Ethereum Cat Herders PEEPanEIP, 6 Feb 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: PEEPanEIP #99: EIP-4736: Consensus Layer Withdrawal Protection with Benjamin Chodroff

Description

Topics covered
-------------------------
0:45 - Guest Intro
3:17 - Intro to EIP-4736 CLWP
7:23 - History of CLWP
13:52 - Set Validator withdrawal address
15:47 - How to CLWP
18:17 - Demo
25:07 - CLWP with Kleros_io & IPFS
27:37 - Ethereum set withdrawal address
32:24 - Air gaps machine & Key management
34:52 - Shoutout to supporting groups
37:25 - Why is this an Interface EIP and not Core EIP?
39:12 - What is the protection available against the attacker on CLWP?
41:00 - Why this is needed as a standard?
43:24 - Clients' team is concerned about enabling this before the Shapella upgrade
46:26 - Stats on Withdrawal address
47:55 - Set up the withdrawal address when you're ready
48:50 - EIP process and status
51:36 - Message to the community

Resources:
-----------------
EIP-4736 - https://eips.ethereum.org/EIPS/eip-4736

Discussion - https://ethereum-magicians.org/t/consensus-layer-withdrawal-protection/8161

PEEPanEIP - https://www.youtube.com/playlist?list=PL4cwHXAawZxqu0PKKyMzG_3BJV_xZTi1F

Shanghai Capella Upgrade - https://www.youtube.com/playlist?list=PL4cwHXAawZxpok0smGmq-dFGVHQzW84a2

Questions for Guests - https://docs.google.com/forms/d/e/1FAIpQLSdsmujnH_ncIlSEJ23s9jzXAKwfpTGNeJqjREWPloBbkJVQTA/viewform

Check out upcoming EIPs in Peep an EIP series at https://github.com/ethereum-cat-herders/PM/projects/2

Follow at Twitter
Benjamin Chodroff @benchodroff | Pooja Ranjan @poojaranjan19

Client Diversity Survey - http://tiny.cc/ECHsurvey

Contact Ethereum Cat Herders
---------------------------------------------------
Discord: https://discord.io/ethereumcatherders
Twitter: https://twitter.com/EthCatHerders
Medium: https://medium.com/ethereum-cat-herders
Website: https://www.ethereumcatherders.com/

A

Foreign episode, 99 I'm pujaranjan here with an interesting ethereum Improvement proposal for your information. Today we will learn about EIP, 4736 consensus, layer, withdrawal protection.

A

Eip 4736 is a standard track interface proposal documented about a year ago. Currently it is in draft status to provide the overview of The Proposal. We are joined by the author Benjamin shardoff. Welcome to the show Ben.

B

Thanks for having me Puja really appreciate it.

A

We'd love to kick off today's conversation with your brief introduction and how you became the part of ethereum ecosystem.

B

Yes, absolutely so: I'm Ben, shadroff I work for HSBC in Shanghai as a digital assets, architect, but just fair disclosure. Those projects or EIP is really not endorsed by my related to my employer, so I've been in the blockchain space since 2013 as an Enthusiast and I've also helped run some crypto asset projects, uh I've also co-founded off chain social, which is a community event where people can meet up with blockchain people and learn more about how crypto projects work.

B

uh I got involved with ethereum back in 2017, uh but this is my first tip contribution.

B

um The interesting fact for this is my validator seed phrase was compromised in 2021, uh so a big part of why I built the CIP which we're going to talk about today was because I I do have a compromise, validator uh seed phrase I accidentally stored it temporarily, while generating it and it was put onto a USB stick which was accidentally backed up and then well I'm human, and we all make mistakes. I should definitely know better.

B

But here here I am um I found out from the gray hat that my validator seed phrase was compromised and they had proof. So I was 100 certain that it's compromised and unfortunately there's not much. You can do about it back in 2021, but I started to think. Well. What could I do to then solve this? Once withdrawals are enabled and I realized. You know what I can still prove. I am the legitimate validator. Now normally, if your seed phrase is compromised, you can't prove who's the attacker and who's the victim.

B

But in this particular case, I know that the deposit address the place where I deposited the 32 Eve is absolutely not compromised and I can still sign a message with it and the attacker can't and that made me realize you know what maybe there's something I can do to actually convince the rest of the world on chain in a way that I am the legitimate owner and I decided to make the most of this very bad situation, learn from it and hopefully try to help others using consensus layer, withdrawal protection, so while I was notified, I have a ticket to race.

B

Sadly, most people are not going to receive this notice, and so I hope everybody can learn from my mistake, help some other people in the similar situation and do this before capella. So with that is the background. Let's talk about what is consensus, layer, withdrawal, protection eip4736.

B

It is an optional way for ethereum validators to set their withdrawal address as early as possible. It is entirely voluntary, it does not change consensus and it's intended for anyone who has not generated and stored their validator seed phrase 100 securely at all times. So that's a lot to unpack, but within that it's basically saying we. We need to be setting these withdrawal addresses and if you don't have 100 certainty, please consider looking at what clwp is for yourself. So setting a withdrawal address is just best practice, good security.

B

Everybody should do it we're going to talk about how many of these everybody's are out there. The clwp community is going to then broadcast your set withdrawal address message to as many Beacon nodes as possible at the capella hard Fork, because we're not changing consensus, nothing's going to get released before capella, but what we're going to do is get a list of volunteers to help broadcast this very quickly into many nodes. This will not exit your validator.

B

It's important to note exiting your validator is an entirely separate step, and this may help in an attack against your seed phrase. If it is compromised, most people do not have to worry at all. Your seed phrase is probably perfectly fine, but in the off chance that it is compromised, this might help meaning it can't guarantee it we're not changing anything at consensus, but it certainly could help.

B

So if you run an ethereum validator, you have a seed phrase for that validator and you've not set your withdrawal address and you're, not 100 certain. Please look into clwp and even if you don't think that you need clwp, maybe you should go look at clwp, nonetheless to see if your validator is in the list, because if it is I'm sorry to say you have a compromised phrase.

B

So when do you have to do this I hate to sound like you know, somebody who's pushing you to go very quickly, but we're asking everybody to do this before February 28 2023 and the reason is because, as best as we can tell sometime in the march-ish time frame, capella hard Fork will launch and we need a bit of time before the hard work to get our project ready to launch. Once your withdrawal address is set, nobody can change it again, and that is both good and bad.

B

The bad news is if you're compromised and the attacker sets it first they win and there's nothing you can do about it once it's on chain. So how do you do this? We're going to show you in this uh today I'll? Do a live demo we're going to use the exact standard tools that come with ethereum? You can use the staking deposit CLI once they release it today, I'm going to show it with eth do, which is a open source.

B

Community contributed tool that generates these clwp submissions, but it's the same tool that you'll use, even if you're, not using clwp. It's how you would generate your set withdrawal address. You can think of this as gossip via GitHub I think this came from each sticker. It's just a very clever way of describing clwp we're not doing anything special. What we're doing is effectively taking the same gossip that will happen at the capella hard fork and just storing it temporarily on GitHub, and it allows them the community to then moderate it using social consensus.

B

So if you take nothing else away from this presentation, never share your seed phrase with anyone ever always, and that includes anybody, who's pretending to be with clwp. We will never ask for your seed phrase and if you want the help, I've got some great links down here and today, I'm going to show the GitHub repository where today, you can also participate in clwp and see all the other submissions as well as put your own in. If you want to join, we will be asking for volunteers sometime later in February.

B

As soon as we see some clients releasing their capella version for the beacon We'll be asking people in the community as well as cops submission uh to be able to load these messages into your node and that will help further secure the entire ethereum community.

B

So what's the history of the CIP, so I already mentioned back in 2021, my particular incident, but I turned out I wasn't alone, I found a thread already happening with youth r d, where we knew that other people in the community sadly, are also having compromised seed phrases for a variety of reasons. It could be scammers, it could be the state Espionage, we've heard it all in the past year. You know if you feel that you've had a compromised, sealed freeze, just just realize you're, not alone.

B

What we talked about is the various different attacks that could be possible and ways we could mitigate it. So a big special thank you to Jim McDonald, York, Peter and others in the youth Community for their help. I think it's fantastic, that we have such excellent researchers and they're already before I even had the issue, thinking about what could happen and how they could mitigate it.

B

um So there are possibilities that can happen a slashing attack with Ransom as possible and or they could drain your validator at capella.

B

um So what we decided was we needed some way of implementing a signed withdrawals list prior to Capella that a node operator could load so about a year ago, exactly I submitted the eip4736 for review, but we're very dependent on the capella spec which even to the state is not finalized, but it's unlikely to change. We're also dependent on how the capella clients themselves are going to implement their version of the capella client. These are also not finalized, so we've been in a draft status for quite some time. I do hope.

B

One day we finalize, uh but the reality is. We have a lot of dependencies that make it difficult to say exactly what the final version will look like the end result, though, is that we're suggesting to clients- and this is entirely suggestive- there's nothing mandatory, we're not changing consensus, we're suggesting to consider the fact that some people will have compromised seed phrases or just aren't certain if their seed phrase is compromised and therefore we want them to be able to receive the gossip request.

B

Early sorry receive the local submission early cash in and then gossip it exactly of the hard Fork. This is effectively a social consensus where any anybody can create a list doesn't have to be the clwp list that I've put together. Literally anyone can decide what list they want to load and then use that within the client that is effectively what the EIP has outlined.

B

So just um about a week ago, we've now launched clwp on GitHub and just today, I've launched it on Claris. So, just broadly, what does that mean um we're using GitHub as the free and easy way it is entirely centralized and I am the sole God of this repository, but I am a benevolent God and I'm going to say as long as I can see, using the GitHub automation that we've built, that your submission is a valid submission. I will include it on in.

B

If, however, we see two submissions for the same validator, then unfortunately I don't know which one's the legitimate one and which one's the attacker in this case, all subsequent submissions for that particular validator index will need to be arbitrated. Now, there's no court in the entire world. That would be a fair court for this particular issue, so we're using a decentralized court called clearos now I'm, not endorsing the project but I. Think it's a very fantastic idea and a good use of decentralized means to solve the problem as fairly as I could possibly imagine it.

