Cosmos Interchain Security

Summary

Interchain Security (ICS) was the Cosmos Hub's bid to become a shared-security provider — the Cosmos answer to Polkadot's parachain slots and a precursor-era rival to EigenLayer's restaking. Built primarily by Informal Systems with Hypha Worker Co-operative, its first version, "Replicated Security," shipped in the Gaia v9 "Lambda" upgrade on March 15, 2023 (Proposal #187, passed near-unanimously). The mechanism let new "consumer chains" rent the Cosmos Hub's entire validator set and ~multi-billion-dollar ATOM stake instead of bootstrapping their own proof-of-stake economy, paying the Hub a share of fees and MEV in return. Neutron (smart contracts) and Stride (liquid staking) became flagship consumer chains in mid-2023. The system worked as engineered — no consumer chain suffered a security failure — but the business model did not: validator costs vastly exceeded revenue, flagship tenants left, and by late 2025 the Hub's own contributors were scoping ICS's formal deprecation.

Design (Mechanism)

ICS is implemented as native Cosmos SDK modules (the CCV — cross-chain validation — provider and consumer modules), not smart contracts. The provider chain (Cosmos Hub) streams validator-set updates to each consumer chain over dedicated IBC channels; consumer chains run CometBFT consensus with the Hub's validator set and the Hub's stake as their security backing. Misbehavior on a consumer chain (double-signing, downtime) is relayed back as evidence and punished on the Hub, where the offending validator's ATOM stake lives — so attacking a small consumer chain risks slashing on the large provider chain.

Version 1 ("Replicated Security") replicated the entire Hub validator set: once governance approved a consumer chain, all ~180 validators were obligated to run its node, with a "soft opt-out" carve-out for validators in the bottom ~5% of voting power. Consumer chains compensated the Hub by routing a share of transaction fees and MEV revenue to ATOM validators and delegators, and onboarding was governance-gated (Neutron via Proposal #792, May 2023; Stride via Proposal #799, July 2023).

Version 2, "Partial Set Security" (PSS), shipped in the Gaia v17 upgrade (Proposal #924, ~99.8% yes, June 2024) after the economics of full replication proved untenable. PSS introduced: (1) Top-N chains, where only the top N% of validators by stake must participate (N=95 mirrored the old model; analysis showed N=63 delivered comparable security with only ~25 validators); (2) opt-in chains, where any validator can voluntarily join and set a per-chain commission rate; (3) consumer-side controls — validator allowlists/denylists, per-validator power caps, and smaller active sets; and (4) a path toward permissionless consumer-chain launches. The v17 rollout itself caused a roughly four-hour Hub halt on June 5, 2024 due to an upgrade bug.

Outcome

Technically, ICS delivered: consumer chains launched, ran for years on borrowed security, and were never exploited through the shared-security mechanism. Commercially, it underperformed badly. Only a handful of consumer chains ever launched (Neutron, Stride, and Duality — which soon folded into Neutron). Per Everstake's H1 2024 analysis, combined 2024 validator returns from Stride and Neutron were roughly $147,500 against operating costs about 16x higher — validators were subsidizing the product. Neutron, the flagship tenant, voted to leave and executed its "Mercury" upgrade to a fully sovereign PoS network on April 9, 2025, citing control over its own security, governance, and performance. Stride pivoted toward a proof-of-authority model on Partial Set Security and later wound down its ICS reliance amid its own strategic pivot. By Hypha's Q3 2025 report, no Top-N consumer chains remained and Hypha, with Cosmos Labs (formerly Interchain Labs), was "scoping the technical deprecation of Interchain Security" and planning to offboard remaining consumer chains. ATOM never accrued meaningful value from security-as-a-service.

Why it worked

• The core cryptoeconomic design was sound: slashing evidence relayed over IBC made attacks on small chains as expensive as attacks on the Hub, and no consumer chain suffered a consensus-security failure.
• It solved a real cold-start problem — Neutron launched day one with top-tier validators and billions in backing stake rather than a thin, mercenary validator set.
• The engineering (CCV modules, validator-set replication over IBC) shipped, iterated (RS → PSS), and ran in production for years, becoming reference material for later shared-security systems.

Why it failed or underperformed

• Costs and revenues never matched. Every validator bore fixed infrastructure costs per consumer chain, while consumer fee/MEV revenue was tiny; ~$147.5k of 2024 revenue against costs an estimated 16x higher made participation a loss-leader, especially for small validators.
• Mandatory replication was the wrong default. Forcing ~180 validators to run every tenant chain maximized cost, not security; PSS's Top-N/opt-in fix arrived in mid-2024, after the model's reputation had soured.
• Tenants outgrew the landlord. Once Neutron had traction, sovereignty (own staking token, faster blocks, independent governance and upgrades) beat renting security tied to the Hub's validator set and politics — the exact churn dynamic a security lessor must survive, but with too few tenants to absorb it.
• Governance friction and ecosystem headwinds: every launch required a Hub-wide vote, the v17 upgrade halted the Hub for ~4 hours, and the 2024–2025 Cosmos appchain contraction (Kujira, Evmos, Comdex, and others shutting down or pivoting) shrank the addressable market for leased security.

Lessons

• Shared security is a two-sided marketplace: elegant slashing mechanics are worthless if provider-side costs (every validator running every chain) exceed tenant-side willingness to pay. Price the validator's marginal node before shipping the cryptography.
• Renting security is a bridge, not a destination — successful tenants graduate to sovereignty. A security lessor needs either lock-in, a large tenant pipeline, or pricing that captures the value it creates during the bootstrap phase.
• Mandatory, uniform participation is an anti-pattern; opt-in markets with per-chain pricing (what PSS eventually offered, and what EigenLayer-style systems started with) should have been the v1 design.
• Governance-gated onboarding throttles a marketplace: making each customer pass a token-holder vote caps growth at the speed of politics.

Redesign (EDITORIAL — hypothesis, not fact)

This section is editorial speculation. A redesigned ICS would launch as an opt-in security market from day one: validators quote per-chain commissions, consumer chains post a required security budget (in fees, tokens, or ATOM buys) into an on-chain escrow, and a matching mechanism clears validators against budgets — no governance vote, no mandatory replication. Minimum viable security would be expressed as a Top-N-equivalent threshold the consumer must afford, not a set the Hub must supply. To address graduation churn, lease terms could include an explicit sovereignty path: a declining revenue-share schedule plus a token-swap or equity-like allocation to the Hub, so ATOM captures upside when a tenant like Neutron succeeds and leaves rather than losing its best customer for free. Finally, the Hub should have underwritten small validators' marginal infrastructure costs from the community pool during bootstrap, converting an invisible validator tax into a visible, capped subsidy that governance could evaluate honestly.