<p>I had to do a lot of digging but this is what I have came up with. Please correct me if any of this is incorrect and I'll update the answer.</p>
<p><strong>What happens when they [PoolTool] know I won the slot lottery?</strong></p>
<p>After going through the <a href="https://github.com/AndrewWestberg/cncli/blob/develop/INSTALL.md" rel="nofollow noreferrer">CNCLI documentation</a>, it looks like the intention is to only ever send the Current and Previous slot leader. Furthermore, when I look at the json result for a LeaderLog, it returns the &quot;slot&quot;, the &quot;slotInEpoch&quot; and an &quot;at&quot; which is a date time. Based off knowing this payload as well as the intended use, I am guessing they are using it to fill in the Orphans section of the site before rewards are calculated. Looking at a couple of examples, I am only seeing Orphans 3 to 4 Epochs back (so 297/298). I believe with these logs they could fill in more realtime.</p>
<p><strong>Can we force a Slot Leader to fail to forge with a given attack that is cheap enough to put me back in the lottery for that slot? DDoS cheap, for example.</strong></p>
<p>If you could keep the relays down long enough for another slot leader to propagate, then yes you could. If the pool is protecting against DDOS/DOS attacks, then this is probably unlikely to work.</p>
<p><strong>Is this easier when colluding with other giants?</strong></p>
<p>If you were a pool like Binance, with 42 saturated pools, then you could potentially cause issues for other SPOs by denying them in your topology files. This could potentially cause issues for their propagation. (<em>Still a big if</em>). The other would be a 51% attack if you got enough people to join you. This would be extremely unlikely to happen though.</p>
<p><strong>Could small SPOs be denied the ability to mint new blocks in the worst case scenario of mass-collusion scenarios where the at least one of the collaborators would have a better chance at being the slot leader than they did if they were to do nothing.</strong></p>
<p>Short answer yes but it would likely be a very small effect. The example would be the Binance one above. This also could be worse if the pool has no protection against DDOS type attacks.</p>
<p><strong>What utility is being served by conceding privileged information to a community member, which means many things from competitor to valued contributor, but still a private third-party.</strong></p>
<p>I believe the utility would be keeping a more up-to-date Orphaned block tab for PoolTool. In general, it would be statistical.</p>
<p>I hope this is helpful.</p>

CC BY-SA 4.0
2021-11-09T01:24:40.687Z
2021-11-09T01:24:40.687Z
Jacob - SNOWY Pool
<p>Please correct me if I'm wrong, but I think this is a non-issue if you don't send upcoming slots/the slot leader schedule, but use the Sendslots command instead:</p>
<p>CNCLI does not send the slot number and/or date and time of the blocks you are assigned to mint. Straight from the CNCLI Git:</p>
<blockquote>
<p>Sendslots command</p>
<p>The sendslots command <strong>securely sends pooltool the number of slots you
have assigned for an epoch</strong> and validates the correctness of your past
epochs. You must have a synchronized cncli.db database and have
calculated leader logs for every pool in pooltool.json before calling
this command. It should be called within the first 10 minutes of the
epoch cutover.</p>
</blockquote>
<p>Here is an example:</p>
<blockquote>
<p>2020-12-01T03:34:33.883Z INFO  cncli::nodeclient::leaderlog &gt; Sending:
{&quot;apiKey&quot;:&quot;blah-blah-blah&quot;,&quot;poolId&quot;:&quot;00beef0a9be2f6d897ed24a613cf547bb20cd282a04edfc53d477114&quot;,<strong>&quot;epoch&quot;:232,&quot;slotQty&quot;:25,&quot;hash&quot;:&quot;d15b6c8d4c81fe48cff0650c5b59ab20da9765374c58c933dacd058eb38bb670&quot;</strong>}
2020-12-01T03:34:33.969Z INFO  cncli::nodeclient::leaderlog &gt; Pooltool
Response:
{&quot;statusCode&quot;:200,&quot;headers&quot;:{&quot;Content-Type&quot;:&quot;application/json&quot;,&quot;Access-Control-Allow-Origin&quot;:&quot;*&quot;},&quot;body&quot;:&quot;{&quot;success&quot;:true,&quot;message&quot;:&quot;We have updated your <strong>assigned slots for epoch 232 to be 25</strong> with a hash of
d15b6c8d4c81fe48cff0650c5b59ab20da9765374c58c933dacd058eb38bb670.  You
must provide an array of slots that matches this hash to have your
performance counted.&quot;}&quot;}</p>
</blockquote>
<p>So as I understand, pooltool does not know which slots you are assigned to and they can't find out based on the info CNCLI sends to them.</p>

