The Internet Computer should allow canisters to control ICP neurons

Governance
1

Currently, canisters cannot own ICP neurons. This restriction was added to prevent neuron marketplaces from emerging through which an attacker could in theory quickly buy up neurons to gain enough voting power to attack the IC.

Each ICP neuron has a single owner which can never be changed. But if a neuron was owned by a canister, that canister’s owner could be changed, transferring the ownership of any neurons that canister controls. So by preventing canisters from controlling neurons, we prevent neurons from being transferrable.

However, this means that SNSs are all losing out as their treasuries of ICP are sat idle, rather than earning voting rewards. Which in turn means that SNS projects have become incentivised to withdraw their ICP treasuries from the control of their SNSs to stake them in neurons owned by individuals. Which is bad!

I am one of the developers of OpenChat, and we would like to stake some portion of the OpenChat treasury for 6 months so that it can earn rewards while still being readily accessible in the future if needed. We would also like to offer ‘Lifetime Diamond Membership’ where users would pay ICP into an 8 year neuron controlled by the SNS and their account’s running costs would then be covered by the voting rewards from the neuron.

I have spoken to many other SNS teams and every single one I’ve spoken to has wanted the ability to stake some of their treasury.

I think the benefits massively outweigh the risks, especially because there is already over 130M ICP staked for 8 years, so even if a neuron marketplace were to emerge, so much voting power is already locked away that no attacker would be able to quickly buy up a significant amount of voting power.

Also, neurons actually can already be controlled by canisters! But they would have to do so using tECDSA and http out calls from canisters and it would be fairly complex. But as soon as one person builds a library which handles this then it becomes easy for everyone to use.

So it is better to allow canisters to own neurons directly, since then the governance canister can detect how much voting power is controlled by neurons and if it grows too quickly, action can be taken to prevent it growing further. Whereas if canisters remain restricted, eventually someone (probably me :laughing:) will build a library allowing canisters to control neurons, and neurons controlled through tECDSA are indistinguishable from neurons controlled by humans, so from that point onwards we have no way of knowing how much voting power is controlled by neurons.

TLDR: The risks are pretty much non-existent and the restriction is hurting every SNS project plus preventing other valid use cases where canisters would want to own neurons. So let’s drop the restriction and allow canisters to own ICP neurons!

PS: To drop the restriction is a 1 line code change!

20 Likes
2

Prior discussion: Proposal: Remove the is_self_authenticating restriction on Neuron Ownership

2 Likes
3

I’ve argued elsewhere, so I won’t go into details, but this is not the only reason for this. The “skin in the game” justification behind the assumption that people with long-term stake is reason to eliminate and punitively restrict neuron markets. The attack is not an issue for ICP at this point(although is still likely an issue for SNSs). The biggest issue with neuron markets is that they allow users to make non-network-optimal decisions and that is the whole point of NNS tokenomics. It just breaks the basic assumption.(Chat with ChatGPT about research on ‘tied to the mast’ in decision theory)

DAOs holding neurons allows for a different kind of ‘skin out of the game’ ability to influence governance and then quickly exit their DAO position without having to endure the consequences. That being said, hopefully, the SNS DAOs are diversified enough to mitigate this somewhat and you do want to balance this with building strong institutions in the ecosystem that have skin in the game as well.

Also, have you considered just withdrawing the ICP to an sns governed application that knows about the NNS and can sign these transactions with T-ECDSA? You can relay them off line and the SNS still controls them. It’s a backdoor and I think there are still massive governance issues that need to be addressed, but that would get you there without having to do anything with the NNS or replica codebase at this juncture.

Second shortest solution: Let us whitelist canisters via the NNS that satisfy 'best practices and intent" for holding neurons like we do with named neurons.

7 Likes
4

If people aren’t in favour of allowing all canisters to control neurons I’d happily settle for having a canister whitelist :+1:

Also, have you considered just withdrawing the ICP to an sns governed application that knows about the NNS and can sign these transactions with T-ECDSA? You can relay them off line and the SNS still controls them. It’s a backdoor and I think there are still massive governance issues that need to be addressed, but that would get you there without having to do anything with the NNS or replica codebase at this juncture.

I’m not really sure what you meant by this though.
What is an ‘SNS governed application’? It sounds like you’re talking about a canister which controls a neuron using http out calls + tECDSA. Which can be done, but if people can start doing that to circumvent the restriction, then surely there’s no point in having the restriction…
Whereas if it isn’t a canister, then how can it be controlled by the SNS?

2 Likes
5

We’ve been working on something like this for CIG DAO - canisters can control neurons, it’s just a bit of a reach around with tECDSA.

Given there’s multiple vectors to access this market, I’m not sure why we don’t just remove the self authenticating function.

Neuron Markets exchange in $ICP as of present (I understand this may not always be the case, but this is where we’re at now).

Meaning in order for somebody to acquire a neuron, they still have to buy $ICP. Beyond this, it takes hundreds of millions, without accounting for liquidity slippage, to acquire even 10% of $ICP, let alone enough to pull off a malicious attack against DFINITYs 99.99% on code based topics, or ~25% in governance topics (which aren’t binding, you have to submit a code based prop after the fact anyways). And then offload your hundreds of millions dollar position after you’ve attempted x malicious action.

I’d agree you can no longer force people into the ponzi (this is a good thing, right guys??? right???) when they have the opportunity to buy/sell neuron’s as they please - but they already can.

What stops me from selling my internet identity OTC? What makes it different?

6 Likes
6

For those interested in having canisters own & control neurons, I wrote a small library a while back: GitHub - AegirFinance/canister-owned-neuron: Proof-of-concept for Canisters in the Internet Computer to own and control Neurons

It’s pretty simplistic, but it works, and shows how you can do it. Interestingly, it enables any arbitrary control structure over the neuron, like direct multi-sig-controlled neurons, revokable access rights, etc.

No, the assumption was always broken. This is just making it apparent.

Side note: A whitelist would also be satisfactory (and helpful) for StakedICP, but feels like a pointless ugly hack.

7 Likes
7

I am pretty sure people investing in these DAOs want to see their funds spent in 2-3 years on progress that results in something great that will be worth 100x their initial investment and not have their funds used by the devs to slowly fund themselves for decades ahead. So why a DAO will lock neurons and live off the rewards indefinitely unless it plans to do that?

3 Likes
8

I personally would not want to invest in a treasury that will have the maximum value extracted from it without any degree of self-sustainability, alongside the possibility of a failed/unused product, considering half of these dApps don’t even have business models, but that’s just me.

The DAO owns the canister which controls the neuron - that means the DAO is in charge of what the neuron is used for.

The bigger issue is fixing this failed theory of decentralized liquid democracy.

6 Likes
9

But this is exactly the issue… these SNSs could stake some portion of their ICP in a 6 month neuron and extend their runways by doing so.
SNSs have much better chances of succeeding if they can maximise the value of their treasuries, especially because even the most successful online services still often take years to become profitable.

6 Likes
10

@hpeebles I agree with you on this.

The whole neuron thing is already broken anyway. You can sell it on IDgeek or OTC. You’ll never be able to truly enforce it.

yay more gatekeeping

2 Likes
11

Dfinity should pay attention to this issue, or many SNSs will slowly die out. Allowing SNSers to lead projects to participate in NNS governance is the best embodiment of liquid democracy. We can require that the governance neurons of these SNSs should have neuron names, rather than prohibiting them from participating. Additionally, the governance neurons of 1-8 years have long passed the risk stage. Dfinity should delegate power and not deprive individuals, groups, and DAO neurons of the right to obtain liquidity.

Under the guarantee of property rights, the freer the market, the more prosperous and innovative it will be.

4 Likes
12

There is only 1 feature of the existing managed neuron design that makes it unattractive for holding an SNS treasury of ICP in an NNS neuron in the way you are describing. Followees for the Neuron Management proposal topic cannot disperse the ICP stake. They can control all other aspects of the neuron as described in the code notes here. However, the code exists to allow neurons with a non-profit status to disperse the stake with the Neuron Management proposal topic. It wasn’t released due to the concerns with neuron transfer, but perhaps it can be leveraged to solve the problem you are describing for SNSs. You can have up to 15 Followees for the Neuron Management proposal topic and I see no reason why they can’t be positions that are elected by proposal voting from the SNS community. Hence, the people making decisions on how to configure the treasury neuron and when to disperse the treasury neuron could be the most trusted members of that SNS community who are actively involved in this kind of decision making. Building this into the SNS framework seems like a reasonable alternative to allowing neuron transfer.

2 Likes
13

A portion for 6 months may be fine, while the whole treasury for 8 years probably wont be.
Imagine Steve Jobs & Wozniak taking their first investment of 10mil$, putting it in the bank, locking it and living off of 4% a year interest - 400k$ a year, staying in their garage and making computers, instead of quickly growing and trying to find more funds to keep growing.

@Accumulating.icp About 90% of startups fail. By letting them artificially self-sustain and giving them % of the whole network, we are removing that ability. Instead of failing they will be barely surviving and taking the network down with them. Well at least that’s how I see SNSes so far - startups around an app. Not every DAO is a startup I guess. Unless that’s the idea. To have organizations that are not typical startups but are envisioned as enduring entities dedicated to providing a service without the traditional economic pressures.

1 Like
15

You’re acting as though the team itself is what owns the Neuron - it belongs to the DAO.

It’s not about the startup & founders, it’s about the owners of the DAO.

There should not be a standard of founders draining treasuries (especially without any degree of oversight, as currently setup - technically @Seers could take their entire treasury & run, with no legal obligation to you!).

The DAO treasury belongs to its holders, and the holders should have a degree of insurance within this potentially failed startup.

Atleast if the startup fails, the DAO holders can still receive neuron rewards long term, in an attempt to recoup losses.

4 Likes
16

A canister whitelist for controlling neurons is not a good idea if the goal is to keep good behaviour.

An SNS can be malicious too and there is no guarantee they will remain honest and do what’s best for the network - the whitelisted canister / SNS could one day even decide to change it’s objectives and start to facilitate buying and selling of neurons on behalf of users.

It also sounds like unnecessary gate keeping and a special privilege to larger projects only.

I think it’s either a case of allowing all canisters the ability to stake neurons or none. I can think of some pretty cool use cases for allowing canisters to stake neurons, but I think all the possible issues need to be taking into account, I think the objective of a DAO such as the NNS is to have people vote on proposals and decide what changes can happen, I know automatic voting exists but at least we can be relatively sure the neuron is owned by a human, hence they are responsible for the votes.

What about a blackholed canister that votes automatically? Ethically, should this canisters votes even be taking into consideration? Are we handing over DAO’s to robots already? :smile:

4 Likes
17

It sounds like there’s a bit of a wall on both sides of this issue. DAOs have a valid complaint here, but adding the ability for canisters to hold neurons opens up a can of worms that requires further thought.

What about adding a new construct instead of modifying existing ones?

Linked Neuron - Abstract idea:

Create a special type of neuron (Linked Neuron) that is like a normal neuron, except that in its lifetime it can only accept ICP from a single account, and can only return return ICP back to that same account (that the ICP originated from).

In this way, the neuron is strictly “linked” to the treasury, and the ICP is only able to flow bidirectionally between the account (SNS treasury) and the neuron.



Just a rough idea, I’m sure there’s holes in it - please poke away!

6 Likes
18

Quick update…

For OpenChat we decided to solve the issue of having canister controlled neurons by using tECDSA + HTTP out calls.
It actually turned out to be fairly simple.
You can see the code for how the canister interacts with the NNS governance canister here.
So we now have an SNS controlled neuron which can (via SNS proposals) stake and manage NNS neurons. :partying_face:

11 Likes
19

Hamish, how will these neurons be displayed, and how will the voting history be displayed?

On the page below, one can find details on the treasury. But it will now be incomplete.

@peterparker tagging you as I do believe it’s good to inform the dashboard team about these developments

20

Thanks @dfisher for tagging me. I assume Hamish can forward this to the dashboard team as well when he responds, if needed.

1 Like
21

The neurons haven’t been created yet.
There are 2 OpenChat SNS proposals currently live which if adopted will each create an NNS neuron.
Once those neurons are created we can publicise the Ids.
We would also like to turn one of them (the 8 year one) into a named neuron.
This hasn’t been fully decided by the OpenChat community yet but its likely these neurons will follow Dfinity for all topics except ‘Governance’, ‘SNS & Neuron Funds’ and ‘Network Economics’.
For those 3 topics, we will automate the creation of an SNS proposal for each NNS proposal and the OpenChat neurons will vote based on the outcome of each NNS proposal’s corresponding SNS proposal.

1 Like