MIME-Version: 1.0
References: <64a34b4d46461da322be51b53ec2eb01@dtrt.org>
In-Reply-To: <64a34b4d46461da322be51b53ec2eb01@dtrt.org>
From: Antoine Riard <antoine.riard@gmail.com>
Date: Fri, 22 Apr 2022 15:57:43 -0400
Message-ID: <CALZpt+F=TyiT6xb9wby_hRRXZ0ZkW7ifP6Jy1iZhkdMjiK174w@mail.gmail.com>
To: "David A. Harding" <dave@dtrt.org>, 
 Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Content-Type: multipart/alternative; boundary="00000000000076507105dd43a4fa"
Subject: Re: [bitcoin-dev] Automatically reverting ("transitory") soft forks,
 e.g. for CTV
Precedence: list

--00000000000076507105dd43a4fa
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Dave,

I think the transitory idea is interesting, though I would say it would
take far more thinking to capture the implications.

> 1. It creates a big footgun.  Anyone who uses CTV without adequately
preparing for the reversion could easily lose their money.

I think that downside should be weighed far more. If we imagine CTV being
used in the context of a said off-chain contract, it's not guaranteed you
can downgrade to equivalent semantics around the reversion date, or not at
the same witness cost which is raising implications for your cached
fee-bumping reserves.

Further, this downgrade path might have to be re-signed by your off-chain
contract counterparties to migrate a balance distribution locked by CTV to
one relying on pre-signed transactions. This contract "consensus" is not
guaranteed and it could even be leveraged by some unfair counterparties,
who have small balances at stake.

If you can't gracefully downgrade to equivalent semantics or negotiate a
migration, it's more likely the safe behavior to adopt would be to close
the off-chain contract, ahead of the reversion date.
As it might be a critical operation, the toolchain vendors might adopt the
practice to coordinate the automatic closing with a flag day (e.g "close
your LN channel at block XXX") or in a relative distributed fashion (e.g
"close your LN channel at randomly picked up block between X and Y"). Such
relatively automatic closure, if realized in mass, would provoke mempools
congestion. An adversarial event which would cloak the security of all
existing off-chain contracts.

Therefore I'm not sure if a reversion date for a contracting primitive
softfork is the soundest off-chain contract engineering practice...

Further, I think there is one more downside not considered in your list :
negative incentives for the CTV ecosystem stakeholders. As a CTV-enabled
protocol developer, as you know time is counted to
prove the worthiness of the primitive, you have an interest to design a
protocol and develop/deploy a toolchain on a short-time basis, likely not
the soundest principle in system software engineering.
Such a development attitude is more likely to grieve the ecosystem with
safety-critical bugs/vulnerabilities, of which the exploitation might
eradicate the credibility of your CTV use-case, and with it the wider CTV
ecosystem.

So I think the data-collection method itself to advance the
consensus-building process isn't neutral on the outcome yielded. The
consensus-building stakeholders themselves aren't immune to the incentives
disruptions brought by an innovation in the process.

Antoine

Le mer. 20 avr. 2022 =C3=A0 21:06, David A. Harding via bitcoin-dev <
bitcoin-dev@lists.linuxfoundation.org> a =C3=A9crit :

> Hi all,
>
> The main criticisms I'm aware of against CTV seem to be along the
> following lines:
>
> 1. Usage, either:
>    a. It won't receive significant real-world usage, or
>    b. It will be used but we'll end up using something better later
> 2. An unused CTV will need to be supported forever, creating extra
> maintenance
>     burden, increasing security surface, and making it harder to evaluate
> later
>     consensus change proposals due to their interactions with CTV
>
> Could those concerns be mitigated by making CTV an automatically
> reverting
> consensus change with an option to renew?  E.g., redefining OP_NOP4 as
> OP_CTV
> for five years from BIP119's activation date and then reverting to
> OP_NOP4.
> If, prior to the end of those five years, a second soft fork was
> activated, it
> could continue enforcing the CTV rules either for another five years or
> permanently.
>
> This would be similar in nature to the soft fork described in BIP50
> where the
> maximum block size was temporarily reduced to address the BDB locks
> issue and
> then allowed to return to its original value.  In Script terms, any use
> of
> OP_CTV would effectively be:
>
>      OP_IF
>        <arguments> OP_CTV
>      OP_ELSE
>        <5 years after activation> OP_CLTV
>      OP_ENDIF
>
> As long as we are absolutely convinced CTV will have no negative effects
> on the
> holders or receivers of non-CTV coins, I think an automatically
> reverting soft
> fork gives us some ability to experiment with new features without
> committing
> ourselves to live with them forever.
>
> The main downsides I can see are:
>
> 1. It creates a big footgun.  Anyone who uses CTV without adequately
> preparing for
>     the reversion could easily lose their money.
>
> 2. Miners would be incentivized to censor spends of the reverting
>     opcode near its reversion date.  E.g., if Alice receives 100 bitcoins
> to a
>     script secured only by OP_CTV and attempts to spend them the day
> before it
>     becomes OP_NOP4, miners might prefer to skip confirming that
> transaction even
>     if it pays a high feerate in favor of spending her 100 bitcoins to
> themselves
>     the next day after reversion.
>
>     The degree to which this is an issue will depend on the diversity of
>     hashrate and the willingness of any large percentage of hashrate to
>     deliberately reorg the chain to remove confirmed transactions.  This
> could be
>     mitigated by having OP_CTV change to OP_RETURN, destroying any
> unspent CTV-only
>     coins so that any censoring miners only benefited from the (hopefully
> slight)
>     decrease in bitcoin currency supply.
>
> 3. A bias towards keeping the change.  Even if it turned out very few
> people
>     really used CTV, I think there would be a bias at the end of five
> years towards
>     "why not just keep it".
>
> 4. The drama doesn't end.  Activating CTV now, or decisively not
> activating it,
>     may bring to an end our frequent discussions about it (though I
> wouldn't
>     count on that).  An automatically reverting soft fork would probably
>     guarantee we'll have further consensus-level discussions about CTV in
> the
>     future.
>
> Thanks for reading.  I'm curious to hear y'alls thoughts,
>
> -Dave
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev@lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>

