Authors: B² = @bjoern @bjoernek
TL;DR
The Internet Computer Protocol prevents canisters from directly controlling neurons, a measure intended to block neuron sales and ensure long-term thinking in voting behavior. However, these restrictions can be circumvented by a canister using threshold ECDSA (tECDSA) and HTTP outcalls.
This situation calls for a reassessment of these restrictions, potentially unlocking new use cases. In the event of relaxing these restrictions, enhancing the long-term binding between neuron controllers and neurons becomes crucial as this is beneficial for the voting behavior and security of the Internet Computer.
A recommended solution is to strengthen the bond between neuron controllers and neurons via Proof-of-Knowledge (PoK) of the cryptographic key through which the neuron is controlled. Users could be incentivized to participate in such a scheme by adjustments to the neuron’s voting power, and hence also voting rewards, with the aim to prevent the formation of a deep neuron market.
We warmly invite the community to share their feedback on the proposed approach.
Background
Restrictions on Neuron Control
In the ICP network, neurons represent decision-making entities that participate in governance by voting on proposals. To ensure long-term thinking in voting behavior, control over neurons is restricted: Currently only so-called self-authenticating principals can be set as the controller of a neuron, see code here. A self-authenticating principal is an entity that utilizes its own cryptographic key pair (consisting of a private and a public key) to authenticate itself. For example, a user relying on Internet Identity, Quill or a Ledger hardware wallet is of this kind. Canisters, which do not possess self-authenticating principals, are therefore excluded from directly controlling neurons.
Reason for the Restrictions on Neuron Control
The restriction is based on the requirement that neurons should not be sold - when canisters can control neurons directly, one can sell a neuron by selling the canister that controls it. It is considered important for neurons to be non-transferable/no-sellable because
- neurons should have an incentive to vote in the long-term interest of the Internet Computer and
- to avoid the possibility of attacks where an attacker acquires tokens only for a short amount of time, votes on a malicious proposal (e.g. transfer tokens) and then sells the neurons again. Similar types of attacks have been executed on DAOs in the past (example).
Circumventing Restrictions on Neuron Control
Despite these safeguards, there are a few ways to bypass the restrictions on neuron control:
- Threshold ECDSA (tECDSA): As canisters are able to control tECDSA keys, which are a feature of the Internet Computer Protocol, they can also sign ingress messages to the Internet Computer and thereby act as the controller of a neuron (making calls via HTTP to appear as ingress).
- Canister signatures: A canister can control a neuron through canister signatures, again making calls via HTTP to appear as ingress.
Furthermore, it is also possible to control a neuron via an Internet Identity (II) and sell the II.
Please note that the current abilities to circumvent neuron ownership & sell restrictions are not considered an immediate risk to the Internet Computer yet. A significant fraction of the total voting power of existing NNS neurons (including Seed & ECT neurons) is not controlled by canisters/II. Hence, a material part of the voting power of existing neurons cannot end up on the neuron market. Moreover, the transferability of II-controlled neurons poses a smaller concern, typically affecting only smaller neurons.
Revisiting Neuron Control Restrictions
Given that the restriction for canisters to not control neurons can be circumvented relatively easily, it should be considered to drop that restriction. This was suggested by several community members already. Lifting that restriction would bring the following benefits
- Facilitate NNS neurons that are SNS controlled: SNSs already chose to do this (e.g. OpenChat) or plan to do it (e.g. GoldDAO), providing them a continuous income to cover cycles fees and involving SNSs in NNS governance. Allowing this behavior more directly would simplify the current more complicated workflow via tECDSA.
- Consistency with SNS: As opposed to the NNS, the SNS framework does not apply restrictions on neuron controllers.
- Facilitate organizational neuron ownership: An organization could control a neuron via a canister.
Ideas for the way forward
Acknowledging the potential for circumvention, we recommend to lift the restrictions on canister neuron control while still encouraging the core principle of non-transferability to safeguard the Internet Computer’s security. A promising approach involves introducing a neuron attribute that significantly tightens the link between a neuron and its initial controller, making it more risky to sell a neuron and thus practically re-establishing the non-transferability of the original design.
Enhancing Controller-Neuron Binding
To strengthen this connection, we propose linking neuron control explicitly to a unique cryptographic key, known to the owner. If as a private user you know the private key, then you cannot un-know it and hence you keep the control even if the controllership is transferred. A practical method to achieve this enduring bond is through a Proof-of-Knowledge (PoK) of the controller’s private cryptographic key. To counteract potential workarounds via threshold ECDSA (tECDSA) or threshold BLS (tBLS), an interactive Schnorr PoK, inherently incompatible with these protocols, is suggested.
Incentivization Structure for Enhanced Controller-Neuron Binding
The overall objective of the incentive structure is to deter the creation of a deep market for neurons. This is intended to make it difficult for an attacker to amass a significant amount of neurons quickly, exercise voting power in a harmful way, and then dispose of the neurons with minimal financial loss.
To further this objective, neurons without the enhanced controller-neuron binding via PoK could receive lower voting power and, consequently, lower rewards. Specifically, neurons without this binding, such as those controlled by canisters, could face a voting power reduction of up to 20%, depending on their dissolve delay. This reduction would range from 0% for neurons with no dissolve delay to 20% for those with an eight-year dissolve delay, applying linear interpolation for periods in between. The motivation for this time-dependence is to encourage non-transferability in particular for neurons with long dissolve delays and thus longer commitment to the network. The maximum reduction (in this instance, 20%) could be a parameter subject to modification through an NNS (Network Nervous System) vote.
In order to prevent creating a counterproductive incentive for neuron dissolution among existing neuron holders and to honor the commitment of current neuron holders, it is suggested that the voting power reduction for non-PoK neurons would only apply after a to be defined cut-off date (assuming that this proposal would be approved via a motion proposal one could for example use the approval date of the motion proposal). Instead of reducing the voting power for PoK-non-compliant neurons, an alternative could be to increase the voting power for PoK-compliant neurons. This change would essentially yield the same overall impact. Yet, as PoK-compliant neurons are expected to become the norm, the approach of decreasing voting power for non-PoK neurons appears more logical.
Application Across Types of Neuron Control
- New User-Controlled Neurons via Quill/Ledger hardware wallets: Eligible for the PoK scheme, reinforcing user ownership.
- New Canister-Controlled Neurons (both directly controlled by canister or through threshold ECDSA or canister signatures): Ineligible for PoK, aligning with the proposed restrictions lifting.
- New User-Controlled Neurons via Identity Identity (II): Due to BLS reliance, these neurons cannot participate in the PoK scheme directly. An alternative might involve assigning a non-modifiable “disbursement key,” enhancing rewards while introducing a mechanism that complicates neuron transfer, thus indirectly bolstering non-transferability. A disbursement key works as follows: If you know the disbursement key (and the neuron id) of the II controlled neuron then you would able to disburse to a specified account (using a new kind of neuron operation). This key, once set, cannot be changed. Knowing the key is irreversible, creates a risk for buyers: the previous owner could potentially access the neuron’s ICP in the future.
Suggested Phased Implementation
To effectively transition to the new framework a phased roll-out is proposed.
- Phase 1 (soon): Lift restrictions on canister control over neurons.
- Phase 2 (next): Adjust the voting power. New neurons lacking a self-authenticating principal will receive reduced voting power and rewards.
- Phase 3 (mid-term): Introduce the additional PoK described above (and a disbursement key of neurons controlled via II). Lower rewards would apply to all new neurons without this additional PoK (or disbursement key).
