[Withdrawn] T3 Trusted Custodianship @Nagalim

Nagalim 2015-12-23 05:44:35 UTC #21

It’s developing a lot of precedent about what trust, collateral and credit mean. Biggest risk is that NSR devalues and I take the funds and run. However, that risk is vastly under spoken in T1 operations and this type of grant will help shareholders understand what trust and credit mean.

Other risks are that I abuse the liquidity reporting system or manipulate price feeds slightly in my favor. Again, all these attacks are totally within the grasp of a T1 pool operator.

The cost is that I take the initial 1000 buy side from T4 reserves. This will reduce T4 overflow by $1000.

cryptog 2015-12-23 05:46:45 UTC #22

You mean in case of NuLagoon?

Nagalim 2015-12-23 05:48:57 UTC #23

No, in the case of ALP. I could drain NuPond nbt and run at any time, leaving Nu with no collateral.

Nagalim 2015-12-23 14:32:02 UTC #24

It is my opinion that if we have ~10 of these trusted custodians with similar trust levels (1-5 kNBT each) we would completely solve our short-term liquidity problems. (T4 would only activate once/week except in extreme scenarios)

cryptog 2015-12-23 19:11:00 UTC #25

Nu needs to pay for 1000 nbt upfront. So 1000 nbt is the cost?

Nagalim 2015-12-23 19:17:43 UTC #26

So the reason why I have a hard time defining cost is that this proposal is really at heart an entry point for T4 funds into the T1-3 ecosystem. It’s more an exchange than a reserve. The funds I will hold will not be my funds, they will be owned by Nu and I will just be holding them.

If you count the 1000 NBT and the $1000 of BTC as costs, then the 500,000 NSR I am burning is a profit. However, these are better seen as collaterals for a trust based relationship.

Nagalim 2016-01-04 16:17:31 UTC #27

I’m not really clear on why this failed. I think shareholders are waiting for some miracle that is never going to appear. Anyway, I’m withdrawing this proposal because it puts an unnecessary hold on my funds.

masterOfDisaster 2016-01-04 17:36:32 UTC #28

Sad to see this fail, but understandable that you don’t want to wait any longer

I had to think about it, but now I’m sure that my first response doesn’t suffice.
I would really like to know why only roughly 25% of minting NSR holders supported this proposal.
Do they really want to rely solely on NuLagoon Tube? This is not exactly in favour of decentralization.

<rant>
NuLagoon Tube can be used whenever LP want to use it in difference to this proposal that requires to make deals. But it’s less convenient than doing an exchange with such a “T3 Trusted Custodian”. NuLagoon Tube requires that address pairs are registered and the funds need to be sent from a registered address.
If an LP wants to balance the funds, they need to be withdrawn to the registered address (BTC, NBT), sent from there (TubeIn), exchanged and sent to the associated (registered) address (TubeOut).
That is much less convenient than sending directly from the exchange to the deposit address of the trading partner (T3 Trusted Custodian) and receiving the exchanged funds directly on the exchange deposit address.

I don’t know whether this is related to a test phase, but the last NuLagoon Tube transaction took close to 12 hours to be processed.

Don’t get me wrong. My intention is not to bash NuLagoon Tube. I think it’s a great service, but in my opinion not exactly for the purpose of balancing funds used for liqidity provision.

So I want to know why this proposal is neither supported nor improved by feedback.
I’m asking in the light of the use of the Poloniex gateways (NBT entry; NBT exit). Each of them has been used more than once in the lat weeks. I thought them out for emergencies. We seem to have a lot of them.

This proposal of T3 custodianship is very well suited for being applied to each (automated) liquidity pool (ideally multiple times).
Each pool operator could think about applying for such a custodianship.
Each NSR holder should think about applying for such a custodianship.

How can we even imagine introducing additional products if we can barely manage to keep the balancing of NBT buy and sell side under control?
</rant>

What are the alternatives?

cryptog 2016-01-04 22:40:19 UTC #29

What is the problem that this proposal wanted to solve in simple term? I think shareholders do not grasp it and therefore cannot judge if it worth or not. They abstain from voting as a consequence, including me.
Maybe it comes down to: what are the problems that the current liquidity operations have?
I think we need to go back to basic questions.

Nagalim 2016-01-04 22:54:53 UTC #30

Mod’s gateways prove that we are in emergency situations constantly. We need a buffer between T4 and T1+2. That buffer is T3. This is a T3 proposal. Is that not clear enough?

Can you not see that the situation is dire?

Cybnate 2016-01-05 02:10:11 UTC #31

I’m wondering why we need additional T3 funds when we have a way dealing with it although ‘less convenient" through NuLagoon Tube and it is not used at all as far as I know. Is Nagalims’ T3 proposal more convenient than the gateways? I don’t think so, and I believe it is more work/overhead for operations.

