Update (Aug 14): I have revised the mechanism substantially again after trying to break the coverage-adaptive version.
The goal is still the same:
If Ethereum provides native delegation, why should a user’s choice of staking company determine where that user’s delegated consensus weight goes?
The current design separates the commercial relationship from L1 routing:
ETH holder
-> native NED pool
-> protocol-routed validators
A wallet, exchange, custodian or wrapper can still provide custody, liquidity, insurance, tax reporting or UX. That commercial choice is not itself a consensus-routing instruction.
Informally, I am still calling this the Flanders Protocol.
Split-neutral routing
For validator i:
V_i = ordinary native effective balance
If it is NED-enabled:
B_i = V_i
otherwise B_i = 0.
B_i is protocol-visible base stake, not a claim about beneficial ownership.
Let D_i be assigned NED delegated principal. The balanced routing target is:
D_i = u * B_i
If one hidden owner splits eligible stake across validator identities:
B_A = Σ_(j in A) B_j
then:
Σ_(j in A) D_j = u * B_A
So validator-identity splitting does not increase target allocation.
More generally, exact split neutrality requires:
g(x + y) = g(x) + g(y)
which under ordinary regularity assumptions gives g(x) = u * x.
The zero-amplification boundary
There is also a limit to what identity-blind selective routing can do.
If delegated weight must produce zero relative amplification for every possible hidden coalition, then full allocation is forced to satisfy:
D_i = D * V_i / S
where S = Σ_i V_i.
That is validator-set-wide proportional indexing.
So selective native delegation cannot simultaneously be identity-blind, non-trivial and exactly zero-amplification for every possible hidden ownership partition.
The question is therefore how to bound selective amplification without an ownership oracle.
Delegation Concentration Envelope
The previous version used the single largest local leverage ratio. That was safe but too sensitive to one outlier.
The replacement is a Delegation Concentration Envelope (DCE).
Normalize:
b_i = B_i / S
y_i = D_i / S
For eligible-base mass m, define:
C(m) = max Σ_i (z_i * y_i)
subject to:
0 <= z_i <= 1
Σ_i (z_i * b_i) <= m
This is a fractional-knapsack upper bound: sort validators by D_i / B_i, highest first, and ask how much delegated principal can actually fit inside base mass m.
A tiny high-leverage validator therefore contributes only its actual delegated mass instead of its leverage ratio being multiplied across a much larger hypothetical coalition.
Proportional splitting leaves this envelope unchanged.
Hard concentration invariant
Define:
E = Σ_i B_i
D = Σ_i D_i
e = E / S
d = D / S
Let κ < τ be the largest pre-NED coalition NED is required to prevent from crossing threshold τ, and:
m = min(κ, e)
NED also has a global effective-weight multiplier 0 <= γ <= 1, normally γ = 1. Effective delegated weight is:
Q_i = γ * D_i
The hard invariant is:
κ + γ * C(m) <= τ * (1 + γ * d)
For Ethereum’s one-third threshold, τ = 1/3.
For any hidden coalition with base share p_A <= κ, its eligible base share is at most m, so by construction:
D_A / S <= C(m)
Therefore its NED-weighted share satisfies:
q_A <= (κ + γ * C(m)) / (1 + γ * d) <= τ
The protocol never needs to identify which validators belong to the coalition.
Flanders earns scale by earning coverage
In the balanced normal state:
D_i = u * B_i
γ = 1.
Then:
C(m) = u * m
d = u * e
The invariant becomes:
κ + u * min(κ, e) <= τ * (1 + u * e)
For an illustrative κ = 32% and τ = 1/3, concentration-only capacity is approximately:
| NED coverage | Maximum D/S from concentration |
|---|---|
| 40% | 2.86% |
| 60% | 6.67% |
| 80% | 20% |
| 88.89% | 50% |
| 90% | 60% |
| 92% | 92% |
Below 32% coverage, the concentration-only ceiling is 2%.
That is intentional. If only a narrow subset opts in, it does not get to absorb a huge native delegation pool.
As coverage broadens, capacity grows. At universal proportional participation, relative amplification tends to zero.
The principle is:
Flanders earns scale by earning coverage.
Three separate risk limits
I no longer think one leverage parameter should do every job.
The design separates:
- the DCE concentration invariant above;
- local principal-agent leverage:
D_i <= ℓ * B_i
- total NED exposure:
D / S <= Λ
In balanced operation:
d <= min(d_concentration(e), ℓ * e, Λ, d_demand)
As an illustrative test vector only, not a mainnet proposal:
κ = 32%,
ℓ = 2/3,
Λ = 1/2
would allow NED to reach a 50% D/S pool at about 88.89% eligible coverage while separately bounding local and system-wide exposure.
Bounded-cost DCE
A client does not need to sort every validator every epoch.
A conservative implementation can maintain a fixed histogram of D_i / B_i over [0, ℓ], round leverage upward into buckets, and scan the buckets from highest to lowest.
With K equal-width buckets:
C_hat(m) >= C(m)
and:
C_hat(m) - C(m) <= (κ * ℓ) / K
For illustrative κ = 0.32, ℓ = 2/3, K = 1024, the worst-case normalized overestimate is about 0.02083% of base stake.
Exceptional safety multiplier
Normal activation must satisfy the hard invariant with γ = 1.
If an involuntary state change later makes nominal NED weight unsafe, the protocol does not need to rewrite every D_i. It can reduce one global multiplier γ.
If C - τ * d > 0:
γ* = min(1, (τ - κ) / (C - τ * d))
Nominal principal stays assigned; effective consensus weight becomes γ * D_i.
Because the nominal DCE and d remain unchanged, the safety calculation is homogeneous and does not create a recursive contraction cascade.
While γ < 1, new NED activation is frozen. Restoring γ upward is activation-like and should consume churn.
The accountable-safety implications of a rapid γ reduction still need dedicated consensus analysis.
Base impairment and eligibility
If an NED validator’s eligible base falls involuntarily:
B_i^old -> B_i^new,
then assigned delegated principal must fall by at least the same proportion:
D_i^new <= D_i^old * (B_i^new / B_i^old)
Excess principal stops creating new consensus weight and enters retirement.
An operator also cannot instantly opt out while delegated principal depends on its base. Voluntary exit is:
stop new allocation
-> retire delegated principal
-> accountability tail
-> clear NED eligibility
This prevents temporary opt-in from inflating network coverage and unlocking capacity that can immediately be rugged.
Consensus weight and MEV
I previously explored making NED attestation-only to avoid MEV leakage. I no longer think that is the cleanest default.
Using different stake bases for finality and proposer selection creates additional complexity across proposer boost, rewards and inactivity accounting.
The current reference direction is therefore:
W_i = V_i + γ * D_i
for stake-weighted roles NED participates in, including FFG, LMD-GHOST, proposer sampling, consensus rewards/penalties and slashable authority.
Proposer boost should be normalized to total W, preserving its scale relative to NED-weighted attesting committee weight.
Sync-committee semantics remain open because assignments are long-lived and light-client-facing.
Execution-layer proposer revenue is a separate economic problem. Priority fees and builder/MEV payments cannot all be reliably measured and forced back into one native pool.
The current design therefore leaves execution-layer proposer revenue with the operator as an explicit operator rent. It is not a routing input.
That means NED pool yield can be below direct-validator return and below LSTs that redistribute MEV. NED also increases total rewarded consensus weight, so the final specification must model issuance and direct-validator yield rather than promising non-dilution.
I would rather expose that trade-off than create another consensus weight system solely to manufacture on-chain MEV sharing.
Bootstrap
Operators can precommit validators to future NED eligibility subject to maturity and sticky exit, while delegators can enter a pending queue.
