Reevaluating Neuron Control Restrictions

[bjoernek]

@alexeychirkov

Therefore, after setting the disbursement key and losing it, the user will NOT be able to disburse the neuron, even while remaining the controller?

No, the idea of the disbursement key is to give whoever knows the disbursement key the right to disburse for a particular neuron. The controller of the neuron can still do all neuron operations (including disburse) without needing the disbursement key.

[bjoernek]

@ajismyid

When an Internet Identity’s neuron is bound to a disbursement key, there is an inherent risk for the sole owner to lose their private key in the future.

The disbursement key is an additional key who gives access to operation disburse. The II controller can still do all operations, even if the controller looses access to the disbursement key. Does this clarify your concern ?

[bjoernek]

@pixld8ta

How then will the previous owner have access to the neuron if they will NOT have access to the sold II?

Good question! This is precisely where the disbursement key comes in. If you know the disbursement key (and the neuron id) of the II controlled neuron then you would able to disburse to a specified account (using a new kind of neuron operation).

[dfxjesse]

@Accumulating.icp

yet consistently being told that this can’t be enacted by DFINITY due to a security risk - what has changed?

I think this is being looked at now again because a neuron marketplace and canister controlled neurons already happened, even with the current design of the system.

It’s kind of an example of Murphys law. Maybe we should be considering that with this new proposed design that people will probably in the future figure out more workarounds to avoid the new restrictions - especially if there is an incentive.

[alexander]

@Accumulating.icp

Preventing Neurons from self authenticating does not prevent the trading of neurons. People can trade internet identities, both online or in person - which is a workaround that caused users to lose their entire attached identity rather than solely the neuron.

You cannot sell a neuron, whether online or in person, if it is owned by a LEDGER. The previous owner can at any time obtain a new LEDGER, input the seed phrase, and regain control. As a result, the buyer cannot achieve 100% ownership of the purchased neuron, since the seed phrase cannot be changed without losing ownership of the neuron. A similar approach is intended for neurons created through Internet Identity.

[Accumulating.icp]

It’d been proposed quite some time ago when these features were in existence, and we were told to enable them would be a security risk of the network - so I ask again, what’s changed

Proposal: Remove the is_self_authenticating restriction on Neuron Ownership

Hi all, we had some discussions in DFINITY regarding whether NNS neurons should be controllable by canisters. Our current take is that we should not allow canisters to control NNS neurons as we should not risk the creation of neuron markets. One main concern about having services that offer “staked tokens” and hold huge NNS neurons is that these services would have a very large, aggregated voting power in the NNS which may thus centralize the voting power. Some more detailed concerns / answer…

[Accumulating.icp]

That’s fair, but I’d be willing to bet a small portion of people created their neurons with yubikeys, and the majority are liquid via Internet Identity etc. We can’t let an outlier dictate the entire system.

[alexander]

It is an open question. Perhaps by number, but I do not think so by volume.

[pixld8ta]

@bjoernek

This is precisely where the disbursement key comes in. If you know the disbursement key (and the neuron id) of the II controlled neuron then you would able to disburse to a specified account (using a new kind of neuron operation).

This information is very cleverly hidden and it’s not in the original text.
Could you update your first message in this thread so that EVERYONE can see and read it (highlight this in the text)?

[dfxjesse]

It seems the main reason for this new design and proposal is to enable canisters to control neurons

But we want these restrictions for obvious reasons:

@bjoernek

• neurons should have an incentive to vote in the long-term interest of the Internet Computer and
• to avoid the possibility of attacks where an attacker acquires tokens only for a short amount of time, votes on a malicious proposal (e.g. transfer tokens) and then sells the neurons again. Similar types of attacks have been executed on DAOs in the past (example ).

Both of these points tie into each other really - we don’t want bad actors voting / creating nefarious proposals and getting them approved by the NNS.

Leading on from what I was saying earlier about people figuring out workarounds. Take this Idea:

• A canister that controls a neuron.
• An organisation / dApp controls this canister.
• This is a successful organisation / dApp and there is a lot of ICP in this neuron and it’s increasing.
• The organisation / dApp has no interest in voting it just wants the rewards for doing so.
• It decides to auction off it’s voting power for a small fee.
• The buyer of the voting power get’s some of the rewards for voting (rewards > fee).

Now we have a system in which a bad actor can obtain large amounts voting power for an even lower price than buying neurons directly and not really have to worry about dumping or selling a neurons at all.

[bjoernek]

@Accumulating.icp

It’d been proposed quite some time ago when these features were in existence, and we were told to enable them would be a security risk of the network - so I ask again, what’s changed

Thanks for making the link our post on this topic.

And to answer your question on what has changed: We thought further about this topic, in particular how to balance the wish from many developers to enable canister-controlled neurons (enabling many interesting uses cases) vs how to still prevent deep neuron markets (which could be used for a voting attack). The preliminary conclusion, outlined above, was essentially to allow canister-controlled neurons (which are transferable), balanced by incentives giving higher rewards to neurons which are not transferable (so that not too many neuron become transferable).

[Accumulating.icp]

Don’t you think it introduces more convolution when the DAO says “why should we pay a -25% fee on our rewards when we can just have “Trusted User” custody it”.

Look at SNS DAO’s & then tell me it won’t happen😅

[bjoernek]

@pixld8ta

This information is very cleverly hidden and it’s not in the original text.
Could you update your first message in this thread so that EVERYONE can see and read it (highlight this in the text)?

Yes I am happy to add this information to the initial post and I am glad that this clarified your question. And just to clarify: There was no intention to hide anything whatsoever (the name disbursement key was chosen to make the functionality transparent).

[dfxjesse]

I just thought about it there so the incentives I came up with are off.

but I was just raising the point that we could essentially see voting power marketplaces via canister controlled neurons (alongside even neuron marketplaces).

The incentives could be anything, I’m sure people / the marketplace would figure something optimal out.

This touches on the main point of all this discussion which is not wanting a bad actor to control too much voting power, creating and approving nefarious proposals and leaving the eco-system. So, what I’m saying is with the current DAO system and the right dApps and tools I don’t think we can avoid this 100%.

[Accumulating.icp]

Thanks for replying. I can’t find the exact cost analysis I did, but we’d deduced it’d cost hundreds of millions to acquire 10% of ICP in the bear market - I cant imagine what that’s turned into now that we’re up 400%+. I guess I’m just not really seeing where the pivot comes from on your side, as nothing has really changed, hence my curiosity on why the “security risk” in no longer a concern.

@Accumulating.icp

Neuron Markets exchange in $ICP as of present (I understand this may not always be the case, but this is where we’re at now).

Meaning in order for somebody to acquire a neuron, they still have to buy $ICP. Beyond this, it takes hundreds of millions, without accounting for liquidity slippage, to acquire even 10% of $ICP, let alone enough to pull off a malicious attack against DFINITYs 99.99% on code based topics, or ~25% in governance topics (which aren’t binding, you have to submit a code based prop after the fact anyways). And then offload your hundreds of millions dollar position after you’ve attempted x malicious action.

I’d agree you can no longer force people into the ponzi (this is a good thing, right guys??? right???) when they have the opportunity to buy/sell neuron’s as they please - but they already can.

What stops me from selling my internet identity OTC? What makes it different?

[Jam]

@dfxjesse

but I was just raising the point that we could essentially see voting power marketplaces via canister controlled neurons (alongside even neuron marketplaces).

A voting power marketplace doesn’t need control over neurons. It can be implemented with people retaining control over their neurons, proving ownership, and receiving additional rewards for voting.

[LightningLad91]

@Accumulating.icp

Don’t you think it introduces more convolution when the DAO says “why should we pay a -25% fee on our rewards when we can just have “Trusted User” custody it”.

Look at SNS DAO’s & then tell me it won’t happen😅

This seems like a risk that would have to be weighed by members of the DAO. If they are willing to accept that risk then they will be accountable for their decision. Just as they will be held accountable if they chose to fund a DAO that isn’t really a DAO.

Overall, I’m just happy that this proposal gives us a choice. I’m also okay with the penalty because rewards are a reflection of your commitment to the network. Reducing the rewards of an 8 year neuron that can be easily transferred seems logical to me.

[Aija]

DFINITY has a number of PHDs that could likely speak to this far better than I could…but here is the ChatGPT try:

This is brilliant! Let’s prompt ChatGPT with slightly adjusted Objective and Assumptions:
Objective: To prove that voter lock-in for a time (t) does not lead to decisions that maximize the long-term value of voters’ ownership share in the network compared to scenarios where voters have an exit option (by transfer) at (t-n).

and launch the ChatGPT battle

[dfisher]

Why not force ALL neurons to have a disbursement key? That might solve the issue of a) a neuron marketplace and b) over complicating things.

Honestly a 20% penalty on rewards feels pretty weak in the grand scheme of keeping optionality. A 6 month neuron earns 50% lower rewards currently than a 8 year neuron, but now I can get higher rewards for a 8 year neuron without a PoK (that I can sell) than a 6 month neuron with PoK? Something feels wrong here

[dfisher]

Also it would be great to explain again in simple terms how PoK solves the neuron marketplace issue. It seems to only be useful for people who want self custody.

There’s plenty of people who are happy to delegate custody. Coinbase has billions tied up. If Coinbase started their own custodied neuron marketplace, then PoK would not help right?