Chapter 5 — Web3, blockchain and cryptoasset security: design alternatives

Lesson map

Lesson 05 published. Map, example, EX021.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 Generating alternatives"]
  N2["5.2 Analysing trade-offs"]
  N3["5.3 Selecting with partners"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX021"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 Generating alternatives"]
  N2["5.2 Analysing trade-offs"]
  N3["5.3 Selecting with partners"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX021"]

[Learning outcomes]
    |
    v
[5.1 Generating alternatives]
    |
    v
[5.2 Analysing trade-offs]
    |
    v
[5.3 Selecting with partners]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX021]

Learning outcomes

You will (1) generate design alternatives; (2) analyse trade-offs; (3) select a design with partners.

5.1 Generating alternatives

Nadia and the partners' engineers generate alternatives for three design questions. For validator hosting: one vendor, each institution hosting its own, or a mix with one independent operator. For privileged control: vendor key, institutional multisig, or multisig with timelock. For dispute handling: on-ledger reversal by multisig, or off-ledger compensation with the ledger left final. Generating several options before evaluating any prevents early commitment to the first idea. She records each option's description so all participants share the same understanding before discussion of preferences begins.

5.2 Analysing trade-offs

Each option has costs. Self-hosting gives independence but requires skills each credit union must build. A multisig with timelock protects against a single compromised key but slows emergency fixes. On-ledger reversal is convenient but means settlement is never truly final, undermining the pilot's purpose. Nadia scores options against the criteria agreed earlier and highlights where scores depend on uncertain assumptions. She notes that combined choices interact: self-hosting plus multisig spreads control most evenly, while keeping final settlement requires a clear off-ledger compensation agreement among partners.

5.3 Selecting with partners

The partners select self-hosted validators with a fourth independent operator, a 2-of-3 institutional multisig with a 48-hour timelock for upgrades, and an immediate pause that requires two institutions. Disputes are settled off-ledger by agreed compensation. The vendor accepts an advisory role without keys. Nadia documents the selection, the alternatives rejected and why. Agreement among partners is as important as technical merit, because a design one partner resents will be weakly supported in practice. The documented reasoning also helps regulators understand the pilot's safeguards.

Worked example

Partners select four validators including an independent operator, a 2-of-3 multisig with a 48-hour upgrade timelock and off-ledger dispute compensation.

Synthetic case. The design process is synthetic.

Errors and limits

Choosing the first design proposed prevents comparison with better alternatives.

Exercises

• EX021 — Hosting alternatives. Name one validator hosting alternative.
  Show marking criteria

  Rubric: 3 = each institution hosting its own;; 2 = vendor hosting;; 1 = no validators;; 0 = none.
• EX022 — Reversal trade-off. Why reject on-ledger reversal?
  Show marking criteria

  Rubric: 3 = settlement would never be truly final;; 2 = finality;; 1 = too slow;; 0 = none.
• EX023 — Upgrade timelock. What timelock applies to upgrades?
  Show marking criteria

  Rubric: 3 = 48 hours;; 2 = 48h;; 1 = vague;; 0 = none.
• EX024 — Vendor role. What role does the vendor accept?
  Show marking criteria

  Rubric: 3 = advisory without keys;; 2 = advisory;; 1 = key holder;; 0 = none.
• EX025 — Validator total. How many validators does the selected design have?
  Show marking criteria

  Rubric: 3 = four, including an independent operator;; 2 = four;; 1 = three;; 0 = none.

Synthesis

Generating, analysing and jointly selecting alternatives yields designs partners support.

Continue studying — chapter 05 of 12

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →