Proposal to increase trade deposit to 30% #233
Comments
|
Thanks for proposing this. A few thoughts:
Regardless of all of the above, isn't having an efficient arbitration process that traders can use a necessary requirement for any decentralized P2P trading network? What if the the actual problem isn't that the security deposits are too low, but that the arbitration system itself should be improved so that 1 case per day is not "excessive" ? |
|
The trade protocol we have is built to have a very low number of arbitration cases. For now we're surviving by the fact that we have an arbitrator that handles these cases. There is a rather high probability that the arbitrator will leave. Once there is no arbitrator each user would have to go to the DAO to ask for reimbursement for each case that goes to arbitration as the DAO is the ultimate arbitrator. That leads to users not getting their funds back for a month or two, a pretty bad situation for both users and DAO contributors alike. The jump from 15% to 30% is meant to be a significant increase. If the extra incentive doesn't help we can lower it. I think we should have notifications, that would be great. I think the api can help with that, but that's not ready for production. |
|
Before taking this decision, we need to have a deeper understanding about why trades get into arbitration: Are sellers or buyers causing more arbitration cases? Low amounts have more cases? What about fiat vs altcoins? Before increasing the security deposit, we should enforce sellers to follow the protocol. Now they can get through a protocol violation without any penalty. #224 (comment) I'm only willing to use a higher deposit than the default for face to face transactions. I don't see why Bisq should impose something that I, and advanced user, don't feel necessary. |
|
Virtually all cases that go to the Refund Agent are because one of the traders abandons the trade. The number of abandoned trades is higher when the market is volatile and most of the cases can be suspected to be future trades. That is, the price moved against the buyer who simply leaves. There are also cases where the seller don't release the btc, probably because he/she does not care enough about the security deposit. Increasing the security deposit will give both buyer and seller more skin in the game, they will do much more to overcome any difficulty in paying, they will have incentives to speed up the trade and they will be less inclined to "forget" the trade. They will be more secure that the other trader will honour the contract and do so quickly. If a 30% security deposit is a suitable amount is unclear but it should be tried to see how traders react. Better would be a security deposit which reflects the price of the option that an offer in reality is. I. e. the past volatility could be used to estimate the correct price of the option. The DAO must realise that an offer is an option and trying to force traders to fulfill their obligations using other means (reputation, blacklisting by "trusted" team members, ...) will be a very cludgy method indeed, probably with plenty of not intended consequences. As it is now the Refund Agent follows the mediators suggestion since in essentially all cases one trader does not respond. Even if both traders do respond there is never anything to change. There are no known cases where the mediators have made any mistake. Bisq should not need any mediation at all. Bisq is a platform where traders meet and make their trade, secured by the security deposit. Mediation and refunding should only be used in those rare cases where there is a bug in Bisq. As it is now I doubt that the DAO will find anyone to replace the Refund Agent. The Refund Agent is a single point of failure which goes against the philosophy of Bisq. |
|
I agree that the security deposit is the most important feature securing trades and we should do much more with it. HOWEVER it is also the biggest barrier to entry in Bisq and I'm certain it is what turns away most newbies. Consider the learning curve! I would really NOT make a high security deposit a default, forced feature. It should be as voluntary and customizable as possible. One thing that we could do is make the % of the security deposit much more visible in the order book and and warn accordingly. Also allow users to filter by security deposit %. Between the Payment method and Time since signing columns there should be a Security Deposit column. If it's an important feature, let's make it prominently visible for everyone! The philosophy is to give users tools, not to force them onto a path.