CC BY-SA 4.0
2021-11-10T13:47:16.487Z
2021-11-12T17:38:42.577Z
2021-11-12T17:38:42.577Z
ATFFpool
<p>Something that could be done is to ask stake pool operators to report just the number of blocks they have been awarded for the next epoch.  They could report this just prior to the start of the epoch.</p>
<p>If a pool operator chooses to report his number of slots awarded then he would be incentivised to report the correct number.</p>
<p>He must tell the truth because if he lied by reporting just one less than the actual number, he will be found out if/when his pool successfully produces all its blocks.  Maybe occasionally his pool will lose a block to a slot battle etc. but mostly it will produce all the blocks issued and then if he lied by saying less then everyone will know.  He will then lose trust with the community.</p>
<p>I don't think reporting slots issued like this would create a security concern because no one would know the actual timing of the slots issued except for the pool operator himself.  Even knowing the precise number of slots awarded doesn't reveal anything much since this amount can be approximated simply by looking at the total amount staked at his pool.</p>
<p>I did think about sending abridged slot leader reports like this but didn't look into where to send this information.  I certainly formed the opinion that there was no way that I was going to send the full slot leader reports containing the timing because, as you say, that would provide timing information to potential attackers.</p>

CC BY-SA 4.0
2021-11-09T14:21:13.400Z
2021-11-09T14:21:13.400Z
74d4
<h1>Small Sample of Concerns Belonging to Larger Family of Unknown Real or Figurative Concerns</h1>
<p>I would like to send my predetermined <code>Slot Leader</code> reports to PoolTool, yet I only use the API key they provide for sending tip heights.</p>
<p>What happens when they know I won the slot lottery? At first I was very paranoid and could only imagine slot leader, even when plural for a single slot, is private information not for public disclosure. But aha, it's not! At least I am unable to find it on PoolTool after a reasonable search.</p>
<p>Worse though, it's not public and not private, so it's valuable information in the hands of a privileged few, or so I thought to myself. My reasoning being if I am an SPO with a relay or two, and the Whales and pre-AML/KYC bullies are around, it would be trivial to assault my nodes, and also interesting:</p>
<ul>
<li>Can we force a Slot Leader to fail to forge with a given attack that is cheap enough to put me back in the lottery for that slot? DDoS cheap, for example.</li>
<li>Is this easier when colluding with other giants?</li>
<li>Could small SPOs be denied the ability to mint new blocks in the worst case scenario of mass-collusion scenarios where the at least one of the collaborators would have a better chance at being the slot leader than they did if they were to do nothing.</li>
</ul>
<h2>Effect on Operator Behavior</h2>
<p>So I never reported, yet I still missed two blocks when I was slot leader anyway. Now that I've probably figured out the network issues causes this, I will report my slot, just because, why not?</p>
<p>But still, what utility is being served by conceding privileged information to a community member, which means many things from competitor to valued contributor, but still a private third-party.</p>
<h1>Bounty Will Likely Not Be Rewarded Within Seven Days</h1>
<p>I am asking for a canonical answer. @Anton, tried to derive one, but I see holes that I can comment on later.</p>
<p>Therefore, I will delegate to the answers I find interesting, thought-provoking, reasonable-yet-contradicting, and so on; just ones I personally found valuable. I encourage you to do the same.</p>
<h2>Upvote and ADA-only Recipients</h2>
<p>So far these are those delegators, with the first satisfying all of the listed qualities.</p>
<ol>
<li>Ticker: SNOWY for <a href="https://cardano.stackexchange.com/a/4464/2092">Anton's Answer</a> - OP comments,</li>
</ol>
<blockquote>
<p>&quot;having the previous slot would be quite the computational challenge
alone, and it does take days or weeks for those pages to populate, but
they don't show a decision tree for a slot battle–maybe a deceptive
illustration of 3,100 pools <code>POST</code>ing (every second as required) its <code>Tip Height</code> API
endpoint, which does some processing on before responding to the <code>POST</code>. Like
wanting to know which node your running, if it's a release or dev
build, other things it must record before responding. It does not
report a <strong>Slot Battle</strong> diagram based on what <em>delegators</em> are
reporting to <em>relays</em> and other <em>delegators</em>. I don't even think it
asks if a <em>delegator</em> is saying it is the <strong>Slot Leader</strong>.</p>
<p>The API has nine endpoints, but Amazon masks their location, claiming
they are all in the US. But they appear to be AWS CloudFront &quot;Web 3.0&quot;
CDNs, and that a show of good faith if CloudFront was chosen for its
equal access to low-latencies ambitions:</p>
</blockquote>
<pre><code>&gt; To deliver content to end users with lower latency, Amazon CloudFront
&gt; uses a global network of 275+ Points of Presence (265+ Edge locations
&gt; and 13 regional mid-tier caches) in 90+ cities across 47 
&gt; countries. Amazon CloudFront Edge locations are located in: 
</code></pre>
<p><a href="https://i.sstatic.net/lQXMG.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/lQXMG.png" alt="CloudFront Edge. &quot;Moreless,&quot; Foxy Brown on a Shyne song" /></a></p>
<blockquote>
<p>&quot;Looks nice, but you can't know where they are. You can experiment,
but if you just want gains you don't experiment, you stake in the most
developed of Western Europe, hedging in the coasts of the US, because
it had had an inflation clock downtown from me since before I was
born, and the world likes it that way. AAA debt for sale for almost
all of me and that clock's life, ala CIA and USN, and so on.&quot;<br />
&quot;Meanwhile, the orphan graph reminds me of a PoolTool page, or the
other way around...&quot;</p>
<p>[Middle Finger Emoji to almost every stake holder]</p>
<p>&quot;Okay, I'll lay off pooltool, or why it doesn't report past slot
leader, leader arrays, empty slots, or pull from the verbose as the
need for a reconstructed Globe Theater.&quot;</p>
<p>What if you just need 51% of topology pathfinders to agree that your
AWS CloudFront WebAPI is gospel? You'd make a topologyUpdater script
that basically reinforced this Western exploit attacking the
single-second slot. Sites like <a href="https://PoolVet.io#PPDAC" rel="nofollow noreferrer">PoolVet</a> claiming if you don't
comply, go let the Best Practices Group promote gain over virtue.</p>
</blockquote>
<p><a href="https://i.sstatic.net/Gbw7j.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/Gbw7j.png" alt="Shut up PoolVet" /></a></p>
<blockquote>
<p>&quot;And on and on,&quot; he continued ranting.
&quot;Where's the utility? What's this project really about?&quot;</p>
</blockquote>