--00000000000076507105dd43a4fa
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi Dave,<br><br>I think the transitory idea is interesting=
, though I would say it would take far more thinking to capture the implica=
tions.<br><br>&gt; 1. It creates a big footgun.=C2=A0 Anyone who uses CTV w=
ithout adequately <br>preparing for the reversion could easily lose their m=
oney.<br><br>I think that downside should be weighed far more. If we imagin=
e CTV being used in the context of a said off-chain contract, it&#39;s not =
guaranteed you can downgrade to equivalent semantics around the reversion d=
ate, or not at the same witness cost which is raising implications for your=
 cached fee-bumping reserves.<br><br>Further, this downgrade path might hav=
e to be re-signed by your off-chain contract counterparties to migrate a ba=
lance distribution locked by CTV to one relying on pre-signed transactions.=
 This contract &quot;consensus&quot; is not guaranteed and it could even be=
 leveraged by some unfair counterparties, who have small balances at stake.=
<br><br>If you can&#39;t gracefully downgrade to equivalent semantics or ne=
gotiate a migration, it&#39;s more likely the safe behavior to adopt would =
be to close the off-chain contract, ahead of the reversion date. <br>As it =
might be a critical operation, the toolchain vendors might adopt the practi=
ce to coordinate the automatic closing with a flag day (e.g &quot;close you=
r LN channel at block XXX&quot;) or in a relative distributed fashion (e.g =
&quot;close your LN channel at randomly picked up block between X and Y&quo=
t;). Such relatively automatic closure, if realized in mass, would provoke =
mempools congestion. An adversarial event which would cloak the security of=
 all existing off-chain contracts. <br><br>Therefore I&#39;m not sure if a =
reversion date for a contracting primitive softfork is the soundest off-cha=
in contract engineering practice...<br><br>Further, I think there is one mo=
re downside not considered in your list : negative incentives for the CTV e=
cosystem stakeholders. As a CTV-enabled protocol developer, as you know tim=
e is counted to<br>prove the worthiness of the primitive, you have an inter=
est to design a protocol and develop/deploy a toolchain on a short-time bas=
is, likely not the soundest principle in system software engineering.<br>Su=
ch a development attitude is more likely to grieve the ecosystem with safet=
y-critical bugs/vulnerabilities, of which the exploitation might eradicate =
the credibility of your CTV use-case, and with it the wider CTV ecosystem.<=
br><br>So I think the data-collection method itself to advance the consensu=
s-building process isn&#39;t neutral on the outcome yielded. The consensus-=
building stakeholders themselves aren&#39;t immune to the incentives disrup=
tions brought by an innovation in the process.<br><br>Antoine<br></div><br>=
<div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">Le=C2=A0me=
r. 20 avr. 2022 =C3=A0=C2=A021:06, David A. Harding via bitcoin-dev &lt;<a =
href=3D"mailto:bitcoin-dev@lists.linuxfoundation.org">bitcoin-dev@lists.lin=
uxfoundation.org</a>&gt; a =C3=A9crit=C2=A0:<br></div><blockquote class=3D"=
gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(20=
4,204,204);padding-left:1ex">Hi all,<br>
<br>
The main criticisms I&#39;m aware of against CTV seem to be along the <br>
following lines:<br>
<br>
1. Usage, either:<br>
=C2=A0 =C2=A0a. It won&#39;t receive significant real-world usage, or<br>
=C2=A0 =C2=A0b. It will be used but we&#39;ll end up using something better=
 later<br>
2. An unused CTV will need to be supported forever, creating extra <br>
maintenance<br>
=C2=A0 =C2=A0 burden, increasing security surface, and making it harder to =
evaluate <br>
later<br>
=C2=A0 =C2=A0 consensus change proposals due to their interactions with CTV=