|
|
Well of course having a TTP / CPOF for Arbitration goes against the spirit of Bisq, nobody is going to disagree with this statement, and I agree it’s an obvious security hole. But this proposal doesn’t acknowledge or address the real issue. The elephant in the room that nobody wants to talk about, is that when the Bisq v1.2 trade protocol update removed the 2 of 3 multisig Arbitration system to eliminate the TTP, it neglected to provide a replacement Arbitration system, despite the need for Arbitration remaining present in the trade protocol. So now Bisq is in the awkward situation where Bisq traders still need an Arbitration system and due to the lack of one they are not happy. This is very obvious in hindsight and I deal with it every day as a Mediator. I understand that our Growth team has hard data showing the XMR trading volume declined sharply immediately after the v1.2 update. This proposal to raise the security deposits only serves to lockup more trading capital, introducing more friction and makes users less happy, driving them away further. It didn’t work last time and it won’t work this time. We will only lose more and more users and trading volume. Instead of another band-aid, can we please address the real issue here and discuss how to best implement a properly decentralized and secure Arbitration system to give the users what they really want? Until the need for Arbitration is completely removed, which seems nearly impossible to do, Bisq still needs an Arbitration system. If you raise security deposits higher and higher you are only removing the need for Arbitration because no users will be trading on Bisq anymore. In the past I have proposed implementing a new Arbitration system by utilizing multiple different pre-signed timelocked payout transactions that are encrypted to mediators or arbitrators, so they can decrypt and publish the one they feel is best. While my idea is still raw and needs additional discussion to resolve the remaining issues, I feel it has merit and would address the core issue Bisq is now facing. So with all due respect I feel I need to NACK this proposal and I again ask the dev team to try harder to address the core issue here - please come up with a proposal for the new decentralized Arbitration system that was painfully missing from the v1.2 update last year. |
@wiz Arbitration has a cost. Any trade that reaches arbitration/refund agent should be heavily penalized. Not just the guilty party, both parties should suffer some cost. That is the only way to make sure that people make an effort in avoiding it. I don't see how arbitration will ever scale 'though, unless it is 1/1000 trades. I don't see Bisq having millions of users and hundreds of arbitrators.
@sqrrm if we are having these problems keeping 1 arbitrator. Can you imagine what it would be like with dozens? hundreds? |
|
Please don't confuse the removal of the need for an Arbitration system with the removal the Arbitration system, like the v1.2 update did. If you remove the system before you remove the need for the system, you just piss off the users. And even when you get the need for Arbitration down to 1 case for every 1000 trades, you still need an Arbitration system, so you can never remove the Arbitration system. |
No? You could conceivably have a 2-of-2 multisig Bisq with no arbitration. Fill or kill. Either the trade is completed or the funds are timelocked for 100 days and return to original addresses. Consider the possibility. With a high (voluntary!) security deposit it could work well. It would be scalable and require no human interaction whatsoever. |
Okay, I'll sell you Bitcoin, wire the money to my bank account 1234567. Then after I get your bank wire I just wait 100 days and I get my Bitcoin back. Since there is no Arbitration you have no way to prevent this. |
You are right. Then Mutually Assured Destruction: Either trade is completed or funds are locked up forever until it is. |
Okay, now that I got your bank wire. I'll only sign my key for the 2 of 2 multisig for a payout TX that pays 50% to me and 50% to you, this is also known as a ransom attack. Since you'd rather get 50% than 0% you would have no choice to accept it. |
|
@wiz you are making a very good case for arbitrators. Why not have them be a voluntary feature with a fee? If they provide so much value compared to a no-arbitration system... most users will happily click on the "pick arbitrator" option. Or even have the arbitration system be independent from Bisq. Users can still sign transactions affecting the funds locked in multisig after the fact... |
|
The problem with using a 2 of 3 system for Arbitration is that the Arbitrators can steal all Bisq trade capital because they can just take all offers and then they have 2 of 3 keys. My proposal to keep the 2 of 2 model but have both parties create pre-signed timelocked payout TX for various scenarios, and encrypt these payout TXs to a group of trusted people who would all have to collude together to steal the funds, is also vulnerable to this attack, but using SSSS it would require several people to collude together which distributes the risk enough to make it much harder to do the attack. The risk can never be eliminated, so the only thing we can do is spread out the risk to more people and slow things down with timelocks. |
You have convinced me that this is the best solution.
This is the part I have a problem with. If we could remove the trusted people from the equation and have some rule-based mechanism or automatic system doing this part... |
|
No, you can never remove trusted people from the equation, especially for fiat trades. You can only spread the trust around to more people, and slow down their action with timelocks. When one party says they sent the funds and one party says they didn't receive the funds, someone needs to examine the evidence and make a judgement call about who they think is the fraudster. There is no way to automate this. |
|
Then those trusted third parties have to be:
...and if Bisq is to scale to millions of users there will have to be 100s of them. |
|
I feel we're getting a bit off topic, the core issue that should be discussed in this proposal is that the v1.2 trade protocol has many obvious flaws, and this proposal attempts to band-aid over them. Here's another example of a major flaw in v1.2 trade protocol: bisq-network/bisq#4162 This proposal would put a very heavy burden directly onto users as an attempt to solve the shortcomings of the v1.2 trade protocol, which will not work and only drive users away. We need to talk about the v1.2 trade protocol flaws and how to fix them. |
|
Sorry if it's off-topic, but for me the Trusted Third Parties discussion is the most important one for Bisq. If there is no way of trading without them it... well it removes one of the biggest reasons for Bisq. The moment you have TTPs you are open to censorship since it would be easy to shut down Bisq by going after 10s or even 100s of arbitrators. If you are going to have to trust the platform you might as well go to localbitcoins or hodlhodl or another P2P market that is not a DEX. Atomic swaps or similar would remove this problem for any Bitcoin-based altcoin (including BSQ). An open source automated check on payment could work for other altcoins (eg: Monero) while still removing the need for TTP. If it's on a blockchain there should be a way to verify payment programatically. Fiat payments will always be the hardest problem to solve, hence the most important. There has to be a way... Of course the moment you get fiat on a blockchain (govt- or bank- backed stablecoins) you can use to atomic swaps... |
There once was a project called Coinffeine that used payment channels to "stream" funds by doing consecutive micropayments while reusing a small security deposit in Bitcoin that was 100% of each micropayment. So that each micro-trade was fully backed but still you could never lose more than a small amount if something went wrong. It required an instant-payment API-enabled payment processor. It worked, although the project never took off. But now that Lightning Network has advanced a lot, there might be a way to combine it with a Revolut, CashApp, Venmo style app to do something similar.. |
The key word in your statement is "should" - you describe a beautiful vision of what Bisq can aspire to become someday. If Bisq actually achieves a near-zero rate of Arbitration cases, then we could discuss removing the Arbitration system, and doing so wouldn't upset users and trading volume wouldn't drop. However, it's precisely because Bisq removed the Arbitration before removing the need for Arbitration that Bisq users are unhappy and trading volume has dropped. So while everyone will likely agree that Bisq "should not need" mediation or arbitration, it still does.
Again, that would "should" appearing. Again, this is a great goal. But in reality, every day we see Bisq users make mistakes, users forget about trades, users aren't properly notified on trade events, we still have the occasional scam or fraud attempt, etc. etc. - so until Bisq is absolutely perfect Bisq will still need support agents, mediators, arbitrators, etc. for the community, and if Bisq does not provide that users will go elsewhere. Increasing security deposits only drives users away. |
|
@wiz what do you think about making arbitration optional (and charge a fee for it)? If it is that important then most users would choose it... and those that don't would know the risk they face without it. Also it would allow us to gauge demand for it, play around with the fees and eventually make it self-sustaining since it would be easy to recruit more arbitrators knowing how much they get paid. It would put a clear value on it. In fact the arbitrator should decide how much to charge. Since you only need to provide the pre-signed txs to the arbitrator... there's no need to change the 2-of-2 multisig protocol. It would not require any changes to Bisq protocol. It could even happen outside Bisq. Being an external service it would not pose a censorship threat. |
Do these ever happen with faster payment methods ( <24h trade time)? |
isn't that why we have notary trust accounts (please forgive if I got the translation wrong) in the real world? could we do something like this? just food for thought, though... |
|
It seems the discussion here has veered off topic. The question is if we should increase the trade deposit to 30%. If we don't it seems the refund agent will leave and a much worse user experience when trades go to the arbitrator-less arbitration. This is not a proposal to ignore the issues with the trade protocol, it's a proposal to keep us going while we find better solutions. |
Not without making sellers accountable first, and not without running some numbers to evaluate the impact. What % of total trades are going to arbitration? Maybe the trades going to arbitration aren't reduced just because there are more daily trades at Bisq, but the overall % is decreasing as the platform improves and people learns. If it's about giving refund agents incentives to stay, I'd rather just raise the min security deposits to 20% and charge 2-5% (or a fixed fiat rate, like 10-50 USD) as arbitration costs. Those who follow the trading protocol should not suffer the costs of those who don't. |
|
Regarding only the topic of this proposal: It's not the first time that a security measure is put in place for everything, even payment methods or currencies that have never had an issue. If instant payment methods never have a problem with "future trades" then any increase in the security deposit should not affect them. I would like to recall a concept we used to have in the past and has now been almost forgotten: the demo experience. For small trades (0.01 BTC) or trades in markets with zero activity we should have fewer hurdles and as little friction as possible. I even recall the discussion on having 0% security deposit for small JPY/BTC trades when trying to kickstart that market. What is the point of having a 15% security deposit for ARS/BTC when there hasn't been a trade in that market in 9 months? Why would you need a 30% compulsary security deposit for GBP/BTC via UK Faster Payments if there has never been fraud in that market? If there is one area in which Bisq is still awful compared to anything we might consider competition it's the onboarding experience and first trades ever for a new user. Please let us have some broken down data so that we only increase security where needed. |
|
Bisq is a DEX because it cannot require KYC- NOT because it lacks trusted third parties. The developers are trusted third parties. Everyone that holds a bond is a trusted third party. Fiat trading must include a trusted third party. I don't know if that's in the form of a refund agent, arbitrator, bozo the clown... or whatever. But you MUST provide a trusted third party to fiat traders or this project is doomed. And really the opportunity to make MONEY in this market is going to be enormous. We want BSQ to INCREASE in value. Think like a business- Not a crypto nerd. Don't think of them as arbitrators- think of them as developers with arbitration roles. |
|
Why does the security deposit have to be set?! There should be a market for it. Maybe keep the minimum, but really - I would have NO problem doing a 100% security deposit. Having made that as an offer to BUY BTC, the BTC seller would be more likely to take my trade, knowing they're secure in the trade being done? As opposed to someone with 15% security deposit. |
|
I belive this to be a no brainer. If I could use more than 50% i would.... at least for my country. If im offering a 50% security deposit, the other trader would feel safer too. |
16/28 (57%) are "unresponsive". This could easily be heavily penalized by awarding both security deposits to the responsive party. This could even be automatic, requiring little work from arbitrator/mediator/refund agent. It would automatically: It also combines well with higher (voluntary) security deposits. It can be done with pre-signed txs so no need to change trade protocol or 2-of-2 multisig. AND it does not require funds to flow through the donation address. So no centralized honeypot to hack, refunds to make or decisions for the DAO. |
Thanks for the overview. Is that distribution similar to the past months? I am surprised that there are so many seller not confirm cases. Could you post the data in more details to see amounts associated with issue (trade amount | cause for dispute)? Those cases could be resolved by higher deposits:
So we have 28% future trades, 17% likely future trades, 28% careless sellers (need more info to confirm assumption) and 10% likely careless sellers (need more info to confirm assumption). If the above assumptions are right 83% could be avoided by a higher deposit. I think it would be good to get a longer time period and more details from the data to be sure our analysis is correct before taking action, but so far the data confirmed our assumption that most cases could be avoided if deposit would be significantly higher. |
