The public nature of a blockchain is by design; as a verifiable public ledger all transactions are published to the blockchain. By default every transaction can be seen by everyone, including “competing interests.” The Keep protocol was developed to bridge the worlds of secure private data and public blockchains.
With Keep, small amounts of sensitive data, such as private keys, can be stored off-chain but used in smart contracts on-chain in a trustless manner. The trustless component is possible due to the development of Keep’s Random Beacon, a source of true randomness that makes collusion virtually impossible.
Keep’s other major innovation is its ability to allow private data, held off-chain but stored online in nodes, to be used extensively on a public blockchain. The containers holding this data (keeps) can be created for a variety of functions such as proxy re-encryption. Keep is well-positioned to address the privacy needs that would enable broader adoption of public blockchains with private data.
Keep is bridging the gap across blockchains by allowing tokens to be moved between protocols. For example, because the Bitcoin blockchain wants to remain simple and secure, it has been difficult for people to use Bitcoin for financial transactions such as collateral for a loan or to interact with DeFi like Ethereum. To address this, Keep has developed a way to securely use Bitcoin on other blockchains (starting with Ethereum) without losing the features of Bitcoin which make it desirable as cryptocurrency.
How Keep Works
These are the fundamental concepts to understand about the Keep network:
keeps: “small off-chain data containers for private storage and computation that can be opened, closed, and managed by smart contracts autonomously.” There are many types of keeps, and each type is purpose-built. Keeps are maintained by node operators who receive fees in return. Every type of keep requires a different number of nodes to service the keep, all of which are chosen at random from the large pool of available nodes.
KEEP token: the native work token required for an entity to become a member of the Keep network and be eligible to earn rewards for performing work on the platform. “Work” is defined as the computation and availability required of a node to select and pull keeps together and read the associated data.
Distributed Key Generation (DKG): a cryptographic process in which multiple parties contribute tothe calculation of a shared public and private key set. This process prevents single parties from having access to a private key.
Random Beacon: the trusted source of randomness for the process of trustless group election on Keep. The Beacon selects providers for each new keep (data container).
Signing Group: the group of Keep nodes essential to sign activities on-chain; nodes never sign alone. For example, the Random Beacon requires a group of 64 signers.
The First dApp on Keep: TBTC
TBTC is a 1:1 Bitcoin-backed ERC-20, the first token to be minted via a decentralized protocol; one TBTC can be redeemed for 1 BTC. Because it is Bitcoin on Ethereum, not the price of Bitcoin on Ethereum, this token allows Bitcoin to be used in Decentralized Finance (DeFi). TBTC is only possible because of the innovations within Keep that allow for private keys to remain secret while also participating on a public blockchain.
TBTC functions in a two-sided marketplace. As with most financial products, TBTC needs usage and liquidity to be useful. First and foremost, there have to be BTC deposits and ETH stakers.
To facilitate reaching critical mass, the Keep team plans to heavily incentivize participation in the first 24 months. Stake Drop is a mechanism by which users with ETH, but no KEEP, can stake and participate in the Keep network, and be rewarded with KEEP and signer fees.
Because KEEP is a work token, and the entire token supply exists at launch, the network does not have an inflation rate. Keep plans to incentivize mass participation from the start, rather than over the first few years, by using Stake Drop to distribute KEEP.
Through Stake Drop, 20% of KEEP tokens (200m) will be distributed as a subsidy to participants running the TBTC keep as well as the Random Beacon keep. This will ensure enough ETH is staked on the network and will reward users for nodes running the TBTC keep more than those only running the Random Beacon keep. The full subsidy details are here, courtesy of the Keep team.
For the first 6 months, participants only need to stake ETH and are not obligated to have KEEP, although staking KEEP during this period substantially increases the probability of being selected to perform work and earn rewards. After 6 months, they will also need to stake KEEP to continue participating but will likely have earned enough from rewards to do so.
Read more about actively participating on Keep in our guide.
Staking KEEP and ETH as a TBTC signer
Node operators that run a TBTC keep must stake ETH along with KEEP to participate and receive rewards. During the Stake Drop, you only need to stake ETH. Rewards will come in the form of KEEP from Stake Drop and signing fees paid in TBTC.
Staking ETH and KEEP would increase rewards by 11% over ETH-only staking during the Stake Drop. In addition, staking both would increase the node’s chance of being selected to create TBTC by 20-30%, which would maximize participation sooner than ETH-only nodes.
18% of the total KEEP supply (180m) will be rewarded to TBTC signers through Stake Drop. The amount any individual node will receive depends upon the amount of ETH staked to the node. Because the amount of work (percentage of the total) any node is asked to do is equivalent to the percent of total ETH the node has staked, rewards will depend greatly on both an individual’s stake and the total stake.
At launch, fee rates are 5bps (0.05%) per BTC in a deposit; this rate will increase as the TBTC network scales and is expected to total 2-4% per year of the TBTC market cap in the medium- to long-term. The only fee charged by the TBTC system is the signer fee which is escrowed when a singer mints the TBTC and is paid out to the signers when the deposit is redeemed.
Staking KEEP as a Random Beacon Signer
Of the 20% of tokens distributed through the Stake Drop, 2% percent will go to KEEP holders running nodes with the Random Beacon keep.
At the end of the first year, this results in a reward rate of 4-5%.
The nodes will also earn signer fees for their participation in the Random Beacon, but these will likely be minimal until usage of Keep hits critical mass.
Risks of Participation on Keep
There are two primary risks in Keep: Signer Failure and Signer Fraud.
Signer failure - Random Beacon
In order for the network to know your node is ready to work, signing nodes must continuously submit tickets indicating they are ready to participate in DKG as a signer.
When a random beacon signing request comes in, your node could get selected to sign.
Only half of a signing group (32 nodes) must sign for a signature to be successful. As long as at least 32 nodes sign successfully, no one will be slashed. However, because the network can not attribute fault, all nodes in the group are penalized equally if a signature fails.
Slashing will be as follows after launch:
• 1% of the minimum stake for the first 3 months
• 50% of the minimum stake between the first 3 and 6 months
• 100% of the minimum stake after the first 6 months
Signer failure - tBTC
Signers not responding to a tBTC redemption request in a timely manner constitutes a signer failure.
A signer has 3 hours to provide a signature from the time of the request. After three hours, anyone can submit a proof that the node is late, which puts it into liquidation. Note - no KEEP tokens are slashed if this happens!
All failures are treated as protocol aborts, and initiate the abort liquidation flow. Signer bonds are seized and auctioned off for tBTC so that the user can be reimbursed for their inaccessible funds, and half of the remainder of the signer bonds (a maximum of 1/6th of the original bond) are returned to the signers.
Signer fraud is the only action in the tBTC system that leads to full, punitive slashing.
Any signing group that moves Bitcoin without authorization by the tBTC protocol is slashed, burning their KEEP and seizing their entire ETH bond for user recourse.
A single signer cannot complete this action to grief the other signers in its group as it only has one of the three shards for the Bitcoin private key. (Griefing means that you’re willing to take a loss to make someone else take a loss as well.)
Fraud is proven by presenting the unauthorized signature on-chain as a fraud proof. Anyone can present a fraud proof and receive the ETH left over after auctioning of signer bonds.
Signer fraud is punished in both tBTC and Keep ECDSA protocols.
At the tBTC layer, the fraud liquidation flow is enacted and bonds are used to purchase tBTC. The holder of the tBTC Deposit Token is compensated in tBTC, unless the deposit is backing currently-circulating tBTC. In this case, the tBTC is burnt to maintain the 1:1 supply peg.
At the Keep layer, the signer is slashed and their KEEP tokens are burned, potentially removing them from the candidate pool. Slashed signers are not only losing their capital, but opportunity for future fees.
“The Bison Trails team is phenomenal. They've been deeply committed to Keep, and have been a huge help moving our protocol design and development forward. The Keep network requires an abundance of reliable, distributed, and secure nodes, making Bison Trails a strong partner and a great choice for Keep token holders and anyone joining our stakedrop June 8th.” —MATT LUONGO, CEO AT THESIS / KEEP NETWORK’S PROJECT LEAD
Running a Keep Node with Bison Trails
Bison Trails was one of the first outside providers spinning up nodes on Keep; we started in June 2019. Since then we have provided feedback that resulted in protocol parameter changes for infrastructure uptime requirements and made the first feature addition not by the Keep team to improve how their infrastructure is configured. Our pull request was merged here.
Our platform is purpose-built to run multiple nodes securely and reliably —perfect for a work token network like Keep that needs node diversity and high availability. In addition, there are three roles, with a related address, used for the set up and management of a Keep node:
The owner/authorizer non-custodially delegates KEEP or ETH to the node.
The operator runs and maintains the node.
The beneficiary receives the participatory rewards and signing fees.
This delineation allows using non-custodial infrastructure providers, such as Bison Trails, to run nodes with a simple and straightforward process.