diff --git a/aips/aip-51.md b/aips/aip-51.md new file mode 100644 index 00000000..dcca89ca --- /dev/null +++ b/aips/aip-51.md @@ -0,0 +1,71 @@ +--- + +aip: 51 + +title: Changing beneficiaries for operators + +author: junkil-park, michelle-aptos, movekevin, wintertoro + +discussions-to: https://github.com/aptos-foundation/AIPs/issues/251 + +Status: In Review + +type: Standard Framework + +created: 10/3/2023 + +--- + + +# AIP-51 - Changing beneficiaries for operators + +## Summary + +Currently, the operator commission goes to the operator's address. We have received multiple requests for the ability to set a different beneficiary address. One example use case is when operators want their commission to go to a cold storage wallet while their operator address is used for day-to-day operations. This feature applies to the staking contract, the delegated staking contract, and the vesting contract. + + +### Goals + +The goal is to allow operators to set a different beneficiary address for their commission rewards. So, the following scenarios should be possible: +- An operator wants to store commission rewards in a cold wallet. This change would introduce the decoupling of the wallet and operator keys so that funds can be sent to an address different from the operator's account. +- The funds would remain in a cold wallet while the operator can perform other operations in a hot wallet. + +### Out of Scope + +Changing the beneficiaries for token owners (e.g., stakers, delegators) is out of the scope of this AIP. + +### Impact + +This feature impacts operators and their beneficiaries. If a current or new operator has never set a beneficiary address explicitly, their beneficiary address is the operator address itself by default. + +## Specification +* The beneficiary of a current operator is the operator address itself. +* The beneficiary of a new operator is the operator address itself by default. +* The operator has permission to change its beneficiary address. +* The beneficiary can also request the commission rewards. +* The beneficiary change takes effect imeediately. +* An event is emitted when the beneficiary address is changed. + +## Reference Implementation +Please refer to the [reference implementation](https://github.com/aptos-labs/aptos-core/pull/10455). + +## Testing +- What is the testing plan? +Automated unit tests and testing in devnet/testnet before releasing to mainnet. + +## Risks and Drawbacks +When the operator address is set to a new address, if the beneficiary address remains in the old one, the commission rewards can go to the wrong beneficiary address. To mitigate this, when the operator address is reset, the beneficiary will be set to the operator address. + +Suppose an operator sets the beneficiary to their separate account for rewards and delegates the operator account and the operation to a third party (e.g., contractor). In that case, there is a risk that the third party can change the beneficiary address to their address. No mitigation for this risk is part of this AIP because it is not a common case and is out of scope. A sophisticated access control mechanism is required to mitigate this risk. + +## Timeline + +### Suggested deployment timeline + +This change will be part of the v1.8 release. +Testnet: December 2023. +Mainnet: December 2023. + +### Security Considerations + +The framework change in delegation_pool.move will be audited before it is considered complete.