TIP-072: Optimistic Redemptions

[Will]

TIP-072: Optimistic Redemptions

Vote Type

Token holder DAO snapshot with a 7-day vote period

DAO-elected Sponsors

Will, John Packel, East

Overview

This proposal introduces Optimistic Redemptions into the tBTC system. Optimistic Redemptions is a mechanism that allows for the responsible elimination of the maintainer as a single point of failure. It empowers the Threshold DAO with a safeguard in the event of malicious redemption requests such as those sourced from a bridge hack. This proposal marks a milestone in the progressive decentralization of tBTC.

Previous discussion about the tBTC redemption mechanism is found here:

tBTC redemption mechanism design flaw

This is an excerpt from the Threshold blog with the relevant portion for this conversation. This is a place for the Threshold community to start brainstorming better solutions for this mechanism or discuss eliminating it entirely. https://blog.threshold.network/a-tale-of-two-bugs/ The second bug — redemption mechanism design flaw The second bug became apparent as we prepared the first patch. The Threshold DAO can delegate to multiple approver addresses in the WalletCoordinatorcontract. Unf…

It was proposed that, instead of a list of addresses that finalize redemptions, we have a list of addresses that can object to a redemption request. Optimistic Redemptions involves a set of Guardians, similar to that of the optimistic minting guardians:

Threshold tBTC Guardians

Intro: Would you like to play a more crucial role in the Threshold DAO? With the launch of tBTC v2 upcoming, it will roll out with a technical implementation known as Optimistic Minting. Refer to this blog post for a full review of Optimistic Minting. The Optimistic Minting protocol introduces two new roles to tBTC: Minters and Guardians. Here you will find more information about Threshold tBTC Guardians and how you can apply to become one. First, What Are Guardians?: Guard…

Optimistic Redemption Mechanism

With Optimistic Redemptions all redemptions are valid by default. Three objections by different guardians results in a veto as outlined by the following steps:

• If a redemption is objected to by an optimistic redemption guardian, it is delayed.
• Two subsequent objections from redemption guardians results in a veto of the redemption request.

A veto returns tBTC to the requester while inflicting a freeze penalty on the tBTC and a financial penalty. The goal of this penalty is to introduce a cost that guards against repeated malicious redemption requests.

The downside is that this mechanism requires an additional delay for each redemption. Thus, the Threshold DAO must carefully select values for the parameters described below.

Over time the delay could be shrunk to as little as 15 minutes, and entirely waived for small transactions.

The implementation of Optimistic Redemptions will start as a manual objection process and move towards automated. More details on the transition will be shared at a later time.

Optimistic Redemption Mechanism Details

• A default increase of 2 hours on redemption request period

• An initial singular objection increases the redemption duration period to 8 hours

• If a supporting objection is made, the redemption duration is increased to 24 hours.

• A third objection vetoes the redemption

• After a veto returned tBTC is frozen for one month

• A veto incurs a governable financial penalty in the form of burned tBTC

• Unless the DAO votes otherwise in advance, at 18 months the veto mechanism drops to a delay of 0, completely removing the ability of guardians to delay or veto.

Governance

The following parameters will be governable by the token holder DAO:

• Initial default veto delay period
• Redemption delay after first veto
• Redemption delay after second veto
• Freeze time upon veto
• Financial penalty upon veto – with a hard cap of 5%
• Adding guardians

In addition, the Threshold Council will hold the ability to remove guardians.

Optimistic Redemptions will be deployed with an initial set of guardians determined in advance by the DAO.

Stalled Redemptions

In a previous snapshot the Threshold DAO decided to implement RFC 12 with options 1c + 2c. A follow up decision by token holders must be made on how to handle stalled redemptions.

This proposal calls for implementation with an initial 100% financial penalty on vetoed requests. Currently stalled redemptions will be immediately vetoed by guardians, resulting in the corresponding Bank balance returning to zero (the corresponding tBTC was already burned at the time of the attempted redemption). Once this is completed, the financial penalty will be lowered by the Threshold DAO via our governance process.

Conclusion

tBTC has been designed to be the first truly decentralized BTC to DeFi bridge and is already resistant to most centralization vectors. To arrive at this end state it is prudent to mitigate the risk of exploitation by sustaining a DAO-managed backstop function.

An 18-month backstop wind-down process allows ample time for tBTC to be battle tested, and avoids unnecessary vulnerability during this period.

Next Steps

Upon ratification of this Optimistic Redemption mechanism by the Threshold DAO:

• The development of the veto implementation as detailed in this proposal begins
• Recruitment for and implementation of 24/7/365 guardian coverage by the Threshold DAO begins

[JohnPackel]

Per this TIP, token holders ratified that several parameters will be governable:

• Initial default veto delay period
• Redemption delay after first veto
• Redemption delay after second veto
• Freeze time upon veto
• Financial penalty upon veto – with a hard cap of 5%

Regarding the final one, it’s time to set this parameter. The Treasury Guild Committee recommends the maximum penalty of 5%.

Snapshot posted here: Snapshot