CC BY-SA 4.0
2021-11-08T23:53:49.867Z
I didn't realize you could send your slot leader reports. I am doing the tip heights but not slot leader. Can you add a link where you found out how to do that as well as view that? I would think this would be something you wouldn't want public based off what you've stated above.
Jacob - SNOWY Pool
CC BY-SA 4.0
2021-11-09T01:21:46.690Z
Yes, there's a talented group that builds tools for the community. Many actually. They range from sites (graph explorers, big data, etc), to various niches like Pool Operator tools. They are well rewarded for the hours on ongoing OSS work. As an example, one tool was communally improved into a pretty polished piece of SPO software, it can tell you your block slots, if any, in the current, previous and next epoch. This isn't magic, IOHK goes out of its way to use English with equations. But forgive me if I failed, I cannot find the discussion about private centralized Slot Leader databases.
Louis Waweru
<security><independent-service-providers>
What Utility Do Third-Party Services Provide with Undisclosed Slot Lottery Information?
# What Utility Do Third-Party Services Provide with Undisclosed Slot Lottery Information?

(Asked by: username_0 on 2021-11-05)

Small Sample of Concerns Belonging to Larger Family of Unknown Real or Figurative Concerns
I would like to send my predetermined Slot Leader reports to PoolTool, yet I only use the API key they provide for sending tip heights.
What happens when they know I won the slot lottery? At first I was very paranoid and could only imagine slot leader, even when plural for a single slot, is private information not for public disclosure. But aha, it's not! At least I am unable to find it on PoolTool after a reasonable search.
Worse though, it's not public and not private, so it's valuable information in the hands of a privileged few, or so I thought to myself. My reasoning being if I am an SPO with a relay or two, and the Whales and pre-AML/KYC bullies are around, it would be trivial to assault my nodes, and also interesting:

Can we force a Slot Leader to fail to forge with a given attack that is cheap enough to put me back in the lottery for that slot? DDoS cheap, for example.
Is this easier when colluding with other giants?
Could small SPOs be denied the ability to mint new blocks in the worst case scenario of mass-collusion scenarios where the at least one of the collaborators would have a better chance at being the slot leader than they did if they were to do nothing.

Effect on Operator Behavior
So I never reported, yet I still missed two blocks when I was slot leader anyway. Now that I've probably figured out the network issues causes this, I will report my slot, just because, why not?
But still, what utility is being served by conceding privileged information to a community member, which means many things from competitor to valued contributor, but still a private third-party.
Bounty Will Likely Not Be Rewarded Within Seven Days
I am asking for a canonical answer. @Anton, tried to derive one, but I see holes that I can comment on later.
Therefore, I will delegate to the answers I find interesting, thought-provoking, reasonable-yet-contradicting, and so on; just ones I personally found valuable. I encourage you to do the same.
Upvote and ADA-only Recipients
So far these are those delegators, with the first satisfying all of the listed qualities.

Ticker: SNOWY for Anton's Answer - OP comments,


"having the previous slot would be quite the computational challenge
alone, and it does take days or weeks for those pages to populate, but
they don't show a decision tree for a slot battle–maybe a deceptive
illustration of 3,100 pools POSTing (every second as required) its Tip Height API
endpoint, which does some processing on before responding to the POST. Like
wanting to know which node your running, if it's a release or dev
build, other things it must record before responding. It does not
report a Slot Battle diagram based on what delegators are
reporting to relays and other delegators. I don't even think it
asks if a delegator is saying it is the Slot Leader.
The API has nine endpoints, but Amazon masks their location, claiming
they are all in the US. But they appear to be AWS CloudFront "Web 3.0"
CDNs, and that a show of good faith if CloudFront was chosen for its
equal access to low-latencies ambitions:

> To deliver content to end users with lower latency, Amazon CloudFront
> uses a global network of 275+ Points of Presence (265+ Edge locations
> and 13 regional mid-tier caches) in 90+ cities across 47 
> countries. Amazon CloudFront Edge locations are located in: 



"Looks nice, but you can't know where they are. You can experiment,
but if you just want gains you don't experiment, you stake in the most
developed of Western Europe, hedging in the coasts of the US, because
it had had an inflation clock downtown from me since before I was
born, and the world likes it that way. AAA debt for sale for almost
all of me and that clock's life, ala CIA and USN, and so on."
"Meanwhile, the orphan graph reminds me of a PoolTool page, or the
other way around..."
[Middle Finger Emoji to almost every stake holder]
"Okay, I'll lay off pooltool, or why it doesn't report past slot
leader, leader arrays, empty slots, or pull from the verbose as the
need for a reconstructed Globe Theater."
What if you just need 51% of topology pathfinders to agree that your
AWS CloudFront WebAPI is gospel? You'd make a topologyUpdater script
that basically reinforced this Western exploit attacking the
single-second slot. Sites like PoolVet claiming if you don't
comply, go let the Best Practices Group promote gain over virtue.



"And on and on," he continued ranting.
"Where's the utility? What's this project really about?"

**Tags:** security, independent-service-providers
> **Comments:**
> **username_1**: I didn't realize you could send your slot leader reports. I am doing the tip heights but not slot leader. Can you add a link where you found out how to do that as well as view that? I would think this would be something you wouldn't want public based off what you've stated above.  
> **username_0**: Yes, there's a talented group that builds tools for the community. Many actually. They range from sites (graph explorers, big data, etc), to various niches like Pool Operator tools. They are well rewarded for the hours on ongoing OSS work. As an example, one tool was communally improved into a pretty polished piece of SPO software, it can tell you your block slots, if any, in the current, previous and next epoch. This isn't magic, IOHK goes out of its way to use English with equations. But forgive me if I failed, I cannot find the discussion about private centralized Slot Leader databases.  

---

## 3 answers

### Answer by username_1 on 2021-11-09. Score: 1

I had to do a lot of digging but this is what I have came up with. Please correct me if any of this is incorrect and I'll update the answer.

**What happens when they [PoolTool] know I won the slot lottery?**

After going through the [CNCLI documentation](https://github.com/AndrewWestberg/cncli/blob/develop/INSTALL.md), it looks like the intention is to only ever send the Current and Previous slot leader. Furthermore, when I look at the json result for a LeaderLog, it returns the "slot", the "slotInEpoch" and an "at" which is a date time. Based off knowing this payload as well as the intended use, I am guessing they are using it to fill in the Orphans section of the site before rewards are calculated. Looking at a couple of examples, I am only seeing Orphans 3 to 4 Epochs back (so 297/298). I believe with these logs they could fill in more realtime.

**Can we force a Slot Leader to fail to forge with a given attack that is cheap enough to put me back in the lottery for that slot? DDoS cheap, for example.**

If you could keep the relays down long enough for another slot leader to propagate, then yes you could. If the pool is protecting against DDOS/DOS attacks, then this is probably unlikely to work.

**Is this easier when colluding with other giants?**

If you were a pool like Binance, with 42 saturated pools, then you could potentially cause issues for other SPOs by denying them in your topology files. This could potentially cause issues for their propagation. (*Still a big if*). The other would be a 51% attack if you got enough people to join you. This would be extremely unlikely to happen though.

**Could small SPOs be denied the ability to mint new blocks in the worst case scenario of mass-collusion scenarios where the at least one of the collaborators would have a better chance at being the slot leader than they did if they were to do nothing.**

Short answer yes but it would likely be a very small effect. The example would be the Binance one above. This also could be worse if the pool has no protection against DDOS type attacks.

**What utility is being served by conceding privileged information to a community member, which means many things from competitor to valued contributor, but still a private third-party.**

I believe the utility would be keeping a more up-to-date Orphaned block tab for PoolTool. In general, it would be statistical.

I hope this is helpful.


---

### Answer by username_2 on 2021-11-10. Score: 0

Please correct me if I'm wrong, but I think this is a non-issue if you don't send upcoming slots/the slot leader schedule, but use the Sendslots command instead:

CNCLI does not send the slot number and/or date and time of the blocks you are assigned to mint. Straight from the CNCLI Git:

> Sendslots command
>
> The sendslots command **securely sends pooltool the number of slots you
> have assigned for an epoch** and validates the correctness of your past
> epochs. You must have a synchronized cncli.db database and have
> calculated leader logs for every pool in pooltool.json before calling
> this command. It should be called within the first 10 minutes of the
> epoch cutover.

Here is an example:

> 2020-12-01T03:34:33.883Z INFO cncli::nodeclient::leaderlog > Sending:
> {"apiKey":"blah-blah-blah","poolId":"00beef0a9be2f6d897ed24a613cf547bb20cd282a04edfc53d477114",**"epoch":232,"slotQty":25,"hash":"d15b6c8d4c81fe48cff0650c5b59ab20da9765374c58c933dacd058eb38bb670"**}
> 2020-12-01T03:34:33.969Z INFO cncli::nodeclient::leaderlog > Pooltool
> Response:
> {"statusCode":200,"headers":{"Content-Type":"application/json","Access-Control-Allow-Origin":"\*"},"body":"{"success":true,"message":"We have updated your **assigned slots for epoch 232 to be 25** with a hash of
> d15b6c8d4c81fe48cff0650c5b59ab20da9765374c58c933dacd058eb38bb670. You
> must provide an array of slots that matches this hash to have your
> performance counted."}"}

So as I understand, pooltool does not know which slots you are assigned to and they can't find out based on the info CNCLI sends to them.


---

### Answer by username_3 on 2021-11-09. Score: 0

Something that could be done is to ask stake pool operators to report just the number of blocks they have been awarded for the next epoch. They could report this just prior to the start of the epoch.

If a pool operator chooses to report his number of slots awarded then he would be incentivised to report the correct number.

He must tell the truth because if he lied by reporting just one less than the actual number, he will be found out if/when his pool successfully produces all its blocks. Maybe occasionally his pool will lose a block to a slot battle etc. but mostly it will produce all the blocks issued and then if he lied by saying less then everyone will know. He will then lose trust with the community.

I don't think reporting slots issued like this would create a security concern because no one would know the actual timing of the slots issued except for the pool operator himself. Even knowing the precise number of slots awarded doesn't reveal anything much since this amount can be approximated simply by looking at the total amount staked at his pool.

I did think about sending abridged slot leader reports like this but didn't look into where to send this information. I certainly formed the opinion that there was no way that I was going to send the full slot leader reports containing the timing because, as you say, that would provide timing information to potential attackers.


---

