TL;DR: Due to an ongoing incident, the foundation will vote “reject” on the currently open proposal for “ICP on canisters” (proposal 30496). Once the incident is resolved, a new proposal will be submitted.
Hello, there is an ongoing incident with one of the application subnets (subnet “pjljw”). The subnet hosts a canister for which execution of messages results in different states on different replicas. Multiple teams are investigating the cause for this non-determinism right now.
The Internet Computer has a fail-safe built in for such a case causing the subnet to suspend sending messages to other subnets so that the problem can be isolated and fixed. However, this may prevent canisters on other subnets from being upgraded. The reason for this is that, to upgrade a canister, the canister needs to have processed all outstanding messages - otherwise replies might not be processable anymore by the upgraded canister due to change of code.
Unfortunately, there is thus a possibility that the Ledger canister may not be able to upgrade and stall: if there are outstanding messages from the Legder canister to the Cycles Minting Canister to top-up or create canisters on the “pjljw” subnetwork, these messages cannot obtain a reply and the Ledger canister will not be able to fully stop, which is a prerequisite for upgrading.
We view this as a high risk. Therefore, to avoid another potential incident, the DFINITY Foundation has chosen to vote “reject” the ledger upgrade proposal 30496 enabling ICP for canisters.
Please note that the incident with subnet “pjljw” is NOT related to the “Canisters can hold ICP” feature. Once the incident with subnet “pjljw” is resolved, the Foundation will resubmit the proposal upgrade the ledger canister and to enable ICP on canisters.