Encourage usage of Bonded Reputation by calculating a score for all offers

[wiz]

This is a Bisq Network proposal. Please familiarize yourself with the submission and review process.

Background

The Bisq DAO has a really cool but completely unused feature called Bonded Reputation. It allows you to lock-up any amount of BSQ for any amount of time, tied to your cryptographic identity. While the BSQ is locked up, anyone can make a DAO proposal to confiscate your BSQ bond, allowing you to stake BSQ for reputation. Contributors who perform bonded roles for the Bisq DAO have also locked up BSQ to stake their reputation.

Proposal

Calculate and display a 0 to 5 score rating for all traders, and display it next to all of their trade offers, next to their avatar. For example something like this:

☆☆☆☆☆ # user has <1X BSQ bonded or bond is for <1Y days
★★★☆☆ # user has >3X BSQ bonded and bond is for >3Y days
★★★★★ # user has >5X BSQ bonded and bond is for >5Y days

Parameters could be configured, for example:
X = 1000
Y = 30

Implementation

• The score of 0 to 5 will be calculated from a blend of both the amount of BSQ and the lock time of the user's bond(s). Bonds which have less than 30 days of lock-time will be ignored.

• The icon should indicate the maximum score if the user performs a bonded role for the DAO, since they are trusted by the DAO as a contributor.

• Allow sorting the table by bonded reputation amounts/times, and make this the secondary sort order after price (i.e. if two offers have the same price, the bonded traders' offers would appear higher)

• Add an option to disable or hide offers from users who have a Bonded Reputation Score less than X.

• Display the Bonded Reputation Score to mediators and arbitrators during trade disputes.

Other use cases

• In the event of certain network events, the user's Bonded Reputation Score could be used to prioritize their mailbox messages.

• For risky payment methods, such as F2F cash trades, we could require minimum Reputation Scores to create offers for certain countries.

• Probably lots of other use cases!

[mpolavieja]

I like this proposal a lot.

• Add an option to disable or hide offers from users who have a Bonded Reputation Score less than X.

This is probably the most delicate part of the proposal. I think that active users of fiat payment methods will be very interested on protecting their bank accounts from interacting with untrustworthy peers. This feauture would be very useful for this, but at the same time it would split liquidity.

[ghost]

This proposal benefit the BSQ rich users. It also implies an unnecessary dependency to DAO and likely Github users as well. This makes Bisq trading a more dependent and centralized solution. Furthermore we think this is negative for exchange liquidity, which is poor as it is.

[shawnyeager]

I can only hypothesize for the general user base, but for me, the greatest friction/hesitation is fear of an unscrupulous trader. Reputation seems the obvious way to alleviate that concern.

[ghost]

I can only hypothesize for the general user base, but for me, the greatest friction/hesitation is fear of an unscrupulous trader. Reputation seems the obvious way to alleviate that concern.

For the general user base a neutral reputation system is needed. What metrics are available? Account age and number of trades. The latter is only partially implemented and could be used more instead of narrowing the user base with bonds.

[m52go]

For the general user base a neutral reputation system is needed.

I think a variety of mechanisms are needed. Deposits and account aging were the original ones, and they've worked reasonably well. Account signing is another one, and additional methods for getting accounts signed are in the works. Bonding is another. Perhaps there will be more. In this case, I think variety is good. Over time we'll learn what tends to work better.

Bonding strikes me as particularly elegant, as it completely avoids the mess of dealing with fiat banking that account signing has to handle, yet provides even stronger protections.

I happen to think an additional confidence mechanism like this would be positive for liquidity, especially if it's one active market makers would prefer.

This proposal benefit the BSQ rich users.

You can "buy in" to the network with time (account aging and single-account signing) or with identity (2FA account signing). This proposal would simply add a financial means to the mix. To my knowledge, BSQ is available to anyone who wants it, and this proposal wouldn't force anyone to use it, so I see this as a shallow criticism.

[chimp1984]

@Bisq2People

number of trades

That could be easily gamed by self-trades.

[ghost]

Bonds are heavy committments. With BSQ bonds it is equal to membership stakes = centralisation.

