Replace burningman and refund agent by market place based solutions #259
Comments
MwithM
added
a:proposal
|
I'll start the discussion of this fundamental proposal: About getting rid of arbitrator:
Getting rid of burning man sounds so good, that's the main central point of failure at Bisq. He does two functions:
I suppose it's not possible, because otherwise it would already have been done, but let me think out loud: if there was a way to pre-pay fees with a BSQ proof of burn, it would be amazing. It would allow traders to forget about BSQ volatility and Bisq to make certain promotions like "80% discount in trading fees for this low trading volume market during X period". I suppose this feature would face similar difficulties as the Bisq v2 project.
This is the most critical function of the burningman, as he can attack Bisq just creating his own sell BTC offers and wait to trigger the locktime transaction with trading funds and security deposit to him. @ifarnung proposal #148 had a possible solution that could reduce slippage at illiquid markets. Something similar will be used for RSK's Money on Chain Token exchange platform. That could work for the 2nd function of the burningman, but the first function (burn BTC trading fees) should be something instant to not delay trades. Keeping a DAO address holder who only burns BSQ trading fees is not a security thread, so that's a possibility. |
The info provided by the mediator and arbitrator which is the summary note of the dispute. There is a open PR for that, so it cointains all important info. That is the base for the DAO to accept or reject. Mediators need to make those summaries sufficiently clear so that the DAO can make a decision based on that. |
Not sure if that can be the case. The claim market need to open and should be not different to the normal BSQ market, so prices should be same like someone buying/selling BSQ. |
This is not unfeasible. Probably not 100% trackable (as it would face v2 problems) but maybe its good enough to say if you burn x BSQ you can trade for 2 months without any fee. Some might gain more if they trade more, but that should not be a big problem for Bisq. Definitely an interesting idea, also to promote those less known features more. |
Yes that is definitely interesting. But the main open problem is how to replace the donation address model. Still the biggest unsolved problem of the whole concept. But I guess even if we do not find a good solution for that part, we could start to fix the other problems and reduce it to that remaining one. If cases are really low we could even burn the BTC (expensive for the DAO but the safest solution). |
Let me give an example: I self trade 1 BTC with 0.2BTC deposit. Don't make the altcoin payment. I, as seller, start arbitration and win it. Market claims start. |
|
It cannot work like this. The claim is for 1.2 BTC and this is what the DAO will refund. The buyer of the claim pays e. g. 1.1 BTC and will pocket 0.1 BTC if the DAO refunds. The seller loses 0.1 BTC but gets paid immediately and without uncertainty. Any self-trade will then not work. This type of selling of claims (e. g. invoices) is common in any economy. |
|
Aggreviated party (seller) puts 1.2 BTC into the trade funds and receives from arbitrator only 1.1BTC, losing 0.1 BTC? |
|
No. The seller has a claim which is at most what was sent to the burning man (the balance depends if the other trader also gets some payout). The DAO thus reimburses at most what was sent to the burning man. To introduce an inconvenience reimbursement will lead to many possibilities of gaming and negotiation hassles. |
|
I like the idea, this system, as I understand it, would capture fees and trade funds in a way that would disallow the amounts to be entered incorrectly as DAO reimbursements? As we have experienced erroneous fee distribution and reimbursement requests in our current scheme. We could start with this market setup right now and restrict participants to ONLY the current burningman and refund agent. For immediate improvement on trade fund/fee handling and DAO reimbursement accounting. |
Refund agent needs to take profit from his activity to exist. Now it's you, a trusted party, and it looks like your activity is not profitable ennough (you charge the equivalent in BSQ to 50USD per case + 1% per advanced BTC funds to be reimbursed in BSQ). I don't suspect you from taking advantage of this, as you're a trusted party and the incentives didn't look too big to try to scam the DAO. But on an open market this is a possibility. |
|
I think that in this proposal there will not be any Refund Agent. And I suggest that the trader who gets reimbursed by the DAO will not get the full amount which was burnt, leaving a small amount for the DAO. That is, part of the security deposit of the trader who did not follow the rules goes to the DAO. This proposal gives extra work to the DAO which should be compensated. |
|
This seems very complicated and increases the potential attack surface. If the market is illiquid it will lead to bad outcomes and user dissatisfaction only in a much more complex and roundabout way. The more I think about all the potential solutions, the more I would like to see a pure P2P, 2-of-2 multisig, MAD system tested. Example:
This keeps it simple. It's not perfect, but I bet it would lead to better % of outcomes than any other more complex solution. For small amounts (<0.05 BTC) it is by far the most scalable solution. |
