Goal
To start a discussion that helps identify potential issues with the “wait and see” approach related to the upcoming change removing canister-controlled neuron restrictions.
Why Canister Controlled Neuron Restrictions Exist
Restricting canisters from controlling neurons was an intentional security measure put in place at genesis, intended to discourage a 51% attack by making it extremely difficult to trade staked voting power.
Currently, HTTP outcalls + threshold ECDSA (introduced post-genesis) enable the ability for canisters to controlled neurons and identities, although the barrier for implementing a canister controlled neuron is higher than if this restriction were removed for canisters.
On May 6th, 2021, DFINITY wrote about 51% attacks: Source
51% Attacks on Governance
A key security concern is the prevention of an attacker gaining 51 percent of the voting power, or even just enough that they can tip the balance in favor of those who vote unwisely, which will damage the success of the network. (The term “attacker” here applies equally to an actor who wishes to harm the network, an actor whose influence will be malign by accident, and one that might simply excessively centralize power.) Luckily, all things being equal, the colossal value of ICP locked inside the NNS makes it exorbitantly expensive to acquire such a stake. Furthermore, the financial investment required would be difficult to recoup, since ICP that have been purchased and locked would dramatically lose value if the network were harmed. Even if resources were less of a concern — for example, where an attacker was a malign state actor — unlocked ICP could not be purchased quickly on financial exchanges, since the vast majority of the overall ICP supply is locked in neurons to earn rewards. This would force such an attacker to build up their position slowly over time, with the buy pressure created by significant purchasing also driving up the price, such that successive purchases become ever more expensive.
For these reasons, it is not likely to be possible to accumulate 51 percent of the voting power without gaining access to locked ICP balances. This reflects why it is important that markets cannot be created for neurons. In this case, an attacker might seek to create a market panic in order that they can quickly acquire locked stakes en masse at low cost. For example, they might combine a serious and sustained DoS attack on the network with the widespread dissemination of fake news and negative opinion on social media, to convince neuron owners that their locked stakes are at risk of becoming worthless such that a grand “fire sale” occurs. Although it is highly unlikely that a state actor would conduct such an attack in practice, the politics of open networks and digital assets ensure that mass manias and market crashes are far more possible. It is not in the interests of the network that such an event drives reorganization of voting power, especially where that results in its sudden centralization within a few well-financed hands. This further reflects why markets for neurons would be undesirable.
The Current Plan to Remove Restrictions on Canister Controlled Neurons
Source - Reevaluating Neuron Control Restrictions - #253 by bjoernek
First off, I appreciate the effort and thought that went into bringing this idea to the community @bjoernek.
That being said, I fundamentally disagree that removing canister controlled neuron restrictions, with only metrics, a threshold, and no strong contingency/implementation plan in place.
Unintended Consequences and User Behavior Changes Associated with Neuron Transferability
Once a new feature (or lack of a restriction) is present and people are using it, it becomes extremely hard to deprecate or remove without angering the community. (As an example, look at the recent attempt to lower the max VP from 8 years to 5 years).
Creating transferrable, canister controlled neurons opens up an easier developer implementation and customer UX for trading staked voting power, especially when compared to creating neurons inside of a tradable identity in the NNS dapp or any other currently available neuron trading approach.
Therefore, it’s not a matter of if, but when we’ll see larger amounts of voting power controlled by canisters, with dapps, interfaces, and ICRC standards built specifically for canister-controlled, tradable neurons.
If users are staking their ICP for 8-years in canister controlled, tradable neurons and that VP is compounding, how will the protocol prevent additional canister-controlled neuron VP from accruing if it passes 10% of the total VP.
Imagine what the backlash from the ICP community would look like at that point, which already staunchly comes to the defense of identity trading solutions such as idgeek.app. And this is only with >190k ICP having been transacted thus far on idgeek. 10% of overall VP would be a significantly larger cohort.
Implementing mitigation measures at that point would be too late. Those who have staked ICP in the NNS have shown that long-term ICP holders prioritize short-term rewards over the security of the network. This change will inflate the amount ICP staked in the NNS, and may unintentionally and irreversibly flip long & short-term voting incentives on their head, where the majority of long term holders have a short-term mind set and are only concerned with one thing - APY return.
In fact, the same article written by DFINITY in 2021, emphasized the intended impact of locked neurons on long-term voter behavior:
Neuron holders are placed in a cryptoeconomic game, where they are incentivized to vote to adopt and reject proposals, or to configure neuron follows that cause them to vote automatically in a desirable way, according to what is most likely to drive the value of the Internet Computer network over the long term
I believe neuron marketplaces are already impacting the staking behavior of ICP investors to stake for longer time periods, and that in anticipation of liquid staking options, this change in behavior will accelerate once canisters are able to control neurons.
Community polling reinforces this notion that the ability to transfer staked ICP via an identity marketplace already makes it more likely that ICP investors will stake their ICP for long period of time.
Without a tangible mitigation plan in place, there are far fewer reasons for anyone to start dissolving a tradable 8-year neuron, as its liquidity and age bonus provides considerable value. There is also far little reason to stake a neuron for anything less than 8 years.
Conclusion
I’m concerned with the ambiguity and lack of concrete ideas past removing the restriction on canister controlled neurons.
Source - Reevaluating Neuron Control Restrictions - #257 by bjoernek
There are a number of long-term investors and builders such as @dfisher and @skilesare that feel strongly about having a mechanism for restrictions on neuron transfer in place, and that removing neuron transfer restrictions both undermines both their investments and the security of the network.
DFINITY is extremely methodical about its improvements to the protocol, and in general one of the foundation’s strengths is its planning and engineering attention to security.
Regardless of the outcome, I hope this thread sparks some additional discussion and crypto economic analysis on the potential outcomes that may arise by allowing canisters to control neurons.