<br>
<br>
Could those concerns be mitigated by making CTV an automatically <br>
reverting<br>
consensus change with an option to renew?=C2=A0 E.g., redefining OP_NOP4 as=
 <br>
OP_CTV<br>
for five years from BIP119&#39;s activation date and then reverting to <br>
OP_NOP4.<br>
If, prior to the end of those five years, a second soft fork was <br>
activated, it<br>
could continue enforcing the CTV rules either for another five years or<br>
permanently.<br>
<br>
This would be similar in nature to the soft fork described in BIP50 <br>
where the<br>
maximum block size was temporarily reduced to address the BDB locks <br>
issue and<br>
then allowed to return to its original value.=C2=A0 In Script terms, any us=
e <br>
of<br>
OP_CTV would effectively be:<br>
<br>
=C2=A0 =C2=A0 =C2=A0OP_IF<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0&lt;arguments&gt; OP_CTV<br>
=C2=A0 =C2=A0 =C2=A0OP_ELSE<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0&lt;5 years after activation&gt; OP_CLTV<br>
=C2=A0 =C2=A0 =C2=A0OP_ENDIF<br>
<br>
As long as we are absolutely convinced CTV will have no negative effects <b=
r>
on the<br>
holders or receivers of non-CTV coins, I think an automatically <br>
reverting soft<br>
fork gives us some ability to experiment with new features without <br>
committing<br>
ourselves to live with them forever.<br>
<br>
The main downsides I can see are:<br>
<br>
1. It creates a big footgun.=C2=A0 Anyone who uses CTV without adequately <=
br>
preparing for<br>
=C2=A0 =C2=A0 the reversion could easily lose their money.<br>
<br>
2. Miners would be incentivized to censor spends of the reverting<br>
=C2=A0 =C2=A0 opcode near its reversion date.=C2=A0 E.g., if Alice receives=
 100 bitcoins <br>
to a<br>
=C2=A0 =C2=A0 script secured only by OP_CTV and attempts to spend them the =
day <br>
before it<br>
=C2=A0 =C2=A0 becomes OP_NOP4, miners might prefer to skip confirming that =
<br>
transaction even<br>
=C2=A0 =C2=A0 if it pays a high feerate in favor of spending her 100 bitcoi=
ns to <br>
themselves<br>
=C2=A0 =C2=A0 the next day after reversion.<br>
<br>
=C2=A0 =C2=A0 The degree to which this is an issue will depend on the diver=
sity of<br>
=C2=A0 =C2=A0 hashrate and the willingness of any large percentage of hashr=
ate to<br>
=C2=A0 =C2=A0 deliberately reorg the chain to remove confirmed transactions=
.=C2=A0 This <br>
could be<br>
=C2=A0 =C2=A0 mitigated by having OP_CTV change to OP_RETURN, destroying an=
y <br>
unspent CTV-only<br>
=C2=A0 =C2=A0 coins so that any censoring miners only benefited from the (h=
opefully <br>
slight)<br>
=C2=A0 =C2=A0 decrease in bitcoin currency supply.<br>
<br>
3. A bias towards keeping the change.=C2=A0 Even if it turned out very few =
<br>
people<br>
=C2=A0 =C2=A0 really used CTV, I think there would be a bias at the end of =
five <br>
years towards<br>
=C2=A0 =C2=A0 &quot;why not just keep it&quot;.<br>
<br>
4. The drama doesn&#39;t end.=C2=A0 Activating CTV now, or decisively not <=
br>
activating it,<br>
=C2=A0 =C2=A0 may bring to an end our frequent discussions about it (though=
 I <br>
wouldn&#39;t<br>
=C2=A0 =C2=A0 count on that).=C2=A0 An automatically reverting soft fork wo=
uld probably<br>
=C2=A0 =C2=A0 guarantee we&#39;ll have further consensus-level discussions =
about CTV in <br>
the<br>
=C2=A0 =C2=A0 future.<br>
<br>
Thanks for reading.=C2=A0 I&#39;m curious to hear y&#39;alls thoughts,<br>
<br>
-Dave<br>
_______________________________________________<br>
bitcoin-dev mailing list<br>
<a href=3D"mailto:bitcoin-dev@lists.linuxfoundation.org" target=3D"_blank">=
bitcoin-dev@lists.linuxfoundation.org</a><br>
<a href=3D"https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev" =
rel=3D"noreferrer" target=3D"_blank">https://lists.linuxfoundation.org/mail=
man/listinfo/bitcoin-dev</a><br>
</blockquote></div>

--00000000000076507105dd43a4fa--