> If the company that runs Lido is responsible for validating 99% of the blocks and the US Treasury Department comes knocking with a list of bad actors to blacklist, what happens next?
The company that employs most of the Lido contributors is based in a region where the US has little influence. But aside from that, the Lido node operators (who operate the validators) consist of more than a dozen companies, registered in various countries, using servers in different locations. Diversity of jurisdictions is an explicit criterion for node operator selection. Possibly some of them could be forced to censor transactions, but I think it’s not the lowest hanging fruit (going after the client software developers might be a more impactful avenue, there are fewer of those than validators, though fortunately Ethereum has multiple client implementations).
But suppose somehow 99% of the blocks are produced by validators who censor certain actors. Then it depends a bit on how far-reaching the censorship is.
If validators refuse to include certain transactions in their blocks, but still accept other’s blocks for consensus, then I expect that blacklisted actors will find it more difficult and more expensive to get their transactions included, but it would still be possible. If they offer a juicy transaction fee, they will have to wait on average 50 blocks to get their transaction in, but then a validator will be more than happy to include it.
If validators refuse to include certain transactions in their blocks, and also refuse to vote on blocks that do for consensus, then they will be able to enforce their censorship. One way to think about this, is that the censorship has been built into the protocol, and the 1% of validators still willing to include the blacklisted transactions, are producing what the others consider invalid blocks. Consensus can tolerate 1/3 of the stake misbehaving.
99% is an extreme case though; if the censorship is limited to less than 1/3 of the stake, then the opposite happens. Validators who refuse to vote on certain blocks don’t fulfil their duty of voting, which incurs a penalty. If the validator is not allowed to vote on even a descendant of a block that contains a blacklisted transaction, then effectively it will be prevented from ever voting again, and its stake will slowly evaporate due to penalties.
An interesting case arises when censoring nodes control more than 1/3 of the stake, but less than 2/3. This could result in a liveness failure, where no blocks get finalized (because neither the censoring nor the non-censoring nodes can get the required 2/3 majority). This triggers an “inactivity leak”, where the stake of the misbehaving nodes gets destroyed, until there is less than 1/3 of it left, and consensus can be achieved again. Of course, who is “misbehaving” here depends on your point of view, and the situation is symmetric, so this would lead to the chain forking into one where the censors have a supermajority, and one where the non-censors have a supermajority. The side which had most stake will be the first to achieve consensus again.
(Because of this risk, there is an ongoing discussion in Lido about whether it should self-impose a limit to not control more than 1/3 of the stake. But it’s a tough situation, because the way it looks right now is that that stake would instead be controlled by centralized exchanges who offer staking services.)