papers/lux-restaking/sections/08-systemic-risk-analysis.tex

\section{Systemic Risk Analysis}

\label{sec:risk}
%%==========================================================================

\subsection{Correlated Slashing Risk}

The primary concern with restaking is \emph{contagion}: a systemic bug or attack that
simultaneously triggers slashing across multiple AVSs, decimating the shared operator set.
We model this as follows.

Let $p_{v,s}$ be the probability that operator $v$ is slashed by service $s$ in a given
epoch. Under the independence assumption:
\[
  \Pr[\text{operator } v \text{ slashed by any service}] = 1 - \prod_{s: e_{v,s} \in \mathcal{E}} (1 - p_{v,s}).
\]

With correlated slashing events (e.g., a client bug affecting all operators), define the
correlation matrix $\boldsymbol{\Sigma}$ where $\Sigma_{s,s'} = \text{Cov}(X_s, X_{s'})$
for indicator $X_s \in \{0,1\}$ representing a service-wide slashing event.

\begin{theorem}[Systemic Risk Bound]
\label{thm:systemic}
Let $\mathcal{S}^* \subseteq \mathcal{S}$ be the set of services sharing a common software
client with vulnerability probability $q$. The probability that total slashed value exceeds
fraction $\theta$ of $W$ is bounded by:
\[
  \Pr\left[\frac{\text{SlashedValue}}{W} > \theta\right] \leq \frac{q \cdot |\mathcal{S}^*| \cdot \bar{\alpha} \cdot \bar{f}}{\theta},
\]
where $\bar{\alpha}$ is the mean allocation per service and $\bar{f}$ is the mean slash
fraction.
\end{theorem}

\begin{proof}
By Markov's inequality applied to the expected slashed value:
\[
  \mathbb{E}[\text{SlashedValue}] \leq q \cdot \sum_{s \in \mathcal{S}^*} \Pi(s) \cdot \bar{f}
  \leq q \cdot |\mathcal{S}^*| \cdot \bar{\alpha} \cdot W \cdot \bar{f}.
\]
Applying Markov's inequality gives the bound.
\end{proof}

\subsection{Diversification Requirements}

LRP enforces minimum diversification requirements to limit correlated slashing exposure:

\begin{itemize}[leftmargin=1.5em]
  \item No single AVS may receive more than 30\% of total restaked LUX (concentration limit);
  \item Operators serving more than 5 AVSs must hold at least 3 distinct client implementations;
  \item AVSs sharing a codebase must be disclosed and treated as a single risk category.
\end{itemize}

\subsection{Insurance Fund}

LRP maintains a protocol-level insurance fund, seeded by 30\% of all slashed amounts and
10\% of AVS registration fees. The fund backstops residual slashing risk for delegators,
up to a per-epoch payout cap of 2\% of fund balance. As of Fuji testnet, the target fund
size is \$50M at mainnet launch.

%%==========================================================================