Introduction
Ethereum aspires to be a credibly neutral infrastructure layer enabling censorship-resistant applications. Successful execution of this mission hinges on maintaining decentralization and neutrality of the protocol. The mechanisms that manufacture blockspace are critical to Ethereum delivering on its promise.
Under proof of work, Ethereum miners had unilateral leverage in including and ordering transactions. Since then, a labyrinthine supply network has emerged with responsibilities distributed across validators, builders, searchers, relayers, and other opaque off-chain actors. This reflects a natural maturation and evolution of the ecosystem, but the complexity introduces new risks. Centralization and chokepoints at any of these layers can enable censorship and discredit the core ethos and values of Ethereum. Understanding the incentives in the supply network is thus essential.
This series explores the past, present, and future of the Ethereum supply chain. In this part, we cover the evolution of the supply chain from proof of work (PoW), to proof of stake (PoS), proposer-builder separation (PBS), and MEV-Boost. We then analyze issues that threaten the network’s neutrality today. This will provide background for future parts that analyze proposals to mitigate these issues.
The Past: Proof of Work Ethereum
Under proof of work, the inclusion and ordering of Ethereum transactions was entirely in the hands of miners. With no mature markets for targeted blockspace, searchers captured MEV by participating in priority gas auctions (PGAs). Searchers competed for top-of-block blockspace by bidding higher gas in the mempool, and probabilistically frontran and backran target transactions by sending transactions with the same gas price.
This method of MEV extraction had severe externalities on the chain. Mempool bloat and failed transactions landing on-chain led to inefficient usage of resources. To combat this, Flashbots launched Flashbots Auction, a centralized, out-of-protocol relay for MEV bundles. Under Flashbots Auction, searchers sent bundles along with bids through the Flashbots-operated bundle relay. Miners with access to Flashbots Auction ran mev-geth, building blocks while promising not to break bundles.
Flashbots Auction successfully moved MEV markets off-chain, mitigated some centralizing effects of MEV by commoditizing the searcher layer, and made the extraction of MEV more efficient. However, it relied on honest behavior from the relay operator (Flashbots) and active policing of miner behavior.
The Present: Proof of Stake Ethereum
Under proof of stake, staked validators replace miners as block producers. Validators must stake a minimum of 32 ETH to participate in consensus. Stakers receive rewards for locking their ETH and participating in consensus.
Because validators are now block proposers, proposer centralization can become an issue. In Vitalik’s PBS notes and original proposal for proposer-builder separation (PBS), he notes
While normal PoS rewards are reasonably egalitarian, as single validators earn the same rate of return as powerful pools, there are significant economies of scale in finding sophisticated MEV extraction opportunities. A pool that is 10x bigger will have 10x more opportunities to extract MEV but it will also be able to spend much more effort on making proprietary optimizations to extract more out of each opportunity.
An out-of-protocol solution like Flashbots Auction does not work out-of-the-box under PoS. Recall that Flashbots Auction relied on the honesty of the relay operator and on block producers (miners). If a mining pool was detected to have bad behavior, the relay operator could simply cut off its access to bundles, incentivizing good long-term behavior. But under PoS, it is difficult to credibly penalize bad behavior while allowing small stakers to participate.
Centralization of stake to a small number of operators is a threat to Ethereum because it reduces the network’s censorship resistance and resilience to attacks.
Proposer-Builder Separation
The current solution for this issue is proposer-builder separation (PBS). Under PBS, block building is delegated to a third party, with the block proposer (validator) only needing to sign the winning block header.
Today, PBS is implemented via MEV-Boost, a sidecar to validator clients built by Flashbots. Under the MEV-Boost architecture, searchers send bundles to block builders. Block builders build blocks, then send block headers and bids through block relays to the current proposer. This moves MEV-driven centralizing forces from the validator layer to the block builder layer.
Under MEV-Boost, searchers must trust the block builders they send bundles to, just as they trusted bundle relays and miners under Flashbots Auction. Block builders must trust block relays to not modify their blocks. And the block proposer must trust block relays to be honest about bids, and also to propagate the block once they receive the signed block header. The block relay intermediates trust between block builders and block proposers.
At the time of this article’s writing, 93% of Ethereum blocks are proposed by validators running MEV-Boost.
Issues
While MEV-Boost addresses MEV-driven stake centralization, it is not a panacea to Ethereum's problems. With it comes a new set of issues.
Relay centralization and censorship
The MEV-Boost implementation of PBS places a critical dependence on external, centralized block relays with no direct business model. These relays need to be trusted by block builders and validators, but it can be profitable for relays to deviate from honest behavior. Because there is no direct incentive to run a relay (and a fee cannot be sustainably taken without cartelizing), there is little relay competition, and six relays account for 99% of MEV-Boost blocks.
Without a direct incentive to run a competitive relay, relay operators must either altruistically fund public goods, or verticalize themselves.
These centralized relays are obvious vectors for censorship. Some relays have been observed to censor blocks containing transactions that interact with blacklisted addresses.
Dependence on out-of-protocol software
93% of blocks go through MEV-Boost today. This core dependence on an out-of-protocol piece of infrastructure can be dangerous to the protocol. These concerns are not just theoretical. On April 3, 2023, the low-carb-crusader exploited a relay implementation vulnerability to extract over $20m. Because the relay did not verify that the signed block header was valid before exposing the block body to the proposer, the proposer was able to unbundle sandwich bundles in their block and propose a very profitable block at the expense of the sandwichers.
Even after this implementation bug was mitigated, it is still possible for a dishonest proposer to sign the correct block header from the relay, then view the block, then propose another block (with unbundled bundles) and race the relay’s block propagation.
In general, the surface area of potential attacks on Ethereum is larger as client teams need to account for not just the core Ethereum consensus spec but also changing sidecar specs.
Builder centralization and censorship
As noted above, PBS isolates the centralizing effects of MEV to the block builder layer, away from the consensus layer. While this is an improvement, it leads to centralization at the block builder layer, as block builders with the strongest trading and MEV extraction capabilities are able to build the most valuable blocks. Block builders integrating their own searchers, as predicted in MEV Markets Part 2: Proof of Stake, is centralizing by increasing the barriers to entry for the builder market.
Today, 88% of MEV-Boost blocks are built by just 4 block builders, two of which are integrated searcher-builders.
Centralization at the builder layer is a vector for censorship. Some builders have been observed to censor transactions that interact with blacklisted addresses.
Private Order Flow
As block building centralizes, order flow naturally consolidates. When users send transactions to the public mempool, their marginal value to a block builder goes to zero: if a transaction is available to all block builders, no builder has an asymmetric edge including the transaction and the value of the transaction is captured by the block proposer. If transactions are instead sent to a single block builder, the builder can withhold this value from the block proposer, keeping some and returning some back to the application or user.
At a high level, users and applications can sell the right to execute their transactions, thus capturing the MEV they generate. MEV Markets Part 3: Payment for Order Flow explores this idea in more detail. Today, private transaction relays exist where users can auction their order flow to builders (MEV-Share and MEV Blocker). Other private order flow deals have been observed with applications and wallets selling their order flow. Exclusive transactions (transactions not observed in the mempool) made up 30% of landed transactions from June 1 to July 15 of this year, including searcher bundles.
In theory, this produces better outcomes for users and applications, who can now capture the value of their order flow rather than leaking it to the base layer. But private order flow is centralizing because most order flow goes through a few chokepoints. For example, if Metamask sent its transactions through a single builder, that builder would likely dominate block building. Proliferation of private order flow also increases the barriers to entry to compete as a block builder, as new builders begin with no exclusive access to order flow.
In Order Flow, Auctions and Centralization I, the author notes that exclusive order flow can lead to lower competition in the builder market, resulting in rent extraction, poor user experience, censorship, and influence over the network.
Conclusion
In this part, we covered the evolution of the Ethereum supply chain from past to present. We also explored various problems that arise due to tradeoffs made in the past, observing that these have led to centralizing tendencies.
In the next part, we dive into enshrined PBS, which is a protocol-level proposal to minimize the reliance on out-of-protocol relays. In-protocol PBS ultimately represents “The Scourge” in the Ethereum roadmap, which aims to ensure credibly neutral transaction inclusion and mitigate MEV-driven centralization. We will explore several ideas and proposals that make up the ePBS roadmap.
To collaborate with us, please reach out to collaborators@umbraresearch.xyz.