I dont understand how that could work from a technical and security point of view. If you refer to the closed proposal with SSSS, that got considered as unsafe and was closed after I posted my concerns. In short: pre-signed payout txs cannot be held by traders as that would incentivise them to try to execute the best outcome for themselves. If it is sent to a 3rd party we have a TTP problem and are back to old arbitration system but just with a more complicated implementation. |
The main problem with reputation is privacy. Reputation requires identity and that does not work well with privacy. So if you link offers to a bond, one could see all trades/offers of that trader. Once the trader get de-anonymised, all his trade history is public. |
"relatively easy" is actually a "pretty hard problem". See previous comment about identity and privacy. To get both is a hard problem. Sure we have account signing and that is a better form of identity than other forms but connecting that to offers/trades and preserve privacy is a challenge. |
Yes I agree that would be a good option, and refunding a part of the deposit is important to give incentive to use the feature (as well mediators cannot do a payout suggestion with 0 BTC for one side to incentivise them to accept the suggestion). The current refund might be too small though (or overall deposit too small). @RefundAgent |
Well sure, but obviously posting a bond is an optional thing, so if you care about privacy then just don't link your trades to a bond. But let's be honest, you can already do blockchain analysis to link multiple trades together unless you coinjoin before and after every single trade. So it's not like Bisq has perfect privacy right now anyway. I would be happy to link my trades together, and I would expect others would prefer to trade with me if I had a bonded reputation score, because they know I'm less likely to default on the trade and more likely to complete the trade quickly and without issues. |
You're right, the idea is still very early and not fully developed into something that can be implemented yet, but I feel it has potential. Maybe if we brainstorm on it together we can figure out the missing pieces. |
I meant that Payment Account reputation is easier than User reputation... But yeah, it still brings a lot of privacy concerns. Agreed. |
Sure, I meant that given that we do still have arbitrators, giving them signed txs, like we already do to send funds to the donation address, could open the door to more automated resolution and thus reduce workload for existing arbitrators which was the problem that this proposal brought up. If the options are very clearly defined and based on objective parameters (eg: buyer/seller does not respond) it would allow the arbitrator to just click on a box and spend only a few seconds to resolve (once time runs out). What's more this "multiple choice" conflict resolution would eventually open the door to automated arbitration once the API is up and running. If the Trusted Third Party is an open source algorithm that would be very easy to scale. Thinking particularly of XMR/BTC trades I don't see why we cannot fully automate it: A
B
C
D
But from what @RefundAgent has said... it seems that case D is a very small minority of disputes. 8 buyer unresponsive or quit --> A @wiz I'm counting on you to poke wholes in this logic ;-) |
|
A more detailed breakdown of the latest disputes: b payment problem did not pay 0.08 usd z The numbers are the trade value in btc, including the security deposits. In most cases (in particular with non-responding traders) the RA has no further information, and relies on the mediators suggestion. b means buyer and s means seller. The last entry is the payment method, s = sepa, z = zelle, nbt = national bank transfer There are two problems. The first is too many mediation cases which will to some extent be solved with a "cancel trade" button. This will not solve the mispriced option problem. Sellers will leave Bisq when they discover that trades that will be concluded only if the price moves against them or does not move much. This problem can be alleviated either by having a correctly set security deposit or policing. Note that the price of options is high when the volatility is high and this is a real cost of volatility. The cost of a security deposit in Bisq is not very high since it corresponds to the lost interest during the trading time. A well-set security deposit will not only decrease the trading time, it will also incentivise the traders to publish offers which are close to the market price. |
|
Thinking some more about this... the closer we can get human dispute resolution to how a true oracle would work... the easier it will be in the future to remove TTPs completely.
