When One Leak Pays Forever: Context Binding and the Price of Deterring Collusion

What it is

A game-theory paper modeling when slashable stake deters collusion in threshold-encrypted mempools (Ferveo, Shutter), where a quorum of a decryption committee sells its capability to a front-runner. The core deliverable is a formula for exactly how much stake is enough, not just an argument that stake helps.

How it works

The paper's central result (Theorem A / 4.1) is an exact threshold: a coalition S is deterred if and only if its exposure κ(S) is at least sup_t Λ_t(S), the largest discounted value reachable from a leak at any round t, where Λ_t(S) = Σ δ^(r−t) v_r(S) summed over all rounds r the leak exposes. Theorem B quantifies the reuse penalty concretely: over T rounds with unit value and no discounting, a fully reusable key requires exposure T, while a key bound to its own round (context binding) requires exposure only 1 — so any constant penalty fails to deter if the reuse window grows unboundedly. A bounded reuse window of w rounds caps the needed penalty at w times the largest per-round value. Theorem C turns this into an engineering recipe: when exposure is split across n parties with per-party stake d_i, and authorized coalitions are "any k of n" with reachable value depending only on coalition size m (λ_m), the cheapest deterring per-party stake is max over k≤m≤n of λ_m/m — a closed-form you can plug numbers into.

Preconditions / Affected

Applies to any system where an authorized quorum (k-of-n) holds a capability that, once leaked, keeps working across future rounds unless explicitly revoked — named applications: threshold-encrypted mempools (Ferveo, Shutter), sealed-bid auctions, multi-authority voting, and federated learning under a shared key. The result is calibrated against Ethereum front-running data.

What to do

Per-epoch keys (context binding, where decryption shares are bound to a context tag like an epoch number and revoked/replaced once any leak becomes public) cut required stake from "value of the key's whole lifetime" to "value of one epoch" — per Corollary 4.3, a fully reusable key with constant per-round value v(S) and discount δ requires κ(S) ≥ v(S)/(1−δ), which grows unboundedly as δ→1. The paper warns that revocable modules must actually replace the key material, not just make it non-exportable: "shares that merely cannot be exported do not suffice, because the modules themselves can be handed to a buyer." For multi-party stake design, use the covering-LP solution (Theorem C) or, for simple k-of-n committees, the closed form max_{k≤m≤n} λ_m/m to size each party's bonded stake.

Caveats

The model assumes exposure is charged once, at the moment of leak, and treats a leak as terminal (leaking parties are ejected); it does not model the market dynamics after plaintexts go public. Probabilistic/time-distributed exposure (partial tracing probability) is handled only as an extension in Section 5, not the main results shown here.