Are canisters not allowed control neurons?

Developers
1

I’m attempting to assign a canister principal as a neuron’s controller, but I’m getting the following error:
Cannot add neuron, controller PrincipalId must be self-authenticating

is this error being thrown because the principal is that of a canister? if so, when will canister’s be allowed to control neurons? Having this ability is a necessity for the application that I’m building. I wouldn’t expect this of all things to be what blocks me.

1 Like
2

AFAIK, a canister cannot natively control a neuron out of the box so the simple answer is “no”… however, I heard one could do the following (not straightforward process): A canister should be able to do an HTTPS outcall to the NNS canister and use Threshold ECDSA to control an NNS neuron. I am not aware of folks who have done this in practice though.

2 Likes
3

Is there a reason for requiring devs to undergo such a roundabout process in order to enable neuron staking within canisters? What’s preventing the restrictions in place from being lifted?

I ask because I’m currently building a product that’s meant to facilitate collective IC staking and governance amongst different communities. Additionally, it’s meant to allows users to be able to collateralize their neuron stake in order to receive liquidity in the form of a loan.

To do this, I’ll need a treasury canister that has the ability to control a neuron. I’ve already built most of the code needed. This restriction on canisters has become a roadblock for me in development.

It wouldn’t make much sense to write up some convoluted system for enabling the treasury canister to control a neuron when, instead, the 1 or 2 lines of code that restrict canisters from controlling neurons could simply be removed.

4

The OpenChat SNS is doing this in practice. The code can be found here: open-chat/backend/canisters/neuron_controller at master · open-chat-labs/open-chat · GitHub

I would personally vote in favor if you put forward a proposal.

3 Likes
5

I am not an expert on this topic, so I am not aware of what the design goals or constraints on these are (or if there is some security issue, or if its just its a feature that has been low in priority queue), so I am sorry I cannot shed more light on this.

6

So I am in the process of this of creating a canister controlled neuron in this way, my WIP can be found in the neuron controller folder here:

So in neuron_controller.mo you will see the function get_public_key_der:

image

But I have no idea how to write this function, is there any information you could give me?

7

Hey James,

If I understand correctly, for this you just need to call the API at the management canister, see examples/motoko/threshold-ecdsa/src/ecdsa_example_motoko/main.mo at 340cc897f5de49eee10c78ec769602a5b1eb391a · dfinity/examples · GitHub

You might also want to checkout this library: Mops • Motoko Package Manager

8

So yeah I can get the tECDSA public key in secp1 format but then I think I need to convert it back to DER format for future requests to the IC?

I can’t actually load the spec
https://internetcomputer.org/docs/current/references/ic-interface-spec

9

yep, haven’t parsed the “der” :slight_smile: But the library I linked does this AFAICT.

10

In the tecdsa library? I went through all the code and it doesn’t mention this format DER anywhere. It’s all new to me, is there any information you can give me on it?

11

@jamesbeadle There’s actually an active discussion proposed Here that would lift the restriction that prevents canisters from being able to control neurons directly.

My guess, is that the restriction will be lifted soon, and all the work that you’re about to do in order to perform an tECDSA-signed HTTPS request will be made redundant.

I’m not sure what your timeline is, but that’s an option for you

12
2 Likes
13

Daily rewards on the neuron are probably around 20 ICP on the current figure so waiting obvs costs a lot of money especially when you’d set the DAO up to stake and pay the team through interest.

14

Would you be able to give me any information on what this does and how it relates to getting the public key der in the same way OC does?

15

@jamesbeadle here is a breakdown I posted in response to another post.

Happy to add more context later, but currently at work.

1 Like
16

I understand.

Once you’ve retrieved the public key, you’ll have to decompress it, and then prepend a constant Blob to the decompressed public key.

This thread should be helpful:

1 Like
17

image
image987×534 32.1 KB

Is that what is happening in here?

1 Like
18

Yes, you can find that function here:

1 Like