What about a scammer selling, receiving payment and then getting his BTC back after 90 days? Sure, that is a possibility. But it's not free or risk-free: the scammer loses their security deposit and has their funds locked up for 90 days. To steal $1000 the scammer would have to lock up $1150 for 90 days. During those 90 days they would risk losing their payment method (Bank account, Revolut, etc..) due to fraud complaints... so they would have a risk of losing it all. Many payment methods still allow chargeback due to fraud (SEPA, Zelle, UK Faster Payments)... If the risk of scam is not negligible (<1%) users would increase security deposits. With a 50% security deposit this type of scam would definitely not be worth it for small amounts... and very risky for high amounts. |
|
We have quite a few cases where sellers do not respond and release the BTC. They loses the sec. deposit which is often quite a lot of money (there are some 2 BTC XMR trades with that issue, so they lose > 1000 USD). We don't know and understand whats the reason for that, but it would be worse with a pure MAD system as those buyers would then all end up with nothing and the seller would even get back their trade amounts later. It might be that we will make some experiments with MAD with some new payment methods (Cash by mail) as those cannot be meaningfully verified by a mediator/arbitrator. So that would give us some experience how well or bad MAD will work, though it has to be taken with care as if it has not scaled up it does not mean too much if it was not abused - scammers come with scale/volume. But as pure MAD is not used as far I know in any platform I doubt it would work if scaled up (scammers will come later once enough potential victims are there). Most other platforms use reputation as a primary "protection" even it is very flawed it is better than nothing... Also most other platforms have much higher fraud rate as far I heard (not investigated myself, and of course I am biased ;-)). |
|
@flix1 I would not call your proposal MAD, if seller can get it's trade funds back. Mutual Assured Destruction needs that both participants see the deposit an traded funds to be destroyed (or sent somewhere they can't reach) if one of the parts is not happy with how the trade developed. Your idea could be applied only for online, not reliable payment methods but not for face to face etc. @chimp1984 Bisq is the first positioned platform to develop MAD protocols, and the one which needs it the most to keep its goal. Other platforms rely on reputation so they don't even think of it, but that makes them more centralized, trust dependant and less private. |
|
I think the problem is the increased risk and increased cost. If any offer I make is at risk to end up burned if the peer is not cooperative or a newby who does not understand Bisq, or just lazy if small amounts, I would think very carefully before adding an offer. And if the deposits is then 100% we make it even harder. |
|
Coinffeine, a defunct DEX project solved the issue of increased cost of MAD by fractioning trades into many small ones, each with 100% security deposit, to be made sequentially. ie: an exchange of 1 BTC would be broken up into 1000 x 0.001 BTC trades. So that with 0.001 BTC security deposit each trade amount would be 100% secured... They did this using payment channels and API-enabled payment methods. If one of the (small) trades failed then the sequence was interrupted. Coinffeine failed, but I think the idea has some merit... I know It's not practical right now with current trade protocol, but it could be if lightning network ever becomes part of Bisq. Of course an API is also necessary, you don't want to be clicking "next" 100 times or making 100 bank wires... But maybe for altcoins it could be a viable possibility. You could set up a channel between 2 bots one sending XMR and one releasing BTC as each XMR fragment is received. |
|
Yes Coinffeine failed as it was based on OkPay so those have been the central party at the end, where you lose all privacy as they would see clearly who did a trade by those micro transactions. |
Completely agree.
You are probably right... but for high risk, low cost, instant payment systems like Paypal, Venmo, Wechat, CashApp, Revolut this might be a the only viable option long term. Once APIs are enabled a bunch of Bisq $10 transactions will be indistinguishable from other (much more common) similar payments. Relying on central parties is almost inevitable for the fiat side... but if you can choose between many of them you can find the chinks in the armour. There are other reasons for programmatic fractional payments and soon a payment method will specialize in them and encourage them and Bisq will be able to mimic those payments and hide in the crowd. Examples: pay per view sport event streaming, Patreon, Netflix subscriptions, twitch sub streams, facebook ad campaigns, in-game shopping... |
But it does not help for chargeback risk. If payment channel get closed and you think you have the fiat the scammer can do the chargeback next day and the seller has lost his btc then. OkPay was chargeback free, so that problem was at least eliminated at Coinffeine. |
In a discussion with @sqrrm we came up with some ideas how to solve the issues with burningman and refund agent. As always the best solution to a difficult problem is to eliminate the source of it, e.g. to get rid of both roles.
Here are the 2 ideas.
We want to remove the role of the refund agent and make the arbitration process a pure secondary mediation process instead. To avoid the friction for the user to need to go though the process of requesting reimbursment from the DAO and then being exposed to the volatility and liquidity risks when trying to sell the BSQ for BTC to get his lost funds recovered I would suggest a new model.