B

That being said, if you don't agree with it Fork it, you could do your own list and you can go load your own submissions. However, you see fit so far. To date, we've received actually not 150, but 200 validator indexes to our GitHub repository, and we would recommend people start with the GitHub repository, because it's free and easy and it'll give you an immediate result. If you really want to, you can also use clearos and that allows you to not only upload your submission, but also evidence.

B

So if you want to sign a message with your deposit address or sign in message with your Fierce recipient address, you can add additional on-chain evidence that proves you're the actual validator operator.

B

So the clearos list will be then used to arbitrate any submissions, but people who want perfect privacy could also consider using Claris because it's fully on chain and it doesn't require any sort of sign up. You can do it with a fully decentralized and very private way.

B

So today, I'm announcing AIP on people, so hi fuja, it's great to be talking here and next month, sometime in February, we'll be asking people to volunteer uh we're asking anybody who has a beacon, node can participate. You don't even have to be a Staker. You don't even need 32 each as long as you run a beacon node.

B

You will be able to download the clwp submissions from GitHub and you can load them into your beacon node, and what is this is doing is helping protect the ethereum community as best as we possibly can should mean that once the capella hard Fork happens, your beacon, node client will start to broadcast the gossip which will then propagate through the network.

B

It also means that if a malicious agent were to be gossiping, something that is contradictory to what's in our repository, your local node will receive it realize that it's not valid and then just drop it not further propagating the attack on the network. So the more people that participate in clwp submissions to their Beacon notes, the stronger the network effect, the more gossip, the faster in theory. It should get to consensus now. The theory is also subjective to many things which get into very technical areas. We'll talk about some of those a bit later.

B

We do have some large endorsers. All nodes has endorsed clwp. We welcome more large node operators to help join and protect the community. I think all of them should have a vested interest to ensuring that their own customers are not getting compromised and realistically most people won't know if they're compromised until it's too late, we intend to use low, latency Bots that are going to broadcast these peers messages throughout the capella Fork.

B

So, in addition to our volunteer network, we're really trying to pull out some stops and try to broadcast messages within reason, we're not going to bring down the beacon node chain. We just want to make sure that at least as many of the different clients we can see are receiving this gossip quite early on.

B

So the first question you probably will have is do I even have a withdrawal address like do, I need to go set it, and most people have not looked at this because well, the capella hard Fork is really the first time that we're talking about withdrawal addresses for most people, in fact 63 percent of us. So we'll talk about that later. What I would suggest is the easiest way to find out is to go to Beacon chain.

B

If you go to Beacon chain, you can search for your validate validator by index number and then you're going to click on the deposits tab under the deposits tab you'll see then Beacon chain deposits and you'll be able to then see your withdrawal credentials. Now this is a bit cryptic. It doesn't look like a normal address. You're going to see the beginning of the address either starts with 0x, 0, 0 or 0x01.

B

If it starts with 0x00, it means you have not set your withdrawal address to the execution layer. You must do so in order to receive any way of withdrawing now. You don't have to do it immediately, but our recommendation is, you really should consider setting it as early as possible and again, if you believe your seed phrase wasn't stored securely at all times, then you probably should be using clwp again so 0x00.

B

You need to be looking at clwp, either to set it or to see if you're compromised and there's somebody else submitting on that behalf. Alternatively, if it's already set to 0x01 you're done, there is no way to set it again. It's set for life. The only thing you can do now is to then submit a separate message which is optionally to voluntarily exit. You can voluntarily exit after the Shanghai capella hard Fork again, the date is announced, but sometime around March tentatively could be delayed.

B

How do you clwp I've copied effectively what we have on our GitHub page we're going to go through this right now it looks more complicated than it actually is. It's pretty straightforward and I think as well. These guides were written by myself, I'm really hopeful in the next few weeks, we're going to see much more impressive and much more well-laid out guides than this one, but they're effectively the exact same steps I'm doing it with the utility eth do, which came from Jim McDonald at Tustin in Wheel Tech.

B

The main recommendation I have is: do this process on a clean computer? Make sure that you triple check that the utility does in fact come from the right Source. Do not download from a random location, be careful. So the next thing you're going to do is you have an option.

B

Clwp is providing an easy without a node type alternative. We recognize that some validators were not actually running a beacon node. They may be using a custodial service where they don't have access to the beacon node and they still have to then set their withdrawal address. So if that is the case, we provided what's called an offline preparation file that you can download.

B

The alternative way to run is with an uh offline with a node and you're going to want to go to your beacon, node first run in an online way, where you're preparing the offline file. You'll then copy that offline preparation file to your secure offline computer and then into the exact same step. Again. You're going to eth do validator credentials set pass in your mnemonic set the withdrawal address.

B

It will then create a change operations Json file, which you can then put back onto your USB, stick to put back on your online computer after you've done the change operations Json file you're going to want to triple check it, make sure, for example, that your withdrawal address is set correctly. You can, unfortunately, there's no simpler way to look at the BLS Pub Key. It is not your public address of your validator. It is just the public address of your withdrawal keys and then the signature should not be changed.

B

This is the BLS signature that proves that you, and only you could have possibly generated the signature based on your seed phrase that you're using for these uh different uh index, Pub, Key and execution address. We will verify if it matches after that you're pretty much done, you're going to take that file, upload it on up to clwp and then we're going to use that to then broadcast on out.

B

So the way that clwp is effectively working is if Alice is wanting to legitimately set the withdrawal address and Bob has a compromise set withdrawal address.

B

The hope is again, we can't guarantee it, but we can try our best that we'll have many different clwp volunteers who are going to take Alice's, set withdrawal, address message and publish them to many different Beacon chain nodes around the network at the moment, there's roughly eleven thousand to twelve thousand nodes on the network, so we're not going to cover them all, but we'll cover enough of them sufficiently that it's quite likely that even if Bob were to get to a beacon node that is his own or um not what clwp they'll start to propagate the network and hit other nodes that already have the message set once the node has it set it'll refuse to accept any more gossip or local submissions to it, because it's already been set, this doesn't guarantee you will win.

B

Unfortunately, what has to happen is consensus and because the architecture of capella only sets 16 withdrawal addresses per block, we won't know for a few blocks. Unfortunately, if you were the winner or if Bob was the winner but statistically you're, getting a significant Edge, the more volunteers use the clwp method and it certainly means that you're going to make it in on the first block to to be broadcasting gossip, it doesn't mean you'll get the consensus.

B

Our clwp Bots are going to also try to have many different peers and attempt to broadcast the message to as many as possible as soon as the capella Fork happens.

B

So with that I'm going to switch on over to my terminal and just show just how easy it is. The first thing you'll want to do is come on out to download the eth Do release. They currently now have 1.280.

B

We accept anything 1.270 or later um you'll download this release to your uh secure computer and then once you've downloaded it. You'll then have an eth do release that you can then use on your computer for today I'm doing it online. So just pretend that this is my secure offline computer.

B

The next thing you'll want to do is come on out to clwp I'm following the easy node way, meaning that I don't need to have a beacon note to do it. If you want to do it with your own Beacon node, just look at the documentation for each do it's really straightforward, but this makes it quite simple where you can then download the offload offline preparation, Json and then pick the chain that you're doing it, for we support both mainnet as well as Gorly today I'm going to demonstrate it with gorley.

B

So what I'll do is I'll unpack my offline preparation for gorley. We're then going to move the offline preparation, Gorly file, to call it offline preparation.json.

B

It is now in the same directory as my eth do command line and we're then going to then run the command, so we're going to be doing validator credentials set we're going to be putting in an offline mode. We're going to be passing in a mnemonic and I. Have this handily stored in a variable, and we need to also specify a withdrawal address and again, I have another variable with that. Hopefully, I've remembered it correctly.

B

And it's done it exits with no output, but if you then look at what it created, it has now generated a file called change. Operations.Json. You can open this up using any text, editor and inspect the contents and I highly recommend you do so. The first thing you're going to want to double check is make sure that your execution address is exactly the one that you intended it to be. Once this gets out to chain. You can't change it again, so really triple check this piece.

B

The other thing you should be looking at is how many validators did it find by default. It's actually going to scan all 500 000 Plus validators in the offline preparation file, and it's going to look to see if your seed phrase matches any of them, it's possible. It missed something, and if it did, you need to go figure out why certain types of uh staking providers have had different derivative uh addresses, and so it may be necessary to modify and look at the eth do command to make it work for your particular seed phrase.

B

But if you use the staking deposit, CLI 99 sure it's going to find it, you may have to pass in the passphrase. If you did that too. So the last thing we need for the clwp process is, we need to take this validator index and we're going to make it. This file only has a single validator, so I'm moving my my change operations to this single validator.

B

Now that you've done this, you can come on out to the website for GitHub and look at the Repository I saw actually here we actually have a pull request so, rather than me, uploading mine, I'm just going to go ahead and show somebody else has already made a merge and you can just click on. uh We can just take a look at this existing submission. Thank you, for whoever did this and what's going to happen, is we'll get a merge, a pull request and I'm going to go ahead and prove and run this.

B

These checks will now automatically download the offline preparation, as well as the ethu utilities and it'll actually try to verify to see if this is in fact a valid submission for yourself. If you're trying to submit it, you just need to Fork the Repository, create a fork, and once you have a forked Repository, you can then go into the actual directory for the chain in which you're uploading and simply click on ADD file. Upload files you'll now choose the file that you just created committed on in once you commit it.

B

You can put down the text name down here and commit the changes upon completion. You should be able to then make a pull request back against Benjamin, chadroff consensus, layer, withdrawal protection and you'll. We will then get notified that we have a new submission. Let's go take a look at the one we just started to review.

B

It should be done in just a second here or two all right, we'll let it go, but you get the idea it's going to go ahead and check everything to make sure that everything is in fact a valid uh submission before. Actually, we merge it back. If you don't like the idea of using GitHub and I, don't blame you, um it is centralized and it reveals your GitHub user. We, alternatively, have ClariS. Claris is a decentralized curated list, and a curated list means that anybody can come and make a submission.

B

We can click submit validator up here and you're, going to put the same information that you can find in your file directly on into this curated list, you'll put in the validator index. Let's pull it on up we'll copy in the validator index.

B

The BLS Pub Key, the execution address you'll, then upload the same file in the same format on up to this particular thing: it'll put it into ipfs and if you are contesting another validator you'll need to mention which one you're contesting and if you wish to, and it's purely optional, you can upload additional information where you can put anything that you feel will help prove that you are the legitimate validator operator again.

B

The best information would be on chain information, things like a deposit address, signature or a fee recipient signature, and we have documentation that can help you with those preparations. In order to use Claris, you have to effectively stake again you're going to stake 0.474. If now, while I realize that's, not a small amount of eth, you do get it back after the challenge period, which lasts for one week. If, however, you're found within that period to have an invalid submission, I'm, sorry to say it, you will lose some of that eth.

B

However, if you have a perfectly valid submission, please check with us we'll help you on Discord to make sure you get perfectly valid before you submit. You will get your full zero point: 0.474 eth back. You will not get back the gas fees, but I was testing it earlier, and it's it's not that much in terms of gas right now. Luckily, gas is quite cheap on eighth, so that is the alternative option. To use. Claris I personally would suggest start with GitHub.

B

It's perfectly free it'll, get you all the way to a submission, and only if you're contested, perhaps then consider putting it on Claris or if you feel that you have a compromised seed phrase and you wish to have the additional security Claris will give you that. So, let's take a look at this pull request.

B

Sure enough. It was a valid pull request, we're merging it on in and we have another submission to clwp.

B

So uh continuing on this is a lot of information to take in and I know it's all still coming out quite quickly, but I do encourage everybody to read the withdrawal sky. That ethereum has started, putting together and also check out the PIP, the peep andeep 94, where potas and xiaoi Wong did a really great presentation. Deep dive on exactly what's happening with withdrawals. They go into a lot more detail than I'm covering here today, but at a high level were the things that I find important.

B

You should know that both the Shanghai hard fork and capella hard Fork. You could almost think of them as one.

B

In the same from a Layman's perspective, the difference is one's for the execution layer, the other one's for the consensus layer, but they're happening at the same time, and as best as we can say, sometime around March, maybe later most of the validators out on the beacon chain have not set their withdrawal address, 63 last I, checked, and because that means there's about six about 300, some thousand um that are potentially uh having an issue and although I highly suspect, most of them will be perfectly fine.

B

um If you have a compromised, validated seed phrase, you won't know until it's too late if they set it and therefore we're recommending you to go. Take a look to see if your validator seed phrase has been perfectly secured and whether or not you've set the withdrawal address and if you don't feel it's perfectly secure. We recommend clwp some more details. The submissions for the withdrawal address change are submitted via the consensus layer. This is a bit odd. You probably remember depositing your 32 eth on the execution layer.

B

Well, when you want to set this withdrawal address, you're not going to be interacting with any smart contract at all, you're, actually submitting it directly to your beacon node. In order to do so, you need that private key and the only way to get the withdrawal. Private key is, if you have your Original validator Seed phrase. Sorry to say: if you lost your validator seed phrase, there's nothing anybody can do including clwp.

B

There is nothing in this process that depends on your original deposit address. So, even if your original deposit address has been compromised, since you originally deposited, you still technically don't need clwp. The only thing you need is that validator seed phrase, another interesting thing: the consensus layer, the beacon chain, has no gas, and one we've seen a number of complaints that why do we only get to set our withdrawal address once now? I'm, not the expert on this, but I would speculate.

B

It's probably to prevent the denial service attack, because anybody who has the validator seed phrase can set the withdrawal address. You could, in theory, spam the network with many many requests to go and change the withdrawal address. So to prevent that you can only really set it once and then, after that, nobody's going to listen to it again.

B

Each Beacon chain node can run one or sorry it can run none or is one or even thousands of validators. So a single Beacon node can be running. You know a thousand validators on it or you don't even have to run a single one. Anyone therefore can participate in clwp for free just by loading, these submissions onto a node, you don't even need to have a validator each Beacon node that receives a valid signed message via HTTP will then cache it and then gossip it to the rest of the community.

B

We are hearing that some clients will not support submissions locally before the hard Fork, the only clients that will accept submissions before the hard work at this current time and it may change our prism, Lighthouse and load star. Unfortunately, taku at this current moment is not intending to support local submissions prior to the capella hard Fork, but it's subject to change and if you want to influence that, please talk to the the Techo community once consensus is formed amongst the validators.

B

It will then attempt to include that as a set withdrawal address into a block, only 16 validator addresses can be set into a block at a time and once it's on chain, even if the CLP node had a different, the node must accept it. It is now going to override it once the consensus has been formed. Additionally, only 16 validator exit operations may happen per block and an exit must first have the withdrawal address set. So you can't exit fully with your validator until you first have this withdrawal address set.

B

Setting withdrawal address does not exit your validator, so all I've been talking about today, doesn't actually exit your validator. If you want to do that, you don't need clwp, you need to go. Do that separately.

B

I've put down some exhaustive notes on what it means to have good security for an air gaps machine and your key management I'm not going to read through all this, but I do think it takes a lot to be a Staker. Some people forget, and even people that should know better. Like myself uh have you know learned through the process, how we could still improve what our processes are.

B

So here are some very good suggestions that I'd encourage you all to go and read them, but main points to take away from here are: don't use your normal computer to go and do anything with your seed phrase. It's just too risky.

B

You never know if there's going to be malware or some key logger, that's already on that machine and once it's on there, even if you temporarily turn off your Wi-Fi to do the processor, even if you use a Docker container, I'm, sorry to say it's just going to phone home the moment you reconnect back to the network so just make sure you use a very clean machine and I recommend a Linux USB key or if you happen to have a Mac machine, you can boot it up into recovery mode and that's a perhaps a good alternative.

B

Ideally, you have a dedicated machine that you keep in a cryptographic. Vault we've heard all the uh best practices now look. You need to find what works well for you, but just make sure that it's really really clean and that you keep it offline during the process make sure as well. Your seed phrase is stored offline and, given the recent news with LastPass uh having their compromised I'm fairly, certain LastPass hasn't had all their Master vaults decrypted by this point.

B

But we just don't know if you unfortunately were storing your seed phrase in a password manager such as LastPass, I personally, would be recommending. You need to be considering the the worst case scenario, which is you should probably plan to exit your validator and do it again, because if it's not compromised today, it may get compromised in the future, regardless using clwp as an option that you have.

B

So that concludes my presentation. I do want to call out all the things uh that I have to thank, but before I do so I just want to say you know it's actually been an awesome opportunity. I, don't regret a thing. um I would do it all over again. I've met so many incredible people through this very stupid mistake, and because of that, it's it's actually made me better. So, regardless of what happens at capella, I hope that clwp helps somebody and if nothing else, I've learned a ton from it.

B

So thank you again to Jim McDonald he's done a tremendous amount of work on ethu and he helped us tremendously, with mentoring on clwp and there's. A lot of people have to thank ether. Indeed, the ethereum magicians ethereum cut herders. No, no doubt as well. Thank you.

B

Puja e, Staker, flashbots, claros off chain and all nodes all of these groups and more have really helped make what we've put together possible and thank you especially to tobes, he's created a clwp XYZ website where we're trying to keep the latest information going, and we also have a mailing list. If you want to keep up to date with the latest without having to watch our Discord, so thank you, everybody in advance. If you participate in clwp again, you don't even have to be a validator.

B

If you have a beacon node, you can help us and just load these messages on into your beacon, node and please practice best security. Don't do what I did, but you never share your seed phrase, never store it online, even temporarily, while creating a new validator. Just don't take notes on your your seed phrase. You really really need to take it more seriously. Thank you. So I'll take some questions now. If we have any.

A

Wonderful demonstration and the.

B

A

Was really great, I I love the personal reason behind the proposal like it keeps people vested and, of course they are trying to help many others in similar situations. I think clwp team is doing a great job and collecting communities apart and explaining the proposal to the users really appreciate the contribution here.

B

I hope it helps somebody hit. Somebody definitely.

A

It would be like, while going through the presentation it made me feel that there are- or there could be many more people out there who would be in need of this kind of solution. They may not be that technically Savvy to understand and come up with the proposal, as you did, but I'm sure this is going to be helpful.

B

A

B

And I think it's also something that um look if this is not an incredibly technical solution, um so I think the EIP process. Maybe it was abused. We could have done this with. You know, just a hack, MD article rather than going the full EIP, uh but I do think it's quite great that we're getting some visibility, even if it's not changing consensus or changing the clients, they're things that it can improve ethereum as a community and make it better and more secure.

A

Right and I think I have that, as my very first question here like, why are we proposing it as an interface EIP and not core EIP like? Is there any downside of having the change at the consensus level, because I understand this is very important feature.

B

Yeah, so when we first submitted it, we got a lot of questions as to. Why is this coming in as an EIP? Why don't you submit it to consensus layer, um keep in mind this was done back in 2021, so the consensus layer was just barely um out the door. It wasn't really where it is today. So I think there are perhaps better ways it could have been submitted in retrospect. Nonetheless, we've gotten an audience we've made managed to make something out of it, um but I do think uh it it.

B

Maybe the track is not appropriate, I'm, not quite sure um so. I'll leave it to the community. uh The more important thing was we needed to do something and it got done.

A

I understand that, uh yes, of course, like generally The Proposal Eid, those are available on ethereum repository as of now, mostly they are related to execution layer and because this was a consensus layer, Central change, so confusion was like. Obviously it couldn't have been avoided at the time very well.

B

At the time it couldn't now now it should be better yeah.

A

I hope so like we are working towards improving the process and there's a lot of work going in the background uh for which, like we are trying to have both execution process for submission of proposal and the consensus layer proposal to be in sync or come up with something common that people do not get confused there.

A

So there is this question from one of our audience, so we are putting a lot of trust on clwp board of volunteers. That, whatever is being submitted, is correct. What is the protection available against the attacker? Getting their injury into clwb before an honest, validated.

B

It's a great question: we've not put any like real name verification on the process, we're not anybody, uh disclosing Who's, Who, and even if we did when we wouldn't help really, we wouldn't know if that was the attacker or the victim.

B

um So unfortunately the reality is if an attacker does submit to the GitHub or clearos process, and if the legitimate person doesn't look at it well, they're going to win the reality is they would have won with or without clwp.

B

If there was no clwp, the attacker simply would have loaded that same message on into their Beacon node. You would have never known about it and they would likely win um so we're hopeful. Now that clwp exists. It brings something that was completely opaque before into the light, and if you are legitimate and willing to go and either use the centralized GitHub process or the decentralized Claris process, we can put it through as Fair of a way of moderation, social consensus, censorship as another way kept saying it as possible.

B

You don't have to do it I think it's really intended for people that are compromised. So if you don't like this idea, you don't have to use it, but if you do want to see what is happening with submissions, it's perfectly transparent and it's the same gossip that would have happened with or without clwp.

A

That's so good to know and I think that has partially answered my next question, which was about why this is needed as an ethereum standard.

B

um uh It was hard to get the client team's information, so while the capella spec is excellent as a specification for how the chain itself should behave very specifically saying what is a valid withdrawal address very specifically saying how many uh validators can exit in a given block and what is required for next.

B

All those explicitly documented what was missing- and maybe this is room for improvement- is some of the user experience interactions um and I I find this as a frequent complaint for web 3 in general, which is that the user experience is less than desirable, especially on security, and this is one that I think everybody not just ethereum could take back to then say what should the user experience be when validators were launched, it was not possible to set a withdrawal address now, while that's great from a specification perspective, I would have loved to have set my withdrawal address.

B

It wasn't even quite quite clear to me at the time that my withdrawal address was going to be not dependent on my deposit address. Since this time, I've already created new validators and I've certainly set the withdrawal address. I do think perhaps that more can be done, not just some specifications but also in user experience to make sure that the client teams have consistency on how to handle this, and- and perhaps you know, some improvements can be made going forward.

B

It's not a knock on anything I. Think, there's a time and a place there just really isn't a good way to kind of Define when we have so many different Beacon node clients and they can all make their own choices as to how to implement it. It was a bit confusing, to say the least, when creating a validator, at least for myself,.

A

That's great, um and it is very important that everyone should be aware of the possible threats and if we are aware of any protection better to share.

B

A

B

It's purely optional um nobody's forcing anybody to use clwp, but the reality is with clwp. Hopefully, if an attacker is trying to use it for bad purposes, it'll allow you to see it early that there is potential that you are now in a race and you must go race.

A

Right this brings to my next question.

A

um You mentioned about the client implementation that a few clients are willing to implement it before the upgrade where a withdrawal is going to be enabled I believe they may be having some concerns, and that could be one of the reasons why they are not willing to have this local submission ready.

A

Are we by any chance aware of the concerns or threats that is there why they are not willing to do it before couple upgrade.

B

I I will just say up front. I am not an expert on the beacon uh chain. I have I've done a lot of research to try to gum up to speed as much as possible, um but I at the end of the day, I do kind of have to trust, um Our, Benevolent overlords of the beacon, node clients as to why they're making the choices uh for each client. It is interesting to see that there are some differences in opinion around this um I do think. Sadly, I've kicked a hornet's nest um by having clwp.

B

They realized that there will be potentially lots of lots of people trying to set their withdrawal address and that that can cause instability in any network type setting where, if you have lots of messages all hitting the same time. Well, you could overload and not just um disrupt setting withdrawal addresses, but potentially the entire consensus of the entire chain. So I think that's pretty far-fetched and we're not likely to see that scenario.

B

It's a legitimate concern, so certain clients are taking a more conservative approach and saying: look: do you really buy the spec we're not supposed to set withdrawal address before uh the capella? There's no need to submit it early as long as you had a perfectly safe validator, we can already see that you know other clients are supporting it. Therefore, we don't have to go support um ourselves and I totally respect that I think it's great that they're giving so much attention to ensuring the Safety and Security of the chain and regardless we've found a solution.

B

We don't need every single client team to be participating, I. Think, though it does make sense, in my opinion, to allow local submissions. My personal logic is even if you allow local submissions, you don't need to allow your beacon client by default to spam, the network you could Implement throttles and this would allow then the client to then say sure we'll allow local submissions. But if you try to spam the network like more than a couple messages per second we're just going to locally throttle it at least with a hard-coded variable.

B

This makes the modest compromise that I think is perfectly acceptable and some client teams have gone that route and I think that's the right approach, but again I'm, not an expert I'm sure they know better.

A

Yeah, it's quite fair and we know that if many people will start changing their address, there could be a long wait time as well, because there's a limitation of having only 16 a withdrawal address could be changed but block for 12., correct second block so yeah. It could be a bit um there's an interesting stats that was shared by um Ben from a client development team uh that was like uh it is observed that uh from over 500, 000 plus validator, it looks like 300 000, plus maybe having the old 0x 0 0 validator.

