From 48d27016365690c3270ccdfe9db7719da82ae310 Mon Sep 17 00:00:00 2001 From: whatisRT Date: Mon, 20 Nov 2023 15:17:57 +0800 Subject: [PATCH 1/4] Guard security-relevant protocol parameter changes behind SPO votes --- CIP-1694/README.md | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/CIP-1694/README.md b/CIP-1694/README.md index 4364b4c1e..cc54ac45b 100644 --- a/CIP-1694/README.md +++ b/CIP-1694/README.md @@ -1246,7 +1246,7 @@ that has been granted to the current constitutional committee. Governance actions are **ratified** through on-chain voting actions. Different kinds of governance actions have different ratification requirements but always involve **two of the three** governance bodies, -with the exception of a hard-fork initiation, which requires ratification by all governance bodies. +with the exception of a hard-fork initiation and security-relevant protocol parameters, which requires ratification by all governance bodies. Depending on the type of governance action, an action will thus be ratified when a combination of the following occurs: * the constitutional committee approves of the action (the number of members who vote `Yes` meets the threshold of the constitutional committee) @@ -1292,6 +1292,7 @@ The following table details the ratification requirements for each governance ac | 5b. Protocol parameter changes, economic group | ✓ | $P_{5b}$ | \- | | 5c. Protocol parameter changes, technical group | ✓ | $P_{5c}$ | \- | | 5d. Protocol parameter changes, governance group | ✓ | $P_{5d}$ | \- | +| 5e. Protocol parameter changes, security group | \- | \- | $Q_{5e}$ | | 6. Treasury withdrawal | ✓ | $P_6$ | \- | | 7. Info | ✓ | $100$ | $100$ | @@ -1399,6 +1400,11 @@ the maximum threshold of all the groups involved will apply to any given such go The _network_, _economic_ and _technical_ parameter groups collect existing protocol parameters that were introduced during the Shelley, Alonzo and Babbage eras. In addition, we introduce a new _governance_ group that is specific to the new governance parameters that will be introduced by CIP-1694. +There will also be a special _security_ group. Any protocol parameter +is assigned to exactly one regular group, but all protocol parameters +that interact with the security guarantees of the system belong to the +security group as well. + The **network group** consists of: * maximum block body size (`maxBBSize`) * maximum transaction size (`maxTxSize`) @@ -1435,6 +1441,17 @@ The **governance group** consists of all the new protocol parameters that are in * minimal constitutional committee size (`ccMinSize`) * maximum term length (in epochs) for the constitutional committee members (`ccMaxTermLength`) +The **security group** consists of: +* `maxBBSize` +* `maxTxSize` +* `maxBHSize` +* `maxValSize` +* `maxBlockExUnits` +* `minFeeA` +* `minFeeB` +* `coinsPerUTxOByte` +* `govActionDeposit` + ### Delegated representatives (DReps) @@ -1292,15 +1295,31 @@ The following table details the ratification requirements for each governance ac | 5b. Protocol parameter changes, economic group | ✓ | $P_{5b}$ | \- | | 5c. Protocol parameter changes, technical group | ✓ | $P_{5c}$ | \- | | 5d. Protocol parameter changes, governance group | ✓ | $P_{5d}$ | \- | -| 5e. Protocol parameter changes, security group | \- | \- | $Q_{5e}$ | | 6. Treasury withdrawal | ✓ | $P_6$ | \- | | 7. Info | ✓ | $100$ | $100$ | -Each of these thresholds is a governance parameter. +Each of these thresholds is a governance parameter. There is one +additional threshold, `Q5`, related to security relevant protocol +parameters, which is explained below. The initial thresholds should be chosen by the Cardano community as a whole. The two thresholds for the Info action are set to 100% since setting it any lower would result in not being able to poll above the threshold. +Some parameters are relevant to security properties of the system. Any +proposal attempting to change such a parameter requires an additional +vote of the SPOs, with the threshold `Q5`. + +The security relevant protocol parameters are: +* `maxBBSize` +* `maxTxSize` +* `maxBHSize` +* `maxValSize` +* `maxBlockExUnits` +* `minFeeA` +* `minFeeB` +* `coinsPerUTxOByte` +* `govActionDeposit` + > **Note** > It may make sense for some or all thresholds to be adaptive with respect to the Lovelace that is actively registered to vote. > For example, a threshold could vary between 51% for a high level of registration and 75% for a low level registration. @@ -1400,11 +1419,6 @@ the maximum threshold of all the groups involved will apply to any given such go The _network_, _economic_ and _technical_ parameter groups collect existing protocol parameters that were introduced during the Shelley, Alonzo and Babbage eras. In addition, we introduce a new _governance_ group that is specific to the new governance parameters that will be introduced by CIP-1694. -There will also be a special _security_ group. Any protocol parameter -is assigned to exactly one regular group, but all protocol parameters -that interact with the security guarantees of the system belong to the -security group as well. - The **network group** consists of: * maximum block body size (`maxBBSize`) * maximum transaction size (`maxTxSize`) @@ -1441,17 +1455,6 @@ The **governance group** consists of all the new protocol parameters that are in * minimal constitutional committee size (`ccMinSize`) * maximum term length (in epochs) for the constitutional committee members (`ccMaxTermLength`) -The **security group** consists of: -* `maxBBSize` -* `maxTxSize` -* `maxBHSize` -* `maxValSize` -* `maxBlockExUnits` -* `minFeeA` -* `minFeeB` -* `coinsPerUTxOByte` -* `govActionDeposit` -