Getting rid of the refund agent
Adding a reimbursement claim market
The trader can put his claim for reimbursement on an auction market with a limited period (e.g. 1 week). Anyone can make an offer in that time to offer x amount of BSQ to pay the trader the lost BTC and getting the right to do the reimbursement request for the traders dispute. He is buying the claim for BSQ issuance with BTC. This can be all relatively trivially secured by signatures and pubKeys. The best offer (lowest BSQ amount) after the time expires will be executed and the trader gets his BTC back from the winning market partizipant. The trade is like any altcoin trade. I doubt there is a solution for an atomic model but I think that is not needed as both sides of the transaction can be trivially verified.
The claim purchaser then makes the reimbursement request for the amount of BSQ he paid. This might be more than the average market price as it represents the risk for getting rejected by the DAO as well as the liquidity and volatility risk. Disputes with unclear outcome have litte chance to find anyone who is making an offer and might not be sell-able. That is good as only 100% clear cases should be reimbursed. In doubt the claim buyer is taking the risk and might get rejected by the DAO.
With that we create an open market for the claims and avoid to put the burden on the trader. The only burden for the trader is to wait 1 week until the auction is over. The price difference will depend on the health of the BSQ market and of the dispute result. As said unclear cases might not be sell-able or only at a very high price which would then again reduces the chance that the reimbursement request gets accepted in DAO voting. The dispute result (mediators summary notes) is publicly visible and the same which will be used for DAO voters to accept or reject.
It could be implemented as a new payment method and a "token" representing the claim. The tools for verifying the signature can be integrated in Bisq. The acution model would be new and need more thought, maybe there are better ways to do it (anyoneCanPay sighash might be useful here - but that needs more thought).
Getting rid of the burning man
Swapping automatically BTC fees to BSQ
With the work on atomic BSQ/BTC swaps and the work on the API we should be prepared for a solution how to do an automated conversion of the BTC fee to BSQ (and burned funds from arbitration cases).
At the trade fee transaction we could add the atomic swap of the BTC fee part with the BSQ fee. There need to be special market makers (using the API for automated trading) who do not need to pay a maker fee for their offers and who keep many offers online. To avoid abuse like offer spam they have to set up a BSQ bond (using a proof of burn would be another possibility as @MwithM pointed out). So they act as bonded roles. Anyone can partizipate to be a market maker and it should be a profitable activity. They make offers with smallest min amount (0.0001 BTC) to max amount (2 BTC). A trader using BTC fees will automatically take the best offer on the market use the BSQ input for the fee tx and burn the required fee. The trade protocol for that is atomic so the trade fee tx is the BSQ/BTC swap as well as the fee payment and preparaton of the reserved funds. The interactive process could be probably reduced to one direct message for requesting the signature of the market maker. The inputs for creating the prepared tx could be added to the offer, but those are details to figure out later...
Automatically burn BSQ from atomic swap with delayed payout tx
For making the process of convering the BTC funds from the delayed payout tx to BSQ and burning those can be automated via a special atomic swap as well.
Similar like the trade fee swap we could use market makers putting up offers to sell BSQ for BTC and the BSQ will be burned instead being received by the peer like in a normal swap.
The funds from the delayed payout tx goes as 1 input to that swap tx. The other input is the BSQ from the market maker. The outputs are the BTC which goes to the market maker and a optional change from the BSQ input. The BSQ amount representing the BTC input will be burned in that tx. The publisher of the delayed payout tx takes the best offer on the market (highest amount of BSQ burned). Here is a bit of a risk how we can guarantee that he has not manipulated the code so that he takes an offer which he created by himself with a manipulated price. To avoid that we can show the price in the arbitration and the arbitrator will discover if the price was off from the usual market price. The price is determined by the health of the BSQ market, so again the real price for that conversion can be different than the average market price specially if it is larger amounts.
How to deal with the issue that we need to determine the output of the delayed payout tx at take offer time is an open problem we need think more about. One solution (not a good one) is to take the best offer at that moment and pre-select the potential marekt maker, but that comes with various problems... An area we need to find a good solution still.
So with that part we are providing more liquidity for those who want to sell BSQ.
The whole concept requires that the BSQ market is somehow healthy and not terrible volatile and illiquid. But it confronts the DAO with the reality and we need to fix it if it is not satisfying. The current system makes some shortcuts that contributors takeing altruistically more risk as the DAO is paying for (refund agent).
An open risk is that the trades with larges amount (e.g. 2 BTC) will cause large burning and reimbursement swaps and BSQ trades with large amounts might tend to have a negative impact on price. Not 100% sure about that but need to be considered.
I think with those 3 elements we remove completely those problematic roles and get to a more market based and open system. It also does not seem to be terribly complex and that much engineering effort, sure its not done in a week, but its feasible to get there in a few months.
The text was updated successfully, but these errors were encountered: