Polygon and technical risk
Polygon has some areas in which it shines in process quality, but also has some areas which seem too rushed to allow us to feel fully confident. Let’s dig into the details downstairs 🪜
Polygon has a relatively good technical risk rating. However, for the next 6 months, their score is suppressed due to chain downtime as per guidance. With this nastiness out of the way, let’s consider what they do well. https://thedefiant.io/polygon-outage-node-halt/
Polygon’s commitment to decentralisation is a step in the right direction. It has 100 validators, with many more queuing. These nodes are in many different locations around the world, promoting network security. https://polygon.technology/staking/
A potential cause for alarm is the hard cap (in its current state) of 100 validating nodes. No more slots are open. This stops further decentralisation (from an admittedly small selection of nodes) — maybe no cap sers? Polygon chose scalability, and this is the cost.
Polygon has TWO separate node implementations (Bor and Erigon) — something that it should be credited for. We’d value more! Users are also provided with simple instructions on how to run an archive node — boosting decentralisation & network strength.
However, the cost of getting a validator slot is extremely high (by our count $130K) and there is no proper node count viewer like ethernodes.org — this reduces transparency. To view the full node count, you must run a node yourself. Easier verification is preferable.
Link: https://www.stakingrewards.com/savings/one1efld6lrq5huppf35skdhgc9ek0kfv99klqf7vv/ — here’s an example of the staking requirement to get a validator slot
Furthermore, their node implementation upgrade process seems poorly coordinated. There is no formal PIP infrastructure (aside from one interesting yet ancient proposal). Most updates to software are merely instructional. https://forum.polygon.technology/search?q=PIP
Chain upgrade proposal forums such as the ones on Ethereum would be ideal to emulate — see https://eips.ethereum.org/core
It’s unclear how improvements are pushed to the production version of the node software — a possible single point of failure. Some commits in the latest release are from months prior whereas others are from the day of release. We couldn’t see discussion for these anywhere.
Polygon have extensively documented their dual-consensus architecture. This is critical for security researchers to understand how the network operates. This is good process and is fully traceable for leisurely perusal: https://pkg.go.dev/github.com/maticnetwork/bor
They’ve even polished this offering with a beautiful $2M bug bounty — a laudable security feature that will bring some of the sharpest eyes in DeFi to scrutinise this chain’s every nook and cranny. To assist them, @Polygonscan is a fantastic tool for checking the chain.
Nonetheless, we’d like chains to offer higher bug bounties in general. Given the amount of capital at stake, it makes sense to offer much higher bounties than protocols. @Makerdao have $10M on offer — this should be matched / surpassed by @0xpolygon et. al.
While there’s proof of massive testing (their repository contains over 300,000 lines of code) with a high code coverage percentage, there’s room for a public audit. We’ve been made aware of a public audit from 2020 on Bor, but we can’t award points for private audits.
@0xpolygon — wen public audit? We’ve even seen it courtesy of @mudit__gupta) but due to the importance of objectivity DeFiSafety cannot award points based on privileged information. Listening to @GNSPS at ETH Denver, we know they poured their heart and soul into it :’)
We want to award the points deserved here but we can’t. Given the weight we place on audits, this would significantly increase our score for good process. Mudits… I mean audits should be public because CT code wizards need to be able to verify their contents.
We’d also like @0xpolygon to consider formal verification testing. Polygon has innovated heavily in consensus, so double checking would add much security.
Ethereum has done this, so it makes sense that something seeking to scale Ethereum should scale with similar security measures. While this test is expensive and time consuming it is close to the last word in ensuring minimal technical risk.
So, Polygon has made some steps in the right direction. It has decided where it will place itself in the blockchain trilemma, and as a consequence the number of nodes suffers relative to other networks.
The docs are good: Polygon has spent considerable time explaining chain operation and incentivised whitehatting through a scrumptious bug bounty offering. They’ve also done a good job at geographically decentralising the nodes.
However, there’s a limited validator count that we’d like to see expanded. We’d also like them to further increase the number of node implementations they offer. Publicising the audit they had done as well as perhaps even getting a new one would be optimal!
A clearer improvement discussion system would also go some way in improving process. For our @0xpolygon technical risk checklist , a public audit is our priority number one.
All this amounts to a relatively secure network thanks to significant (yet incomplete) steps in the direction of greater distribution which in turn is supported by some good technical risk infrastructure. More is yet to be done, but their new CISO is an impressive hire.
We’re hopeful that he will be equipped with the tools he requires to really grow their network into one of the titans of process quality on the chain-layer. Polygon is aiming extremely high with @0xPolygonNF and @polygonstudios, alongside its already expansive native offering.
We know they know the importance of carefully developing their infrastructure to support assets stored on all of these exciting new layers. We know they know how to do it. We’re excited to see it all come together, but there’s much to do first.
