Announcing Oxford, Tezos' 15th protocol upgrade proposal

This is a joint post from Nomadic Labs, Marigold, TriliTech, Oxhead Alpha, Tarides, DaiLambda, & Functori.

Following the smooth activation of the Nairobi protocol upgrade on June 24 — and a successful TezDev conference on July 21 — we are happy to unveil our latest Tezos protocol proposal.

For our 15th upgrade proposal, we head to Oxford, home to the world’s second-oldest university in continuous operation, with evidence of teaching happening as early as 1096. As usual, the proposal’s “true” name is its hash, ProxfordSW2S7fvchT1Zgj2avb5UES194neRyYVXoaDGvF9egt8.

The Oxford proposal first and foremost contains two major changes to the staking economics of Tezos. Note that these changes will not be automatically enabled upon activation, if the Oxford proposal is adopted. Instead, bakers will be able to signal their position in a separate vote. The changes in question are:

Adaptive Issuance: a new approach to tez issuance in the Tezos economic protocol, where emission is adjusted dynamically, and tied to the ratio of staked tez over the total supply.
A new Staking mechanism: a reworking of PoS on Tezos, which introduces the new role of staker in addition to the existing delegate (also known as baker) and delegator roles.

In this post we provide an overview of the functionality. For a deeper and more technical description, see the specification document.

Other prominent changes in Oxford (enabled upon activation):

Refinements to PoS penalties and rewards: slashing penalties are made proportional to funds at stake, and new tools for easier management of staked funds are introduced.
Timelocks are back: a new design and implementation of Timelocks has been finalized, addressing security concerns that led to their temporary deactivation in a previous protocol upgrade.
Further improvements of Smart Rollups: new features simplify the deployment of Smart Rollups both on public periodic test networks and ad-hoc dedicated ones.

The protocol proposal also includes other minor changes and improvements which can be found in Oxford’s changelog.

Adaptive Issuance and Staking

Adaptive Issuance, originally introduced as “Adaptive Inflation”, is an evolution of the staking mechanism, adapting the economics of tez to fit better with real-world usage, as argued in the Tezos Agora post “Why adaptive inflation matters for Tezos”.

The proposed mechanism ties the Tezos protocol’s regular issuance of tez (from participation rewards and the Liquidity Baking subsidy), to the ratio of staked tez over the total supply. At the end of each blockchain cycle, the nominal issuance rate is recomputed to nudge the staked funds ratio towards a protocol-defined target of 50%. When the ratio of staked funds decreases and diverges from the target, emission rates will increase, incentivizing participants to stake funds to re-approach the target, and vice versa.

Consequently, the value of participation rewards and the Liquidity Baking subsidy are no longer fixed values determined by protocol constants – they rather change automatically as the mechanism encourages (or discourages) staking of funds.

New Staking Mechanism

A new role — staker — is introduced, in addition to delegate and delegator. It enables tez holders to contribute to a baker’s security deposit without the baker taking custody of their funds, with in-protocol reward sharing.

When a staker provides staking funds, these funds are frozen and are subject to both rewards and slashing, in proportion to their weight in their delegate’s deposit. Stakers can modify or remove their stakes, with the changes taking effect after 5 cycles for staking and 7 cycles for unstaking.

Delegates (or bakers) can configure their staking policy by setting parameters which explicitly state whether they accept staking by stakers, and if so, up to which fraction of their total deposit. By default, delegates do not accept any funds from stakers.

To encourage staking over liquid delegation, staked and delegated funds have different weights in the computation of a delegate’s baking and voting powers: staked funds (own and external) count twice as much as delegated funds.

Additional changes to the staking mechanism and economic incentives are also included in the Oxford protocol proposal. These are independent of Adaptive Issuance and the new staking mechanism, and would take effect from the protocol proposal’s activation:

Delegates will have more control on their frozen deposits via a dedicated interface. There will be no more automatic freezing and unfreezing of deposits.
Double-baking penalties are changed from a fixed sum of 640 tez to 10% of the frozen deposit, making the slashed funds proportional to the delegate’s (and potential stakers’) funds at stake.
Denunciation rewards (for double-baking and double-attestations) are reduced from one half to one-seventh of the slashed funds.
Bakers can have a part of their rewards paid directly to their frozen deposits, making management of staked funds easier.

Activating Adaptive Issuance and Staking

As previously mentioned, approval of the Oxford protocol proposal by the community will not immediately enable Adaptive Issuance and the new Staking mechanism upon protocol activation. Instead, it will enable a per-block vote: a continuous signaling vote giving bakers the opportunity to activate Adaptive Issuance and Staking on Tezos Mainnet.

Concretely, the features guarded behind the voting mechanism are:

Adaptive Issuance (and adaptive rewards).
Ability for delegators to become stakers.
The changes in relative weights for staked and delegated funds for the computation of a delegate’s baking and voting power.

This choice is based on the following considerations:

Separating the acceptance of Adaptive Issuance (and the rest of the guarded features), from other contributions and changes included in Oxford avoids the technical cost of creating, testing, and maintaining two proposals: one with and one without Adaptive Issuance.
It gives the community more time to evaluate and discuss the adoption of the feature, without blocking the protocol amendment process.

The threshold for enabling the guarded features is set to 80% Yes votes out of Yes + No votes — the same used for protocol amendments — to ensure a high degree of community consensus. The vote however differs from protocol amendment votes, in that the voting phase is driven by an exponential moving average (EMA), and there is no quorum. Absence of signaling will count as a Pass vote, which is not taken into account by the EMA. If the threshold is reached, the guarded features will be activated 7 cycles later.

A high-level functional specification of Adaptive Issuance and the new Staking mechanism is given in: “Adaptive Issuance and Staking”. For more insight into the rationale and design choices behind these features, see the original proposal on Tezos Agora and this episode of the Blockchained Evolved Show by Tezos Commons.

Timelocks are re-enabled

The Michelson op-codes enabling support for cryptographic Timelocks are re-enabled in Oxford.

Timelocks address a challenge with blockchain-based transactions, primarily when trading, known as Maximal Extracted Value (MEV). Since a transaction can be observed in the mempool before it is included in a block, a user can exploit knowledge of the pending transaction to their advantage against another user. For example, upon receiving a transaction, a baker could craft a block including this transaction and one of their own such that the sequential execution of these two transactions guarantees a gain to the baker.

The use of Timelocks can mitigate (but not entirely prevent) this kind of value extraction, by enabling the payload of a transaction to be encrypted until it is too late to change the order of transactions.

Timelocks were disabled in the Lima protocol upgrade, following the discovery of a security flaw at the application level. The feature has since been redesigned, and after thorough testing, including an external audit performed by Inference AG, we are ready to re-activate this feature in the Tezos protocol.

Additionally, the new version of Timelock features new client CLI commands allowing users to create, open and verify time-locked chests, as well as to execute the pre-computations required for fast chest generation.

Improvements to Smart Rollups

As with the Nairobi protocol, the Oxford protocol proposal brings several quality of life improvements for Smart Rollup developers:

The rollup origination operation has been simplified. With Oxford, it no longer requires a so-called “origination proof” as an argument. This should benefit projects building on top of the Smart Rollups infrastructure stack.
Similarly to what was already possible for smart contracts, it is now possible to hard-code the origination of Smart Rollups in a chain’s genesis block. This is used in the deployment of EVM rollup on test networks.
A new WASM PVM revision is released (2.0.0-r2). It enriches the set of host functions available for querying the durable storage of a Smart Rollup with a faster alternative to store has.

Tezos evolves, again

We consider the new staking economics proposed in Oxford another good example of Tezos’ ability to evolve and adapt, and look forward to the community discussions on the activation of the Adaptive Issuance and Staking features.

Note that if this proposal is voted in by the community, upgrading to Octez v18.0 (or later) will be necessary for participating in consensus.

In order to allow the community to start testing the Oxford proposal as soon as possible, v18.0~rc1, a release candidate for Octez v18.0, will be published in the coming days. A dedicated protocol test network, Oxfordnet, is also scheduled to launch soon after.

Announcing Oxford, Tezos’ 15th protocol upgrade proposal