[m52go]

@Bisq2People how much of a bond is too heavy of a commitment? 10 000 BSQ? 500 BSQ? 50 BSQ? Is the "heaviness" of a commitment something you alone can determine, or does it vary from person to person? Is such a commitment still "heavy" if there are other options for the user, and they're not compelled to use it? How are bonds "equal to membership stakes" if anyone, contributor or not, can buy BSQ?

[ghost]

Now if one doesn't can or doesn't want to participate one is "null". And one is going to show it in a dispute to gain more trust. Honestly?!? Also please see the difference in buying a trade token and holding a bond or stake.

[m52go]

@Bisq2People you didn't even try to answer my questions. To me, your unwillingness to clarify your own statements indicates your feedback isn't serious.

Therefore, I am forced to disregard your posts as unproductive noise ✌️

[ghost]

It is your own questions. I don't have to answer them. You are talking to a customer now...

[chimp1984]

@Bisq2People From your style and behaviour it seems you are the same person who got banned recently. You are welcome to contribute to Bisq but please take feedback from people who work already long time on Bisq and have produced a lot of value serious. Most of those contributors disagree and even don't see any sense in your proposals and ideas. This leads to the situation that you occupy time/energy/space for those who do real work on Bisq. Try to formulate your ideas in a rational well articulated way so others can follow it. Have respect for things you might not fully understand. Most of us are not posting on the Bitcoin Core mailing list because we respect that this is a space for highly knowledgeable developers and most of us do not feel to be competent enough that we should participate there. That does not mean we are dumb, it is just a matter or respect.

If you do not change your attitude I fear we need to unfortunately ban you again. Github is our work area and pointless content feels like spam.

[ghost]

Me and others are providing feedback and just trying to help. I can leave and cancel my issues now myself instead.

[eigentsmis]

This is a very interesting proposal which I think would definitely put more people at ease regarding trades currently seen as high risk. On the other hand it could potentially introduce a new "attack" vector to be used by malicious users.
Overall I think it's at least a worthwhile experiment to get out there and see how the market reacts. I would also try to implement it as frictionless as possible to market liquidity (ie. would probably avoid hiding offers and adding other such "hard" filters, at least to begin with)...again, market will decide.

[MwithM]

This looks like a nice way to explore how Bisq v2 would work. There's one thing that worries me though.
Looks like this proposal is not considering trading volumes for each user: If I bond 1btc while I'm trading 20btc (in ten or more separate trades), the bond is not covering very much, while I guess that a bond of that quantity would guarantee me 5 stars in very little time. I suppose that this proposal does not intend to cover all possible costs, but if Bonded Reputation is just a signal of good will, it would generate a false sensation of security.

The icon should indicate the maximum score if the user performs a bonded role for the DAO, since they are trusted by the DAO as a contributor.

Usually, bonded roles have high stakes for many time. There are not many contributors with bonded roles. Signalling them in the app is a good measure for their privacy? Unless this bond is already something everybody can know matching Bisq client's information, this doesn't add very much value (they would already have 5 stars) while is compromising privacy.
Also, locked bonded role is supposed to cover the expense of mismanagement of their role. The contributor should lock another separate bond for trading. There could be a discount in the price of the Bonded Reputation.

For risky payment methods, such as F2F cash trades, we could require minimum Reputation Scores to create offers for certain countries.

F2F payouts are very difficult to judge because there's no way to provide reliable proof of payment, so DAO wouldn't have a way to decide what to vote. The only way bonded reputation would make sense for this payment method is if both traders agree to a mutual assured destruction protocol, meaning both of them should lose something if one of them wants, and that could be done just with trade deposits.

[chimp1984]

@wiz
I reviewed the proposal again and have some comments and at the end of the text some serious doubts (sorry loved the idea but fear it's problematic):

• The minimum locktime of 30 days seems to be too short as confiscation require at least one cycle but can take longer if some discussion/proof finding time is needed. As there is no formal process how to deal with a situation where someone makes a confiscation request i think we should be rather conservative and use at least the min. locktime for bonded roles which is 15.840 blocks (abount 3,5 months).

• We should lay out a suggested process what kind of proof is required for confiscation. For instance we could state that a proof for a chargeback from a mediator is enough. This proof from the mediator should be as stong as possible (done with PageSigner). We still need to keep it flexible as unknown reasons might lead to confiscation request and we need to trust on the DAO stakeholders subjective judgement ability.

• To simplify the score we could omit the locktime (using a sufficiently large locktime by default). Then we could simply show which % of the amount in offers is covered by the bond (e.g. 50% of 1.2 BTC in 3 offers are covered by a BSQ bond). Having less complexity increase UX and make interpretation easier. Instead of stars we could use then a simple scale of the lowest bond up to the highest and the users score is in that range with a rounded % number (like a progress bar). Buyers and sellers need to be treated differently as seller is at risk to bank chargeback.

• I would remove the bonded role feature. There are not that many such users and I think we should keep all as simple as possible. (agree also to @MwithM 's concerns in that regards)

Add an option to disable or hide offers from users who have a Bonded Reputation Score less than X.

• I would add that later once the feature is widely used as otherwise initially it would not make sense to filter away most of the offers and it could create a bit too much pressure on users to make such a bond. I think we have to be careful to not force users into that but keep it a completley optional feature which is left to the traders if it will become a valuable metric or not. It also has privacy implications which again we should not create pressure to users to use a less privacy protected way. (agree also to @MwithM 's concerns in that regards)

• Which identity key should be used for the pre-image for the hash which will be visible in the bond? It can be either the onion address or the signature pubKey which are both in the offer. Because both if those keys carry also some privacy problems and as there is work in progress to enable renewal of the onion address we should consider to create a new key for that feature. A custom bond key will give us the future flexibility to improve privay by generating new sigKeys and using different onion addresses for offers by allowing the user to selectively map offers by revealing the bond key. Privacy and identity are hard to combine and reputation requires identity so comes with weaker privacy. So there will be a trade-of for the user to weaken privacy for exchange of reputation and based on that a potentially better trade price and security. But as privacy is a strong core value in Bisq we have to take care to not create too much pressure that users need to use bonds as otherwise nobody takes their offers.

• We should differentiate between buy and sell offers as well as Fiat and Altcoin. Only the BTC buyer (Fiat) can do a bank chargeback which represents the biggest security risk. The other less critical risk is "forward trading" where a buyer decided to not complete the trade if price has moved against his favor. This is also relevant for Altcoins. But when it comes to a violation and a confiscation request for such a "future trade" it is very difficult or impossible to proof (traders can bring up some invented reasons like bug, bank problems,....). We should consider to use that feature maybe only for the chargeback risk case which delivers usually clearly a proof once the seller provides a PageSigned bank statement showing the chargeback (or any other trader who became victim of same scammer).
  If we limit it to Fiat BUY offers we should consider the context and relation to the account signing feature. E.g. enable to unlock the trade limit earlier if the Bond covers the offer amounts - but that has to be updated with each offer change so that the trader could not get his limit lifted and do then a "long con" scam.

• An interesting side effect will be that it creates incentive to remove offers if they are not likely to get taken. E.g. you have 3 offers with different prices. Now there is no incentive to remove the 2 offers with the less attractive price but with the bond you would have a lower score with 3 offers as if you set 2 offers inactive and only keep the offer with the best chances to get taken. Once its taken you enable the next offer. So this will remove network load for offers which have anyway low chances to get taken as other better priced offers are above them.

Potential showstoppers:

• As @MwithM pointed out there is some risks with that proposal. A trader could make an offer which is covered by the bond. Once taken he publishes the next offer, still covered by the bond but the information that one trade is pending is not visible. After he has enough pending trades that a scam is profitable he could do e.g. chargebacks for all pending trades and he risks to only lose the bond which covered only a portion of the trades. The information about the finalisation of pending trades is missing and creates that security risk.

This could be only mitigated if we would link the tradeStatistics into the mix, but that would decrease privacy. It could be done by adding the bond hash to the tradeStatistics extraMap and users could look up that data to see how many trades have been done in the recent past and which trade amounts. Then still there is no clear information when a trade has been completed.
In fact here we are challenged by the same basic problem for the "Off-chain Trade Protocol". How to track the bond with the pending trades in a secure but privacy protecting way? I fear there is no easy solution for that.

• There is another big issue: We only cover the maker but if the taker is the buyer the maker wants to be protected to only accept takers which are bonded. In fact the chargeback scammer back in April mostly was in the role of the taker (always the buyer obviously). Any ideas how to solve that problem?

If we cannot solve the last 2 points I fear the whole idea renders itself less useful and potentially harmful (giving wrong impression of security).

[mpolavieja]

We only cover the maker but if the taker is the buyer the maker wants to be protected to only accept takers which are bonded. In fact the chargeback scammer back in April mostly was in the role of the taker (always the buyer obviously). Any ideas how to solve that problem?

Is this point relevant if the previous point is solved? Apart from that, could it be possible to configure Bisq to only accept takers that have a Bond or Bond Score greater than X? (this could be also applied to signed accounts as described in #133).

How to track the bond with the pending trades in a secure but privacy protecting way?

I think that privacy concerns are important, but we should realize that once the API is running it will be very easy to track trades by onion addresses anyway and build personalized statistics.

Also, from my experience in financial markets, where order books are much more crowded (i.e. more anonymous than Bisq from the perspective of other traders) and also data is more opaque than the information available in Bisq, active traders are still identifiable by other professional traders by their behavior patterns. We all have behavior patterns that can be easily spottable for people that spend 10 hours a day looking at offer books for many years. However, it is very difficult to identify ocasional traders that trade just every once on a while, as their trades get diffuminated amongst a large number of trades from other market participants. Therefore privacy is mainly a problem for active traders.

Changing onion addresses frequently would not help much as the account signing process makes it difficult to change payment methods and only the account age data could be enough to identify a trader, or at least it would allow to narrow a lot its identification.

The very nature of fiat payment methods makes privacy very difficult, anyone could harvest personal information by trading / probing with many peers and then use the information available in Bisq to pull the thread to identify all his offers (i.e. country of SEPA Account, BIC, account age....)

In conclusion, IMO privacy in fiat pairs is not fully achievable even if you are a very occasional taker, and it is almost an oximoron for active makers. So maybe for active traders and market makers we should try to keep privacy as good as possible, but focus more on their reputation and security, as they are centralized points of liquidity within Bisq fiat pairs. It is not positive at all for Bisq that they easily get in trouble with their banks as they might get their fiat accounts easily closed just upon one or two incidents.

[chimp1984]

@mpolavieja The trade off between privacy and reputation is a difficult one. I think we need to give enough flexibility to the trader to choose what is more important to him. Pro traders might have less privacy requirement anyway as they need to run it as a business to not get into tax/legal troubles.

My main concern is still that the pending trades are not covered and this would lead to a false signal of security which can be easily abused by a scammer. I see that problem as a showstopper for that proposal as I think it would create more harm as it helps.

[mpolavieja]

My main concern is still that the pending trades are not covered

@chimp1984 But as I understand the solution to cover pending trades is not ready because we have not found a way to do it without compromising privacy, correct?

[wiz]

We could simply require takers to have a bonded reputation score before they can take an offer from a maker with a bonded reputation score, then everyone has skin in the game.

[chimp1984]

My main concern is still that the pending trades are not covered

@chimp1984 But as I understand the solution to cover pending trades is not ready because we have not found a way to do it without compromising privacy, correct?

Yes.

[chimp1984]

We could simply require takers to have a bonded reputation score before they can take an offer from a maker with a bonded reputation score, then everyone has skin in the game.

Only having a bond would not contain info for how many trades he uses it. a 1000 BSQ bond for a 0.01 BTC trade is a lot but for 10 times 0.1 BTC trades its nothing.

[mpolavieja]

Ok. So then privacy is the main issue. As I see it, we have already made an implicit decission towards reputation and sacrificing privacy in several aspects. For example, for account signing. Let´s say you have an account with an age of 1237 days, how many users have that same account age within Bisq?

What I mean is that maybe we should assume that setting up a bond necessarily implies a tradeoff in favour of reputation and detriment of privacy as older trades have to be considered for the bond.

