sBTC Research - Cap on BTC in Peg Wallet

[AshtonStephens]

This is a research discussion post meant to be edited with research notes surrounding adding a hard cap on the BTC in the peg wallet.

The primary concerns are:

• Security / vulnerability to malicious majority signer set
• Limitations on applications that could come from a hard cap
• How we might tie the value of stacked stx coins to the maximum amount in the peg wallet

[AshtonStephens]

Currently under investigation by @andrerserrano

[andrerserrano]

Research summarized here.

[friedger]

Some discussion here as well https://discord.com/channels/621759717756370964/1100888369380212757/1166541727365087333

[AshtonStephens]

Follow up here: https://discord.com/channels/621759717756370964/1100888369380212757/1171283713049505862

[tycho1212]

It's become pretty clear from previous discussions that a capped sBTC will be a disaster for DeFi protocols on Stacks. We had an initial open discussion here: https://forum.stacks.org/t/making-sbtc-ready-for-defi-prime-time/14421

There's really no way that DeFi with sBTC can succeed when there's a cap on minted sBTC

As a user, I personally won't use sBTC as collateral in DeFi when there is a cap (extreme long tail liquidation risk)

[andrerserrano]

I'm supportive of the removing the cap for the following reasons:

1. As Tycho mentioned, the hard cap likely would prevent any meaningful adoption of sBTC due to its limitations on scalability and risk for DeFi users.
2. Nakamoto stackers will likely be majority exchanges and custodians, who have reputation at stake as security-focused businesses. As long as 30% of these entities remain honest & incorruptible, the BTC in the peg wallet will be secure.
3. Based on this forum post, its clear that community sentiment is in favor of removing it.
4. The cap doesn't prevent users from sending BTC to the peg wallet, it only prevents sBTC from materializing. So it is largely ineffective at perpetuating it's intended goal.

It's important that we communicate this change clearly, since it does introduce some new trust assumptions. We can also emphasize our strategy to work with high-reputation signers to mitigate any potential concerns.

Long-term we plan to do continued R&D on technologies like BitVM and DLCs to explore potential avenues to reduce the trust assumptions of the peg.

[Policynotic]

Can you or anyone expound on what is meant by this "The cap doesn't prevent users from sending BTC to the peg wallet, it only prevents sBTC from materializing. So it is largely ineffective at perpetuating it's intended goal." by chance? Does it mean that you can't stop someone from sending to the L1 bitcoin wallet, but what the cap does stop is new bitcoin being entered as part of the smart contracts that might risk liquidation as tycho explained? Thanks a lot!

[andrerserrano]

That's correct.

[muneeb-ali]

I think the key thing to understand here is that the cap vs no cap choice is actually a choice between two different underlying designs:

(a) A design where signers are mostly anonymous and the only security guarantee is the STX capital locked
(b) A design where > 30% of the signers are not anonymous but reputable institutional signers and in addition there is a long tail of other signers as well that freely come and go.

The evolved sBTC design is (b) and not (a) and the whitepaper needs to be updated to reflect that. There is a huge difference between the security properties of the two systems. In (a) the system is very much dependent on the STX/BTC price and the economic security whereas in (b) the final backstop for security is the > 30% of institutional signers regardless of STX/BTC price.

I personally would feel more comfortable with (b) given Stacks is still a relatively small ecosystem and STX/BTC price can be volatile. More importantly, design (a) absolutely requires a cap on sBTC supply and that is a bootstrapping issue. If Stacks marketcap was north of 10B and the sBTC cap could be in billions then you could explore design (a) more. Having a cap of 100M or even 200M immediately puts a small ceiling on potential DeFi usage and discourages large players from even entering the system.

Given these market realities and what the BD working group has learned from parties that want to use sBTC in DeFi, the uncapped version with trust-assumption of institutional signers as final backstop seems like the clear path forward.

We should also keep in mind that the goal here is to deliver a practical system that is usable in 2024-2025, not some theoretical perfect thing that doesn't work in short-term (say due to practical limitations like low cap). There is rapid innovation happening at Bitcoin L1 e.g., with BitVM that can potentially reduce trust assumptions for BTC pegs. As those technologies mature or if Stacks marketcap matures at a much higher number, the devs and community can revisit some of these design choices.

As far as the Nakamoto release is concerned I think setting these design parameters concretely helps everyone. So there is less confusion and it's super clear what exactly is the system that is being built here. Appreciate the discussion here. I think it's an important topic. An important next step will be to update the whitepaper (which is open-source and the working group updates it). I can try to help with it -- thanks!

[Policynotic]

Hi! It’s Hannah Wolfman-Jones. I talked with some of you in the sBTC discord recently, but as Muneeb suggested, I think it may be best to continue the conversation here.