I have to disagree with you @clearwater-trust. Unfortunately experience has taught me that any central point of failure will be attacked by regulators and they will impose KYC or censor the market. I have seen it a million times. But let me just point you to one example: Shapeshift. They had the best legal advice on how to not be custodians so that they would not have to do KYC. Erik Voorhees was adamant that they would never do KYC. He left NY after the Bitlicense was approved. They built it all the right way: no custody, no touching user funds, no accumulating user data, etc... They were so proud of their NoAccountNeeded hashtag! The minute that their volume grew large enough they were called up and given a choice: submit or close. When you have employees, a company, investors... it's a very tough choice. Now they have KYC. I am glad that the founders of Bisq have followed Satoshi's example and left. Otherwise they could be pressured. It would be so easy for regulators to doxx a few dozen Bisq arbitrators to shut Bisq down or destroy trust in the market. They will be a target the minute that volumes grow to be significant. |
|
@RefundAgent thank you very much for the additional detail. This is very useful. Any chance that you would have info on payment methods? It would help test my theory that faster payment methods have fewer "future trades" problems. BTW less than 30 disputed trades out of more than 3000 completed trades in the period is absolutely amazing! |
|
@flix1 Bisq is not a corporation. Do not be afraid of the DAO. Let it be our guide in these matters. Your blind faith in the machine world of code, as if it can someday replace people of good standing (and massive bonds), is disturbing. You cannot code "the oracle". A human arbitrator is just like a developer- with the arbitrator role. @RefundAgent What are you doing with the security deposits? |
|
@clearwater-trust Ignoring your ad-hominems and dismissive tone and moving past it to focus on the arguments... 10 years of experience in Bitcoin shows that every single exchange, be it centralized or P2P, has been pressured to become regulated or forced to close the moment that their volume became sufficient to merit attention. Being a DAO affords some protection, but it is not a complete safeguard. The day a terrorist is caught using Bisq there will be headlines and there will be massive regulator scrutiny. As Bisq grows to 100.000s of users the probability of a bad actor being among them approaches 1. 100s of years of contract law shows what even with recourse to human judges and arbitration, the simpler and clearer a contract is, the easier it is to enforce and the less need for dispute resolution. Since the problem here as referenced by @sqrrm at the top is too many disputes... I think that simplifying and clarifying the Bisq contract is a good direction to go regardless of whether an ultimate goal of full disintermediation can be reached. If it could be reached (I'm definitely not certain that it can and have no blind faith in perfect code) it would be very superior to a system with TTP. Even if it can only be partially reached (say 99% of cases are automatic and only 1% of disputes require TTP intervention) it would still be a major breakthrough. In fact Bisq already achieves over 95% P2P trades without requiring mediation or arbitration. 1 arbitration case a day is a huge success. If we can get it down to 0.1% we would have gained a lot. |
Corporate Law is Over! They are all going to hell where they belong! Don't get stuck in the past. We have real accountability on our side! Use the DAO! |
|
Introducing a "cancel trade" button makes the offers into options also for the seller and the security deposits should be symmetric. It will make the offers more similar to American options (with a user-chosen expiration date) than European options (with a fixed strike date). I assume here that both traders can choose to cancel the trade. @flix1 Payment methods are now in the data. |
|
@RefundAgent with the PR Deposit improvements that introduces symmetric deposits and Add feature to cancel a trade being worked on I think that's what we'll have. |
|
I like the ideas on the Deposits pull request because it still leaves the option to use the 15% security deposit and only suggests a security deposit based on current volatility. But still, sellers stop answering and they can omit mediator's suggestion: that's as critical as the security deposit, maybe even more. Symmetric deposits won't help buyers if sellers are not accountable when they don't follow the trading protocol. To fix this, a software lock seems good ennough Furthermore, I'd like to study a few changes for arbitration:
We should keep discussing at #proposals channel the pros and cons of this changes, and what numbers should be used. I'll make the proposals after considering your points. |
If we allow that we must make very clear that buyer only can accept cancelation if he has not started payment yet. If users read instructions that should be not an issue, but we know they often don't read and it might be just a new source of problems. It also would increase number of "option trades" which should be not the preferred operation mode in Bisq. It might be frustrating for users who just want to get in or out of BTC to be the "victim" of speculative traders and might decrease user experience for such traders. I think we should only use the cancel button for the buyer as we cannot avoid option trades in that case. |
ghost
mentioned this issue
MwithM
added
a:proposal
|
Closed as approved (with several changes from the original proposal): bisq-network/bisq#4347 |
Due to the amount of cases reaching the arbitrator (about 1 per day) I have made a PR to increase the deposit to 30% to incentivize following the trade protocol, as can be seen in bisq-network/bisq#4330
I realize that this is a crude tool that's not helping usability. That has to be weighed against the cost of too many non bug trades not getting resolved before going to arbitration.
The text was updated successfully, but these errors were encountered: