I estimate that computing a custody bit comes at a CPU cost of ca. 1-5ms: The main computation is just to compute a Universal Hash Function, which is just evaluating three polynomials of degree 2^13 with coefficients in a 256-bit prime field. (Additionally 10 Legendre bits have to be computed at a cost of a few microseconds each, that part should be much cheaper). This is probably fairly trivial compared to loading the actual data required to do this from disk.
If you police all past committees you were a member of, then this would mean instead of computing one custody bit, you would compute (committee size) custody bits every epoch, on average. So the overhead is on the order of a few seconds of CPU time, per epoch.
One approach to encourage this would be to bury some "gold coins": some attestations are valid custody slashings, but they don't lead to the "offender" getting slashed, only the whistleblower will be rewarded. In these special gold coin custodies, the secret of the whistleblower would be mixed into the custody as well, so the gold coin is individual to the whistleblower and can't be redeemed by someone else.
Effort: Quite moderate:
- Modify the custody secret computation to allow for variable probability (probability of gold coins is much lower than custody) and mixing in the whistleblower secret
- Modify the slash_validator method to allow a "reward only" slashing without actually punishing anyone.
I estimate that computing a custody bit comes at a CPU cost of ca. 1-5ms: The main computation is just to compute a Universal Hash Function, which is just evaluating three polynomials of degree 2^13 with coefficients in a 256-bit prime field. (Additionally 10 Legendre bits have to be computed at a cost of a few microseconds each, that part should be much cheaper). This is probably fairly trivial compared to loading the actual data required to do this from disk.
If you police all past committees you were a member of, then this would mean instead of computing one custody bit, you would compute (committee size) custody bits every epoch, on average. So the overhead is on the order of a few seconds of CPU time, per epoch.
One approach to encourage this would be to bury some "gold coins": some attestations are valid custody slashings, but they don't lead to the "offender" getting slashed, only the whistleblower will be rewarded. In these special gold coin custodies, the secret of the whistleblower would be mixed into the custody as well, so the gold coin is individual to the whistleblower and can't be redeemed by someone else.
Effort: Quite moderate: