[Pre-Draft] Allow staked Atoms in genesis addresses to be transferred once without unbonding

Governance
#1

For those delegating since the Cosmos launch, and who use a Ledger, there is the frustrating reality that their Atoms live on a separate HD wallet from the rest of their crypto.

Many of us who use a Ledger have for years, and hold several cryptocurrencies and tokens across several HD accounts derived from one seed. Having everything under one HD wallet is great and makes managing assets easier (that’s sort of the point of HD wallets). This will be even more relevant in the future when we regularly participate in governance, possibly across several networks.

As it stands, one either needs a) two Ledger devices for their historical seed and their Cosmos funding seed, or b) to frequently restore their device with one seed or the other.

Of course, one could move assets from their historical seed to the funding seed. But those with years of usage and transaction history will find this very cumbersome.

  • They may have several tokens spread across different accounts and addresses.
  • They may reuse addresses derived from their historical seed to receive funds.
  • They will have transaction histories in two places, which may add complexity when paying taxes.
  • They will incur some transaction fees to move the funds.

Moving Atoms from the Cosmos funding seed to the historical seed carries a cost as one would need to unbond, effectively loosing 21 days of rewards. Depending on one’s stake, this could represent a lot of money. But even with a modest stake, the potential future losses could be significant if the price of Atoms increases substantially. For example, a reward of 100 Atoms over 21 days would translate to a loss of about $600 today. If the price of Atoms one day reaches $100, that’s a potential future loss of $100,000.

My proposal introduces a special transaction type which would allow Cosmos funders to reassign ownership to a new address derived from their historical Ledger seed. The new transaction type would work as follows:

  • Reassign ownership of all the Atoms in an original funding address to a new specified address derived from the historical seed. The originating address would need to be in the genesis block for the transaction to be valid.
  • The transaction would not affect bonding. Atoms would remain bonded with the same validators and in equal proportions, simply transferred to a new address.
  • Any further transactions would require the user to unbond normally.

As someone who participated in the funding and who is delegating since the network launch, I would like to see an easy and painless way to do this otherwise simple wallet ‘housekeeping’ task.

I would love to hear what others think of this and if it’s something more people also wish they could do. I’m also not necessarily conscious of the technical feasibility and complexity of such a change. For example, I can see different ways in which this new transaction type could be architected.

  1. Perform a special ‘no unbonding period’ unbonding, transfer the assets, and immediately redelagate.
  2. Tokens never get unbonded, their ownership just gets ‘magically’ reassigned to the new address if the conditions are met.

I’m looking forward to the community’s feedback on this.

4 Likes
#2

Hey Seb,

Thanks for starting the conversation. I agree with parts of your proposal, but disagree with others. Let me chime in with my thoughts.

I absolutely see the use case in transferring delegated ATOMs to other addresses, but I don’t believe it should be restricted to crowdsale participants.

Crowdsale users may want to move their staked ATOMs for convenience, sure, but there are other valid reasons to do this:

  1. If someone believes their Cosmos key has become compromised, they may wish to transfer their staked ATOMs to another key the believe is more secure
  2. If someone wishes to sell their staked ATOMs to someone else, they will need a way to transfer them.

In all 3 of the above cases, the ability to transfer staked ATOMs is not only useful, but I’d argue that it also maintains the security of the Cosmos network.

Right now, if a user unbonds their ATOMs so they can move keys, there are 3 weeks where the global bonded total is reduced, which decreases the financial cost to “buy” the network.
By allowing bonded ATOMs to transfer once per 3week period, the network won’t have to suffer the loss of those bonded ATOMs.

Now, while I agree adding this feature will increase security of the Cosmos network as a whole, I also acknowledge that it has another impact on individual security.

Right now if my key is copied by an attacker, I can plan to move my tokens in 3 weeks after they’re unbonded. I have plenty of time to prepare the transaction, sign it, and hold it until I can broadcast it at the exact block where it’s movable. The attacker has an equal opportunity to do this, so it’s a known “race” that will begin at a known point in the future.

If we adopt this proposal and allow ATOMs to be transferred while bonded, the attacker can use the copied key immediately to transfer my ATOMs to his account. I won’t have any opportunity to “race” for my ATOMs as they’ll be gone immediately. This proposal removes an opportunity for the victim to reclaim their funds, and increases the probability that attackers are successful in their thefts.

TL;DR:

  1. I think all accounts should have the ability to move bonded ATOMs once per 3 week period
  2. Adding this ability increases the overall security of the network, but decreases options for victims of stolen keys.

I am personally fine with this tradeoff as “the needs of the many outweigh the needs of the few”

3 Likes
#3

Right, allowing bonded Atoms to be transferred doesn’t reduce the security of the network. I think that’s an important point to make.

I also don’t think it generates many opportunities to sell. Since one would be required to move all the Atoms at once, they would be indivisible and illiquid. With the exception of OTC trades, I doubt people would sell their Atoms this way.

I’m less concerned about the first point since it’s a known risk. People already use crypto under the assumption that they will loose funds if keys are compromised. That’s why we use Ledgers :slightly_smiling_face:

I think using the crowdfund mnemonics presents a security risk. These seed phrases were generated in the browser and probably sat in text files for many people. Using a Ledger to sign transactions with keys generated on a computer defeats the point. Encouraging people to move their funds off crowdfunding seeds to a cold seed, and making that process easy is a security best practice.

#4

I have a strong preference that bonds should freely transferable as a whole between accounts.

I think we should have a transaction type that moves a bond from one account to another without an intermediate unbonding.

The key thing here is that a transferred bond doesn’t change anything about that the slashing and unbonding would still take 21 days.

4 Likes
#5

You pretty much summed up the idea in 3 paragraphs. Clarity.

#6

This is fundamentally saying that we are willing to allow trading on staked atoms. Which may be fine, but a proposal around this needs to be well crafted and lay out the pros and cons of such a paradigm and its second order effects.

3 Likes
#7

It’s saying that we would allow bonds to be transferred as a whole. I don’t think it would create a significant amount of new trading volume.

  1. The fact that the bonded atoms would be indivisible would make trading difficult.
  2. The buyer would need to agree that the atoms remain bonded with a specific validator.
  3. Exchanges probably wouldn’t be able to support these trades unless they make changes to their interfaces and order books. It would probably be limited to OTC trades.

These constrains would probably force people to sell these atoms at a discount, which would further discourage trading.

#8

I disagree. One the major drawback of any crypto for most people is that if you lose your keys or get them compromised then you lose everything without any possibility to reclaim anything.

Right now with Cosmos bonding mechanism there is at least an opportunity to enter into a “race” course to secure bonded atoms if key has been stolen, as you explained. Actually I believe that not only we shall retain this possibility, we shall also try to find a way to leverage this 21 day period to secure the compromised Atoms. I have already started a bried discussion about this on reddit here : https://www.reddit.com/r/cosmosnetwork/comments/bw9drb/unbonding_period_as_an_anti_theft_security/

One possibility as suggested in this reddit thread would be to have one special “escape” address associated to each Cosmos address. If a user realizes his usual key has been compromised, then he could move all bonded atoms to this escape address immediately. Then he could create a new standard Cosmos address and move the Atoms from the escape address to the new standard address. They would still be in “unbonded” state though, i.e. they could not be transferred from escape address to the new standard address before the end of the 21 days period, so that people cannot use this mechanism to bypass the unbonding period.

I do not know if it is technically feasible, but if it is then it would be a strong incentive for users to stake their atoms as they would be protected agains theft (assuming they realize their keys have been compromised before the end of the 21 days period of course) !

This “escape” mechanism could also be used to answer OP original concern if it was allowed for users that have participated to the ICO to move their bonded atoms to this escape address, then to another address, but with the unbonding restriction removed. However I am against such type of exception. In my opinion, ICO participants should already be happy enough with their 50x gains and could afford the loss associated to the 21 day unbonding period :wink:

#9

B-Harvest didnt know about this, but accidentally implemented this with additional feature(transfer of a fraction of delegation)

I think the implementation by dongsamb@bharvest is very neat and simple, but powerful.

#10

I saw the demo, it’s very cool. My original idea was motivated by a selfish desire to move atoms to an other Ledger without loosing rewards :smile: It’s when others started commenting on the idea that I realized there was a much bigger potential around staking derivatives. It’s too bad we didn’t get to discuss in Berlin.

Happy to take part in the discussion, and help write and/or fund the proposal.

#11

You mean OP could sell delegated atoms to himself ? The problem I have with that it that it would also allow a thief to immediately transfer delegated atoms to himself, making it even more difficult for the victim to secure his Atoms while they are bonded (this was the point of my previous comment)

#12

Basically staking is not for achieving delegator’s security of his wallet. Consider that liquid atom is at risk of immediate theft. I think we need another function(disabling or freezing sending/delegationtransfering msg type for given period of time) to achieve that purpose. I feel it is a valid point but need different approach to achieve