EIP-4881: Deposit Contract Snapshot Interface

Establishing the format and endpoint for transmitting a snapshot of the deposit Merkle tree

Metadata

Status: FinalStandards Track: InterfaceCreated: 2021-01-29

Authors

Links

GitHub page Discussion on Ethereum Magicians

Abstract

This EIP defines a standard format for transmitting the deposit contract Merkle tree in a compressed form during weak subjectivity sync. This allows newly syncing consensus clients to reconstruct the deposit tree much faster than downloading all historical deposits. The format proposed also allows clients to prune deposits that are no longer needed to participate fully in consensus (see Deposit Finalization Flow).

Motivation

To reconstruct the deposit Merkle tree, most client implementations require beacon nodes to download and store every deposit log since the launch of the deposit contract. However, this approach requires beacon nodes to store far more deposits than necessary to participate in consensus. Additionally, this leads to increased sync times for new nodes, which is particularly evident during weak subjectivity sync. This simplistic approach also prevents historical contract logs from being pruned from full nodes, a prospect frequently discussed in the context of limiting state growth.

Specification

Consensus clients MAY continue to implement the deposit Merkle tree however they choose. However, when transmitting the tree to newly syncing nodes, clients MUST use the following format:

Where finalized is a variable-length list (of maximum size DEPOSIT_CONTRACT_DEPTH) containing the hashes defined in the Deposit Finalization Flow section below. The fields deposit_root, deposit_count, and execution_block_hash store the same information as the Eth1Data object that corresponds to the snapshot, and execution_block_height is the height of the execution block with hash execution_block_hash. Consensus clients MUST make this structure available via the Beacon Node API endpoint:

Deposit Finalization Flow

During deposit processing, the beacon chain requires deposits to be submitted along with a Merkle path to the deposit root. This is required exactly once for each deposit. When a deposit has been processed by the beacon chain and the deposit finalization conditions have been met, many of the hashes along the path to the deposit root will never be required again to construct Merkle proofs on chain. These unnecessary hashes MAY be pruned to save space. The image below illustrates the evolution of the deposit Merkle tree under this process alongside the corresponding DepositTreeSnapshot as new deposits are added and older deposits become finalized:

deposit tree evolution

Rationale

The format in this specification was chosen to achieve several goals simultaneously:

Enable reconstruction of the deposit contract Merkle tree without requiring full nodes to store all historical contract logs
Avoid requiring consensus nodes to retain more deposits than necessary to fully participate in consensus
Simplicity of implementation (see Reference Implementation section)
Increase speed of weak subjectivity sync
Compatibility with existing implementations of this mechanism (see discussion)

The proposed DepositTreeSnapshot structure includes both execution_block_hash and execution_block_height for convenience to consensus node implementors. While only one of these fields is strictly necessary, different clients may have already designed their block cache logic around one or the other. Sending only one of these would force some consensus clients to query the execution engine for the other information, but as this is happening in the context of a newly syncing consensus node, it is very likely that the execution engine will not be synced, especially post-merge. The deposit_root field is also not strictly necessary, but by including it, newly syncing consensus nodes can cheaply validate any received snapshot against itself (see the calculate_root() method in the Reference Implementation).

Why not Reconstruct the Tree Directly from the Deposit Contract?

The deposit contract can only provide the tree at the head of the chain. Because the beacon chain's view of the deposit contract lags behind the execution chain by ETH1_FOLLOW_DISTANCE, there are almost always deposits which haven't yet been included in the chain that need proofs constructed from an earlier version of the tree than exists at the head.

Why not Reconstruct the Tree from a Deposit in the Beacon Chain?

In principle, a node could scan backwards through the chain starting from the weak subjectivity checkpoint to locate a suitable Deposit, and then extract the rightmost branch of the tree from that. The node would also need to extract the execution_block_hash from which to start syncing new deposits from the Eth1Data in the corresponding BeaconState. This approach is less desirable for a few reasons:

More difficult to implement due to the edge cases involved in finding a suitable deposit to anchor to (the rightmost branch of the latest not-yet-included deposit is required)
This would make backfilling beacon blocks a requirement for reconstructing the deposit tree and therefore a requirement for block production
This is inherently slower than getting this information from the weak subjectivity checkpoint

Backwards Compatibility

This proposal is fully backwards compatible.

Test Cases

Test cases are included in test_cases.yaml. Each case is structured as follows:

This EIP also includes other files for testing:

deposit_snapshot.py contains the same code as the Reference Implementation
eip_4881.py contains boilerplate declarations
test_deposit_snapshot.py includes code for running test cases against the reference implementation

If these files are downloaded to the same directory, the test cases can be run by executing pytest in that directory.

Reference Implementation

This implementation lacks full error checking and is optimized for readability over efficiency. If tree is a DepositTree, then the DepositTreeSnapshot can be obtained by calling tree.get_snapshot() and a new instance of the tree can be recovered from the snapshot by calling DepositTree.from_snapshot(). See the Deposit Finalization Conditions section for discussion on when the tree can be pruned by calling tree.finalize().

Generating proofs for deposits against an earlier version of the tree is relatively fast in this implementation; just create a copy of the finalized tree with copy = DepositTree.from_snapshot(tree.get_snapshot()) and then append the remaining deposits to the desired count with copy.push_leaf(deposit). Proofs can then be obtained with copy.get_proof(index).

Security Considerations

Relying on Weak Subjectivity Sync

The upcoming switch to PoS will require newly synced nodes to rely on valid weak subjectivity checkpoints because of long-range attacks. This proposal relies on the weak subjectivity assumption that clients will not bootstrap with an invalid WS checkpoint.

Deposit Finalization Conditions

Care must be taken not to send a snapshot which includes deposits that haven't been fully included in the finalized checkpoint. Let state be the BeaconState at a given block in the chain. Under normal operation, the Eth1Data stored in state.eth1_data is replaced every EPOCHS_PER_ETH1_VOTING_PERIOD epochs. Thus, finalization of the deposit tree proceeds with increments of state.eth1_data. Let eth1data be some Eth1Data. Both of the following conditions MUST be met to consider eth1data finalized:

A finalized checkpoint exists where the corresponding state has state.eth1_data == eth1data
A finalized checkpoint exists where the corresponding state has state.eth1_deposit_index >= eth1data.deposit_count

When these conditions are met, the tree can be pruned in the reference implementation by calling tree.finalize(eth1data, execution_block_height)