The lower the hoops and loops for rebalancing the better. If that can be done without further T3 (outside NuLagoon) then why not? Maybe we should even revisit the T3 maintained by NuLagoon. My apologies if I annoy people to challenge status quo, but I think it is time to rethink this.

Maybe we should use the automatic gateways for normal operations instead of only emergencies. I’m interested to hear why that is not a good alternative. I imagine that we need a few more operators though and revisit MoD’s terms of reference. This maybe a lot simpler and therefore more cost effective.

Nagalim 2016-01-05 02:26:50 UTC #32

Mod set up the gateways for emergencies. No one has set up gateways for normal operations because it has no incentive. If Nu Lagoon solves all our problems, why are we still abusing the gateways that were specifically designed for dire situations? If gateways work so well, why is no one willing to set more up? Think about the incentives and design a robust, scalable structure. That thought process led me to this grant.

The main differences between this and Nu Lagoon is are that a) there is no trade between T3 and t4, rather it is just a trusted refilling making for automatic consensus with no need for a price feed and b) it is scalable and decentralized by having many trusted operators.

There are a lot of other things to say, but Mod was on point: what’s the alternative? Using shareholder funds on-exchange got us into a lot of trouble a year ago, perhaps shareholders have forgot that lesson.

Nagalim 2016-01-05 02:39:41 UTC #33

Even if you think exchange default is a low risk, there is still another question: what are the downsides to this motion? I offer fully collateralized liquidity operations that deal directly, smoothly, and fairly with T4. Why would shareholders not want that?

Cybnate 2016-01-05 02:41:24 UTC #34

Clearly not and that therefore I challenged that in my post.

The gateways are a robust design imo and work with existing tooling. Nothing is needed to develop. My reason is the uncertainty/risks of directly trading with funds which are not mine in the US (Poloniex). The legal/tax/administrative consequences of that are not clear to me. If someone can assure me that that would be no problem and easy to administer, I’m fine to setup such gateways for a relative small fee given that they are automatic. I’m sure we can convince a few others if it was that simple.

It is the way Shareholder funds are managed. Would Shareholders be more comfortable to transfer that risk to custodians at a fee? Maybe to a certain extent for a low fee. However I don’t see a problem/huge risk when small amounts are released across several exchanges to spread the risk. The amounts MoD is managing now on just one exchange and the way it works. The issue is that we only have one gateway operator and one exchange as arbitrage doesn’t appear to work well, that is a risk indeed which we need to solve.

Nagalim 2016-01-05 03:27:41 UTC #35

I am blown away that you don’t see the risks associated with gateways. I will enumerate them, putting the way in which this proposal alleviates that risk in {}. I will try to put most important first, but I do intend to be thorough.

Exchange Default. If the exchange is hacked, we lose all funds in the gateway. This is very reminiscent of ktm and jmiller’s operations that cost shareholders so much money. The only other Nu service that has this risk to shareholders is the share buyback process.
{No funds are held on exchange}
Gateway operator could run with the funds. There is no incentive other than reputation to follow through.
{Operation is collateralized}
Gateway operator could sell to themselves at a discount. Without access to the exchange’s records, shareholders have no way to tell if they’re being had.
{Operator is required to submit a list of transaction prices with a time stamp}
Exchange could freeze funds. Exchanges are sometimes subject to KYC and AML laws.
{Funds aren’t held on exchange}
Gateway operator could falsely submit liquidity data. Without exchange records, no one really knows how much liquidity the gateway holds but the operator.
{Liquidity is verifiable on the blockchain}
T4 signers could overfund the gateway, requiring them to fund the other gateway as well, generating more risk and loss for the whole network.
{Liquidity is only replenished when it is used}
Gateway operator demands compensation.
{Operation pays for itself using a trading fee mechanism}
Bot malfunction or price feed manipulation.
{No bots or hard-coded price feeds are used}
Only works on one exchange, so custodians pay withdrawal fees
{Trades happen off-exchange}

Cybnate 2016-01-05 03:42:13 UTC #36

I do see most of those risks and they are not only gateway related, but it is good to have them nicely spelled out. Thanks for that. But are you saying that your proposal solves all this and at no fee? I don’t think that is sustainable, if possible at all. At best a subset of those risks can be covered and at a cost of overheads or fees.

I’m still struggling why trusting and paying a number of custodians with manual handling of T3 funds, collateralised or not, would be better/less risk than having automatic gateways with no overheads even though there might be some risk left. Maybe we need to compare the risks and costs between the gateways and the custodian proposal to get a clear overview of the value vs remaining risks and costs of the T3 custodian. Or if anyone has a better idea, I’m open to get a better understanding of this.

Nagalim 2016-01-05 03:45:09 UTC #37

Which points do you have problems with? The way the proposal deals with each risk is explained in {}.

What overhead is there in this proposal? All funds used will be put directly into T3 or T4 liquidity.

The sustainability is in the 0.3% fee, like NuLagoonTube is playing with. 0.2% goes to the trusted custodian, 0.1% to Nu. The Txn volumes are verifiable, giving a clear reward to the custodian for playing nice.

mhps 2016-01-05 04:02:13 UTC #38

IMO @Nagalim missed one important point of T3 in the list – FLOT should not be a daily job to micromanage T1-2 liquidity. FLOT operations should be no more than once a week. Daily balancing of T1-2 should be T3’s responsibility.

This T3 proposal makes it a routine, quasi-predictable job for FLOT to refill T3, with no shareholder’s fund going into exchanges. This is very good.

If @masterOfDisaster feel that the gateway is being abused, he should curb the use of it, for the benefit of himself, the FLOT, and Nu.

Nagalim 2016-01-05 04:11:10 UTC #39

I can reiterate each point if that would help:

Funds in T3 are held in single-signer wallets, presumably backed up and only the trusted custodian has the private key. This risk devolves into point 2.
If the operator runs with the funds because of personal insolvency or getting hacked or whatever, there is collateral. It’s not the best mechanism in the world, but just try collateralizing a gateway: the use of a fixed band of liquidity held in a T3 custodial address makes collateralization much easier, reducing it to a problem of estimating the value of the collateral rather than trying to guess how much money will be in the gateway. Also, good luck getting people to collateralize a gateway without any incentive.
The price feed is basically the custodian’s best judgement. The record they submit can be checked via the blockchains (all transactions are public because that’s the state of crypto folks) and cross checked with a record of the BTC price on popular exchanges. If the custodian is bending the prices some curious investigator (or a future software) may discover their ploy and oust them. This risk will prevent such actions.
The custodian is trusted by the customer/custodian to receive the funds first in a trade.
The BTC and NBT addresses hold x BTC and y NBT on the blockchain, 100% verifiable.
This is a passive liquidity source that asks for more from T4, rather than being active where T4 needs to be triggered by a threshold.
Charging a trading fee gives the T3 trusted custodian an incentive path already.
Trades are manual and with a minimum volume, so manipulation or malfunction will be rare.
Trades can be done directly to exchange addresses, or wallets, or whatever you want.

Cybnate 2016-01-05 05:41:01 UTC #40

That helps
Re 1 and 2 Collateral is required either way, gateway or T3. The collateral would be the same as what would be trusted to a T3 custodian. An agreements with a a gateway would be up to say 10k, collateral would be at least 10k or more with both gateway or your T3 proposal. In both situations an incentive will need to be paid which wouldn’t differ from each other. However the gateway operation can be automatic so require less overhead and therefore lower cost.

Re 3 This is a risk with any T1/T2 operations which have to take place anyway. I think you are shifting the risk to another LP taking care of the T1 and T2 when provided from T3. Overall the Shareholders are still exposed to the same risk or more as they also have to trust and compensate you.

Re 4 This is a real risk which can be mitigated by feed dripping the gateway instead of dropping large amounts on it. This can be done with a simple triggering script and a wallet used by T4 which releases a certain amount every hour or every day till empty.

Re 5 Alix would make that clear or just looking at the actual order books. This risk is relatively well mitigated and once caught such operator wouldn’t be trusted again ever. And I believe there is not much value for an operator to do so assuming they are trusted to a limited amount.

Re 6 See 4 scripts and a wallet

Re 7 Not sure if I understand this. Why wouldn’t a gateway operator be able to have a trading fee mechanism. E.g. just a bit of spread.

Re 8 This is relative small risk. Nu is relying on many bots. Hard-coded price feeds in NuBot? Not sure what you are referring to. Only price determination would come from T4/FLOT, but that wouldn’t change with both methods.

Re 9 It still needs to be distributed to T1 and T2. I fail to see why this is different.

This is an interesting point as FLOT is apparently set up with T3 in mind. So a gateway would indeed require some adjustments to FLOT’s role. I still think it is possible to have a gateway with a bot which is drip fed by a wallet with script so that the wallet only needs to be topped up e.g. once a week by FLOT. That way T1-T3 liquidity can be in control of one custodian. Ideally you need more custodians to take this role.

Just re-iterating my point, I think the T3 layer as proposed is too complicated (overheads and costs) without taking away a lot of risks by automating it as described above. The same may apply to the T3 role NuLagoon takes, but I need to think about that a bit more as I don’t have all the data e.g. risks and costs on how that works at hand.