A

They may need to change at some point of time. So having this information available could be really helpful for, like a greater number of users out there.

B

Absolutely I I, don't think it needs to be. Exceptionally, uh you know overstated. You know just because you've not set your withdrawal address doesn't mean that you have less security.

B

um It does mean, though, that you have the potential of some attacker getting access before or after capella and then setting it to without to something that you didn't want set. So I do recommend, set it as early as you feel necessary. If you don't have certainty clwp, but if you have fairly good certainty of your seed phrase, storage and mechanisms, you really don't need to be freaking out about sitting at the BLS is perfectly secure and you're going to be just fine, just set it when you feel it's necessary.

A

Right- and uh there was this discussion and in which it was mentioned that you may want to set up your address when you are ready to actually withdraw your earnings right, it's not needed that you need to do it up front.

B

Yeah and there's even I was talking with some in the community, saying that there were some good reasons not to set your withdrawal address um in certain tax jurisdictions potentially receiving um your withdrawals uh can then be a tax event. Maybe I'm not 100 I'm, not a tax expert. Don't quote me, um but you look at your own situation. I I personally, if I had a friend asking me I would be recommending set it as early as possible.

B

I think it just makes sense to just say lock that thing down you don't want to have a lock it's not set, and if you're getting an attacker who could potentially set it, that's just a bad scenario. So lock it as soon as you feel is necessary. You don't have to do it, though, before capella. If you feel that your seed phrase is perfectly secure, foreign.

A

All right, um we have a few minutes left. So, let's quickly talk about the proposal. The EIP process, anti-present status, I personally feel that this proposal is not a good fit for a draft. This is definitely good for review or probably for the last call. I wouldn't say last call right now, because last call has only 14 days to be finished uh before it could be merged as final, but definitely review unless uh you as an author, feel like that. This is not ready and you are expecting some specs changes there I.

B

Do think a review is probably a better uh status, so we're eager to go into the review. There are probably a few things that need to be minor changed as we're still seeing the consensus, spec not finalized, but nonetheless, overall, the submission is quite comprehensive and it should be considered uh ready as ready enough for review.

A

Right in that case, uh the simple process- I'm sure you are aware by now, you have to just make a full request to move it to review and if we get the specs, Clarity, I hope I before the release of the second public test, and today we are gonna, have first public test, not release um Genesis is happening today and after a week, people may be able to start testing on that test net.

A

So we are hoping that we will get the finalized specs soon and after that, uh as an author, you are open to maybe create another pull request to move it to the last call status. If you want to always ready yeah.

B

I'll I'll certainly do so so uh we will be participating in the jejean uh test net and seeing um how that goes, and using some of that as an opportunity to learn, and then subsequently, it's probably the right time to move this one into the review. At that point, the capella spec should be finalized.

B

um I will mention nothing in this. Eip mentions anything about GitHub. It does not mention anything about clearos. This EIP is not here to endorse myself or or claros as a project. It's just purely trying to suggest to client teams the appropriate way of handling these early submissions and how to potentially mitigate some of the attacks. That could happen.

A

And I think that's a good part of this proposal, because when we are adding any proposal to ethereum repository, it is just added as a standard. The implementation could be different. Like we for your project, you are using clearas as a body who are trying to help mitigate the issues or the concerns. People can use different body, so it's just a standard that is being provided, can be used and whatever that's.

B

Exactly correct.

A

All right um any final thoughts or message for the community out there.

B

um Take away from this, uh hopefully some lessons learned, you know, learn from my mistakes. uh You really need to make sure that that seed phrase at all times is being securely protected, but even if you mess up realize you're, not the only one, um as you can see in the news, uh many many even core developers and other blockchains have made stupid mistakes.

B

um It happens. The best thing you can do from any type of mistake like this is learn from it and ideally pass it along and try to make the most of it. I hope you see that that's what we've tried to do with clwp I sincerely hope that it at least protects everybody that we're doing it here. But if nothing else learn from from what we're we're seeing here,.

A

Getting to know that I'm, not the only one and we have people around to support, definitely provides a lot of conflict. Thank you, uh Ben for uh joining us today. I really appreciate you taking out time to provide overview of EIP, 4736 consensus, layer, withdrawal protection, I'm sure it will be helpful to many validators with the old wallet setup or if we have lost the seed phrase or who may have any kind of issues and have concerns related to the security of their withdrawal address.

A

Looking forward to seeing this proposal and final status, an important announcement before we go, ethereum catheters are collecting users suggestion for clients Improvement. If you run an ethereum node, please take out time to share your response. Make sure your voice is heard to client development. Team link is available in the description and on this note, thank you to all our YouTube viewers for watching and podcast subscriber for listening to this Chapel special episode. Should you have any question on this or any other EIP?

A

Let us know at catheters discard next week we will be back with another interesting talk till then keep watching and listening and keep sharing your love with ethereum Caterers cheers.

A