I would add also, that if I put myself into the point of view of a thief I will tend to assume anyway that those with higher reputation, no matter which reputation system and how private it is, are more likely to have more money than those users with lower reputation.

[wiz]

Only having a bond would not contain info for how many trades he uses it. a 1000 BSQ bond for a 0.01 BTC trade is a lot but for 10 times 0.1 BTC trades its nothing.

Why does that matter? This isn't a security feature, it's more of an indication that the person is not a newbie and is serious about trading on Bisq. The usual security features of each trade, as well as the dispute resolution methods, are not affected by this proposal.

[mpolavieja]

The usual security features of each trade, as well as the dispute resolution methods, are not affected by this proposal.

I think that what @wiz is saying here is more than fair. If trading limits are not lifted early because of having a high Bond score, this proposal has no problem at all.

The discussion has evolved outside of the scope of this proposal into the "off-chain trade protocol". I still think that the discussion is necessary but maybe this is not the place because implementing this as @wiz has suggested does not give any false sense of security, it is useful on itself, and it could provide very valuable feedback for the off-chain trade protocol.

[wiz]

To be clear, this proposal literally does nothing except display some stars next to offers if the maker has a bond posted. That's all, purely informational in nature and no security of any trade is affected.

[chimp1984]

Ok. So then privacy is the main issue.

No, the main issue is that it gives a wrong signal and is potentially harmful.

What is the goal of the bond? To indicate that you can trust the other trader to not be a scammer, right?
Which kind of scams we want to prevent by that feature?

• Bank chargeback: Yes.
• Future trade: No, because we cannot get a clear evidence of wrong doing and that would avoid a bond confiscation.
• Other contract breaches: No. Same as above. Without clear evidence of intentional wrong doing the DAO stakeholders should not use the confiscation feature.

For bank chargeback I think the only real threat is the "stolen bank account" scam as we had in April. "Friendly chargeback" (calling bank to make a chargback) happens super rarely and the banking system prevents enough that this will not become a systemic problem (you cannot repeat that scam otherwise your bank will make you problems, in most countries/banks you require some evidence like a police report for a severe reason).

For the "stolen bank account" threat we have the account signing in place. What would be nice is to have additional ways to get lifted one's limit faster/easier. Does that proposal be able to be a candidate for that?
Maybe if the bond is pretty high (e.g. 5000 BSQ). The bond hast to be connected to the account (using account age witness - not onion or pubKey, as that would allow to reuse the bond for several accounts). The scammer does not know in advance how much he will be able to cash out from the stolen account. Investing 5000 USD to maybe only be able to cash out 3000 USD is a risky bet for him. But with smaller amounts (1000 BSQ) I think we would render the account signing insecure. So if we want to use it for that we have to be careful. BSQ volatility needs to be taken in account as well. If we want to use if for that I think it still require deeper analysis, but on a first sight I don't see big showstoppers.

Is that proposal good to protect sellers (as maker) from malicious buyers (as taker)?
No. The scammer could set up a bond and repeat some scams (e.g. the scammer in April made about 12 000 USD - we cannot require that high bonds).

Is that proposal good to protect sellers (as taker) from malicious buyers (as maker)?
No. The maker could setup a bond just covering one offer and once that is taken he makes the next offer. If offers are quickly taken he could easily get a multitude of pending trades and only risk to lose the bond covering one trade.

I think as it shows that even we need to discuss that so much to make it clear (and only one reviewer - @MwithM - has seen the problem), it shows that this is dangerous to mislead traders in wrong assumptions of security. People would also misinterpret it to help in cases of "lazy" traders who could get punished by that - but that is impossoble as without clear evidence we cannot confiscate. But more importantly the scammer might have it easier to get traders as users would trust that bond, which is not covering at all parallel trades.

[chimp1984]

To be clear, this proposal literally does nothing except display some stars next to offers if the maker has a bond posted. That's all, purely informational in nature and no security of any trade is affected.

People will interpret that information. And they will mis-interpret it as security feature and that will help a scammer.
If the information has zero value for security then there also no benefit and the privacy implication does not justify it in the first place.

[wiz]

@chimp1984 What are you talking about? If you post a big long-term bond, you get a star next to your offer, that's the entire proposal. This proposal doesn't introduce any new security or privacy implications on trading on Bisq. It literally changes nothing.

[chimp1984]

Just to make clear I NACK that proposal for above reasons. There still might be the valid use case for account age signing limit lift, but that requires more analysis.

Additional to the above reasons there are more downsides which would require clear benefit to justify a trade-off.

• It lowers anonymity set if it pushes traders to trade only between bonded users. Traders who want more privacy would get partitioned.
• We should not emphasis on marketmakers as those could impose a censorship resistence and privacy risk. Professional traders with high volumes will be treated as a business and then like centralized exchanges, so they might become subject to regulation and KYC requirements. Bisq must not follow strategies to become dependent on market makers and must not make compromises for increasing the importance of those. That said they are seen helpful for liquidity and welcome but we must not sacrifice anything to make their role in Bisq stronger.
• There are informal security mechanisms like that if an offer has a very good price that you should be suspicious (as it happens with the April scammer, he made many "too good to be true" offers). If we add "wrong signals" for security we might lower those "common sense" security mechanisms as traders would think, ah its a 5 start offer, nothing can go wrong.
• People do not read information and often do not understand much of Bisq. The risk that any display (star, or whatever) would be interpreted by users as kind of "rating" from Bisq is real. We have to avoid that. Also to explain it correctly it is a UX challenge and adds more complexity.

[mpolavieja]

People do not read information and often do not understand much of Bisq. The risk that any display (star, or whatever) would be interpreted by users as kind of "rating" from Bisq is real. We have to avoid that. Also to explain it correctly it is a UX challenge and adds more complexity.

I understand now @chimp1984 and @MwithM concerns about this proposal. Given that pending trades are not going to be tracked against the bond so the rating does not objectively provide more security, it can be counterproductive as users will interpret it as secure. Most users will just look at the stars without really knowing what is behind.

Setting up a bond shows commitment, yes, but not necessarily commitment towards being honest. A scammer can use it to buy reputation if it is profitable for him.

[wiz]

Bisq already has a reputation score system now and we use it all the time. Every time I trade with these people, my "score" for them gets incremented. My proposal is that if they have a bond posted, or if they are a regular contributor to Bisq, and they have opted-into advertising this fact, it would add a ★ badge on their avatar like the number is now. That is all I am proposing. There is no security or privacy risk. If you don't want to use it, then don't use this feature.

[wiz]

Additionally, we could implement this an advanced feature that's not enabled by default. In the settings, if you enable this feature, a popup would explain to the user that this is not a security feature, to prevent any mis-interpretation of what the ★ means, and @chimp1984 can decide the text for the popup message.

[sqrrm]

I have followed the discussion and I think there is some merit to the proposal. The drawbacks seem to balance that out in favor of not going down this route though. I think the money would be better spent elsewhere. The main arguments against for me are:

• The risk of split of liquidity would be bad. Worse might be the push to force the users to put up a bond in such a case, which has privacy implications. Privacy is hard but I think it's one of the core tenets of Bisq so it's not worth compromising.
• Users don't read documentation. If there is a star rating (or any similar indication) it will be treated as a guarantee by many users. This would reduce the effectiveness of our other safety mechanisms, including basic human instinct to be careful in this kind of environment.

[wiz]

Well, after lots of discussion it seems there are a lot of good arguments both for and against the proposal. The DAO stakeholders can vote on this proposal in Cycle 9.

[mpolavieja]

Rejected on DAO voting - Cycle 9

[flix1]

I had not seen this proposal before. It definitely has a lot of merit and I hope that after more discussion some version of it is brought forward again... I see a lot of potential for BSQ bonds to be used this way. Congrats @wiz I had no idea this was possible.

I also like the "decentralized reputation" that repeated trades with the same counterparty creates. I personally use it to great effect. There should be some way to leverage that...

[stopfeds]

Apparently, there are quiet a few Traders bonding for a reputation bond. Is there a specific reason why they do this? I mean, the bonded reputation in the DAO doesn't have a benefit (yet), right?

[pazza83]

I think a few have done it for the buy-bitcoin and buy-bsq channels on Keybase as these are small OTC transactions that take place with no security deposits.