Rukh Dispute Game

Guarantee disputer liveness using the dispute game

Rukh Library’s Dispute Game

Disputers are critical to the security model of any optimistic interoperability system. It would be accurate to say incentivized disputers are more important to secure optimistic protocols than long dispute periods. As seen with the case of MEV bots, off-chain actors are very good at getting transactions into blocks if there are good financial incentives. The same applies to disputers. With good financial incentives, disputers will report bad message proofs promptly, improving protocol security and allowing for much shorter dispute periods.

The Rukh library allows applications to ensure the availability of disputers by introducing something called the dispute game. The dispute game fixes the misaligned incentives in traditional optimistic interoperability systems. Traditional optimistic interoperability protocols punish oracles for presenting wrong message proofs. The punishment does a good job of discouraging dishonesty. However, it also introduces a problem. Disputers are only compensated if they report wrong message proofs sent by oracles. An oracle behaving honestly disincentivizes disputers from staying around since there is no financial gain. Suppose an oracle goes a few months without sending a bad message proof. There is no economic incentive for disputers to stay. Eventually, they all leave, dramatically weakening protocol security since no one is around to catch oracles when they are dishonest. Even if some disputers stick around, dispute rewards usually go to the first disputer, reducing incentives for anyone but the fastest disputer to stay.

The Rukh library’s dispute game fixes this problem. The game has six steps:

Step 1: Applications set an upper bound for the number of invalid message proofs that the oracle can include in an epoch.

Step 2: The application also decides on the number of points it wants to give the first disputer and how many points it wants to give the remaining disputers for each correct dispute. Giving points to many disputers ensures a healthy network of disputers.

Step 3: Lastly, the application gives the dispute resolver the reward it would like to distribute to disputers after the epoch.

Step 4: During the epoch, the oracle submits invalid yet harmless message proofs to the Rukh library on behalf of the application. The number of invalid message proofs it submits in the epoch must be less than the upper bounds set by the application. The Rukh library’s receive module assumes the oracle is compromised if it hits the upper bound. It then prevents the oracle from submitting new message proofs until the application says otherwise.

Note: Invalid yet harmless message proofs are invalid message proofs for whom messages can’t be submitted because they fail other checks in the Rukh library’s receive module. Oracles can prove they are harmless by presenting the contents of the message proof to the application’s dispute resolvers contract.

Step 5: Disputers have no way of telling whether a message proof is harmless or not. They can only see that this message proof does not match any message from the source chain. So they dispute every invalid message proof they see. The disputers are granted points for correct disputes as dictated by the application.

Step 6: At the end of the epoch, the dispute resolver distributes the reward to disputers proportional to the number of points they have amassed.

The dispute game creates a healthy network of disputers so long as there are sufficient dispute rewards. Furthermore, the Rukh library allows applications to pick whatever token they want to compensate disputers. It allows new projects to use their tokens as utility tokens to secure their products, as L1s do. The dispute game does not introduce a new security incentive system from what developers are accustomed to; developers already do something similar with bug bounties for their applications. Now they can use the same funds that would go to bug bounties to reward disputers for keeping their products safe.

Last updated