Pending delegation has no weight, reward or slash exposure. Precommitted validators do not count as eligible coverage, and pending principal does not count as active delegation, until activation.
This gives both sides an on-chain view of intended supply and demand without a bootstrap subsidy.
It does not guarantee adoption. That needs market simulation.
Pool withdrawals and bounded latent liability
NED uses one native pool rather than a dense user-to-validator graph.
Withdrawal shares remain inside the loss-bearing pool while their delegated weight retires and while the NED slashing claim window remains open. A user cannot simply observe likely slashable behavior, request withdrawal, and lock an old NAV before the proof arrives.
The trade-off is pooled latent liability: new entrants can inherit unresolved pool risk inside the finite claim window.
The L1 design accepts that risk to preserve fungibility. Wrappers can provide stricter cohort isolation if desired.
Finite NED slashing window
Ordinary Ethereum attester-slashing evidence does not have a simple fixed age expiry while a validator remains slashable.
So NED cannot simultaneously provide unbounded historical delegated liability, finite final withdrawal with no clawback, and exact assignment of every arbitrarily late loss to the old users who backed it.
The reference design gives the delegated component its own finite claim window:
W_NED = 8192 epochs
This aligns with the current slashings-vector length; it does not mean ordinary Ethereum evidence expires after 8192 epochs.
A timely NED slashing notice preserves pool liability. A withdrawal can settle only after its last NED exposure plus the claim window and after all timely notices affecting it have resolved.
A proof first presented after the NED window may still affect the ordinary validator under normal Ethereum rules if applicable, but it no longer reaches a finalized old NED pool claim.
At current timing this is roughly a 36-day liability window, so the liquidity cost is material.
Historical exposure and proof ordering
For a slashable pair signed at states t_1, t_2, reference NED exposure is:
X_i = min(Q_i(t_1), Q_i(t_2))
If D_i and γ are committed in BeaconState, existing state roots and Capella historical summaries appear usable as commitment points for historical SSZ proofs. Exact proof format still needs specification.
NED also needs accounting separate from the ordinary validator.slashed boolean. Otherwise proof order could hide a larger historical NED exposure.
Track per-session maximum already-accounted exposure X_i^charged. For each timely valid notice:
ΔX_i = max(0, X_i - X_i^charged)
then:
X_i^charged <- max(X_i^charged, X_i)
This makes maximum NED exposure proof-order independent.
The exact delegated penalty schedule and correlated-slashing treatment remain open.
Where this stands
The core is now:
D_i = u * B_i
for split-neutral routing,
C(m) = max Σ_i (z_i * y_i)
subject to:
0 <= z_i <= 1
Σ_i (z_i * b_i) <= m
for hidden-coalition delegated-mass concentration,
and:
κ + γ * C(min(κ, e)) <= τ * (1 + γ * d)
for the hard full-network bound.
I have moved these claims into executable exact-arithmetic models. The latest harnesses cover the DCE approximation, hidden coalitions, split neutrality, γ recovery, proposer-boost normalization, proof-order independence and pooled withdrawal/slashing behavior.
The remaining blockers before an EIP are substantive:
- parameter selection for
κ,ℓ,Λand the claim window, - Pyspec lifecycle/accounting,
- full
effective_balancecall-site audit, - accountable-safety analysis for rapid
γreduction, - sync-committee semantics,
- exact delegated/correlated slashing penalties,
- historical proof format and cost,
- state-processing cost,
- and adoption/yield/issuance modeling.
Related work remains important here: eODS, Rainbow Staking, EIP-7251, and EIP-7685.
I do not claim native delegation, pooled staking or proportional allocation themselves as novel.
The narrower question is now:
Can Ethereum provide a provider-neutral native delegation path whose ability to scale is tied to broad validator participation, while bounding the additional consensus leverage created by delegated capital without relying on a real-world ownership oracle?
Working name: Native Ethereum Delegation (NED).
Informally: the Flanders Protocol.