It sounds like there might be friction between ideals for institutional investors (no cap for sBTC so not liquidated) and the ideals for more risk-averse stakers or sBTC users (which benefit from a guarantee of a higher cost of attack to reward ratio). Because if I understand correctly, both these things are true:

1. Having sBTC value >> Stacks marketcap can result in hacking/stealing by anyone who has the capability as they all have a profit motive and if the value of the sBTC is very large it becomes likely. There is also real safety risks for companies and individuals who comprise the trusted 30%

2. What tycho eloquently explains about liquidation risk for companies if there is a hard cap. That is a concern I think is worthy of caring about as well DeFi will drive much of the adoption and thus also benefit the security both of sBTC and Stacks in general.

I think a soft cap can potentially balance both needs.

To expand on my personal main concern (1). Let me paint one of many possible hypotheticals for you that are likely enough to be taken into consideration in my humble opinion:

IMAGINE: You are the commander of a highly capable intelligence unit facing serious shortages and the frightening prospect of losing a war and your lives. A man in your unit notices a very large value of bitcoin collateral secured by a much smaller value of stacks. Bitcoin can buy you the drones you need on the black market, or perhaps be paid to a human smuggler to get you out of this horror into which you were forced by draft. Your unit decides to work together to steal the funds. Facing existential threats yourselves, you are ready to use blackmail or even violence to get this bitcoin reward. You know that you will need to corrupt a huge percentage of the “known and trusted” 30% of stakers to help you steal the funds. Your 3 most skilled hackers immediately go to work finding blackmail on trusted stakers. Conveniently all their names, businesses, affiliations, and stake sizes are listed right there for you! First, your hackers investigate the biggest known stakers which are mostly different DeFi protocols, apps, exchanges, etc.. For one business you discover that the founders failed to disclose their initial holdings properly to investors, another that they find bought big into some shitcoin right before listing and featuring it on their exchange, yet another doesn’t have all of their customers’ funds. All of these could end in reputation savaging and even bankruptcy and legal action against those involved. Great blackmail potential. Next, your team hacks into the associated founders, etc. including their loved ones. You get into their computers, their spouse's emails and socials, and kids' accounts. In some you find evidence of insider trading, or illegal pornography, or tax fraud. Through this blackmail and also threats of violence you manage to get 20% of known stakers to agree to withdraw their funds. The blackmailed known stakers can mostly preserve their reputations fine as all they are doing is selling their stacks. The 20% of known stakers all unstake and sell their stacks at once. This tanks the price of stacks so you are able to buy the stacks up at a discount until you reach the required 70%. It also gives a window of time where the trusted entities are a smaller than the usual percent of the protocol. Additionally, the trusted stakers with really bad skeletons sell you all their stacks at a steep discount anonymously on the side or perhaps even help you with the initial funding or give you info to blackmail still more stacks holders (how kind of them!). Through these means you are able to buy up enough stacks to steal all the Bitcoin. Due to the blackmail and your team's enormous skills in cloaking your digital identity, you don’t think you will be caught. Even if you are caught later, you have existential risks you need to deal with right now, so stealing was a rational economic move. Your superiors actually see the move as a moral and military victory, because most of the bitcoin came from your opponent, the U.S. and their allies. Bonus!

While I hope the above example was mildly amusing to read it was not a joke as far as what I think could plausibly occur if a hard cap is removed. It turns the trusted stakers into coercion targets for criminals or in this case, some military intelligence unit which could be an enemy or even a sufficiently disgruntled ally. The chances of this occurring are very low if the Bitcoin controlled by sBTC never gets very large, and the ratio of Bitcoin controlled to Stacks securing doesn’t get very high. Then great, by far no cap ended up being the right choice! However, if the opposite occurs it becomes more and more likely the larger the honeypot and the smaller the corresponding stacks for security.

Thus, at a certain point I believe that trusted stakers become liabilities and points of poor security for the protocol. The known stakers could also face escalating risks as the value of the Bitcoin gets high. I know it adds complexity (which also comes with risks), but I believe that some sort of a soft cap system might accommodate both the real needs of DeFi and the concern of some stackers such as myself due to the types of attack I gave an example of above. I know several have been discussed like sliding pricing and a hard cap based on the ratio of Bitcoin to stacks securing, but I would like to reopen the discussion, because I think there are others that might work better.

For example, what about a soft cap where there is a hard cap for bitcoin in new bitcoin contractual agreements that can be added (or a cap based on ratio of Bitcoin to value of stacks securing, etc.). However, even after that cap is reached for new Bitcoin contracts, the existing Bitcoin contracts can be added to so that the people who already had contracts when the hard cap was reached can continue adding bitcoin and avoid liquidation (but no one else can start a new smart contract). That may not be a good explanation, but I can flesh it out further if you don’t know what I mean and haven’t already dismissed that as an option in a different discussion I haven’t seen.

[muneeb-ali]

@Policynotic thanks for moving some of the chat here. Thanks for bringing up the soft-cap idea as well.

The last point I made on Discord was that the hybrid system that has both (a) anonymous signers that have locked STX and (b) known, institutional signers that have > 30% weight, is arguably more secure than a system with just anonymous signers with capital locked.

First, let's try to define what type of signers qualify as institutional. These would be entities like Bitgo, Coinbase, Anchorage, Binance etc. These entities already hold significant amount of STX and BTC, either through their custody business or just on the exchange. To give more concrete examples, Coinbase holds around 5% of BTC supply or approx $35 billion worth of BTC. Binance holds 50,000 BTC worth approx 18 billion. If a Coinbase, or a Bitgo, or a Binance would get hacked then the hacker is much better off stealing the billions of dollars of funds directly accessible to them vs trying to collude with other signers on sBTC where the total money they can steal would be less than 1 billion. Please keep in mind here that a compromised signer still needs to collude with other parities to get to 70% signing capability. It's safe to say that if Coinbase, Bitgo, Binance, and other institutional players are all hacked then the entire crypto industry is in trouble. However, the sBTC peg would still be safe because all these hacked entities will still need signature from the other 40% signers to do anything and move funds.

Next, a hard or soft cap approach does not protect you against hacking of all institutional players. Because if Coinbase and Binance and other large players are hacked then the hackers can crash the price of STX causing the peg to be under collateralized. Same argument applies for institutional players turning evil and stealing funds. If they turn evil and don't care about local laws then the easier thing for them to do is steal customer funds where they have direct access vs trying to steal from the sBTC peg where they still need to collude with other signers and cannot move the funds even if all 30% institutional players turn evil.

Now compared to a "collateral only" approach, the hybrid approach is not susceptible to two types of attacks (a) attacks on the on-chain STX/BTC price feed oracle which is calculated from BTC bids on Bitcoin L1 and (b) attacks in which an attacker wants to cause a temporary price crash of STX on exchanges. If there is an attack on the on-chain oracle or a flash crash of STX price on exchanges, the institutional signers may continue to do their job correctly because they were signing for reputational reasons (and not just because of the collateral).

Having this additional security vector of highly reputable institutional signers even discourages people from attempting on-chain oracle or temporary exchange price drop attacks. On the flip side, worrying about institutions becoming evil or institutions getting hacked doesn't really buy you much practically speaking because if a hacker takes control of large exchanges or large custodians then the "collateral only" approach is not going to save you anyway (the price of STX can fall quickly and the peg can become under collateralized anyway).

We appreciate that you are thinking hard about these problems and this discussion is really helpful to the community. I think the best steps for us to focus on are:

(a) To get as many signers on the network as possible. Including as many institutional players as possible. That's the beauty of decentralization. If we get 100s of signers then we're not dependent on any single signer or institution. Given the network is open, the ecosystem can continue to add new signers and keep becoming more decentralized over time. The more decentralized the set of signers the harder it is for all of them to collude and do any harmful thing.

(b) Active research on BitVM and other approaches where the trust assumptions can be significantly reduced from 70% honest majority to potentially just a single honest verifier can be very helpful and a game changer.

Finally, the thing to keep in mind is that the current market leader WBTC is a single signer (Bitgo) with no cap. The other solutions in the Bitcoin ecosystem, namely Liquid and RSK, are both multisig (a handful of pre-determined signers) and no cap. So when sBTC ships with a ton of decentralized signers on an open network it'd be a welcome addition. However, it's important to note that all other options are already no cap and if we hamper sBTC by making it capped then it can significantly limit the potential success given that we have direct market data from the BD working group that developers and DeFi operators prefer no cap solutions. It's not even a small preference but a significant preference for no cap solutions to the extent that they may not even use a capped version. Also, as we discussed on Discord, the no cap stuff is much more relevant in the early stages, say when total BTC pegged is less than 1 billion. Once enough liquidity is there, potentially in billions, then some of the early bootstrapping concerns start to fade away and the free market solution can naturally start coming closer to the collateral ratio potentially. Hope this helps!

[Policynotic]

That all makes a lot of sense to me and assuages my concerns. I think you all are likely right about the no cap approach. Thank you for taking the time to thoroughly explain. If possible, I would love to participate in ironing out the specifics as to how the 30% known/trusted works etc. if those have not already occurred. But this all sounds very well thought out and I am so grateful for all your hard work!!

[andrerserrano]

The sBTC working group is in agreement with these points and will pursue design (b). The hard cap will not be included in the protocol implementation. Next step is to update the whitepaper and prepare other educational materials on this design choice.