sBTC Working Group

[blocks8]

Objective & Scope

The ability to easily transfer BTC in and out of Bitcoin layers is an important property. Bitcoin does not have a full execution environment (like EVM) at the base layer for security reasons. Bitcoin layers, like the Stacks layer, can be more experimental and have a full execution environment with smart contracts. Users can then transfer BTC in and out of the Bitcoin layer. The security, cost, and commercial viability of such a peg-in and peg-out system is extremely important to study. The peg-out process needs to be trust-less, so users are not trusting any centralized parties or custodians. The cost of peg-in and out needs to be minimal, ideally zero. And the system should be able to reach a high enough circulating supply so that developers and users can easily use the BTC derived asset in applications.

This working group aims to design (and potentially implement) a trustless and reliable 2-way peg between Bitcoin and the Stacks layer.

Lead

• Ashton Stephens (Engineering Lead)
• Andre Serrano (Product Lead)

Participants

• Joey Yandle
• Muneeb Ali (@muneeb-ali)
• Mårten Blankfors
• Jesus Najera

Deliverables & Timeline

The current focus is on the detailed technical document and releasing the first draft. Anyone interested in contributing can get in touch with the working group.

How do I stay updated / involved?

• Announcements / Updates: posted to Github discussions in this repo
• Architecture / Designs: posted as RFCs to the Forum. There will be a corresponding update in Github discussions too
• Implementation: will be opened as PRs against the stacks-blockchain repo.
• Real-time / near-time discussion: #stacks-core-devs channel on the Stacks Discord server

[dseroy]

Is there any information how this would even theoretically be possible without changing Bitcoin main chain? Would this be an actual trust-less 2WP or an over-collateralized peg like tBTC?

[muneeb-ali]

Recently there have been several proposals floating around in the community about it and this working group is trying to combine them into one concrete design. The high-level details are that:

• BTC gets locked in a script (say Taproot) on the Bitcoin main chain
• A Bitcoin derived asset is minted by Stacks consensus (which has read ability on Bitcoin) on the Stacks layer, let's call this sBTC (so sBTC is 1:1 backed by BTC on main chain, the key thing is who does the peg-out and how).
• A threshold group of signers are responsible for peg-out requests of sBTC. This threshold group of signers have 200% capital locked in Stacks consensus as compared to the BTC locked in Taproot. This group is responsible for liveness i.e., for processing peg outs and has an economic incentive to process peg-outs.

So it has economic security vs cryptographic security (say Lightning) but what makes sBTC interesting is that people already lock $150M+ in the PoX contract to earn BTC rewards, so it's economically/commercially viable to get to a large circulating supply and also not have any fees on the peg-in and peg-out operations (because the signers are already earning BTC rewards for their work). The BTC rewards can be used as incentive for doing the work of peg out requests and these entities/individuals can have 200% (or more) capital locked for ensuring liveness i.e., if they don't transfer the BTC out from the Taproot script on Bitcoin mainchain then their capital remains locked in PoX / consensus.

Stacks has some unique features like Bitcoin read ability, forking with Bitcoin, PoX with BTC rewards that can enable this. The devil is in the details as always and that's why the focus is on the detailed technical design and doc that covers various corner cases and safety conditions.

[cargocultscience]

Thanks Muneeb - this is an interesting idea indeed. I'm struggling with the concept of the threshold group participants economic incentive. For example why would they agree to be part of the threshold group when they could instead simply be a PoX stacker with that capital and get the same economic benefit? I suspect that being part of the threshold group will mean that there are additional risks associated with that capital. Top of mind would be duration / liquidity risk assuming that they are required to lock for periods longer than what they might otherwise desire if they were pure PoX stacker. Additionally processing the peg out is work - and they likely should be compensated. I bring this up only to suggest that perhaps having a fee associated with peg outs is appropriate. Very interested to see where this goes.

[muneeb-ali]

they could instead simply be a PoX stacker with that capital and get the same economic benefit?

The SIP proposal will be to change stacking behavior where everyone must be a threshold signature signer. The idea is to reuse the decentralized group of stackers (and their capital locked for BTC rewards) to do the work of peg-out signing. Some people might drop out, given additional work/risk, but that means a higher BTC yield for folks who want to do the work.

There are ideas to introduce fees (maybe for giving priority to sBTC peg outs or other use cases) but having zero fee wrapping/unwrapping is very powerful as it reduces the friction to go in and out. In fact, a key advantage of reusing existing capital locked in stacking is that there is no need to introduce additional fees so the peg operations can be cheap/economical.

Very interested to see where this goes.

Thanks! Same here!

[yangfh2004]

Zero-fee wrapping would be game-changing.

[getify]

Has anyone here looked more deeply into how RenVM (https://renproject.io/) works, with respect to custodial/non-custodial "bitcoin write"?

[hstove]

Yes, we've spent a lot of time researching it. There are definitely similarities relating to having a large-membership threshold signature scheme, using some other asset as a kind of "stake" for economic security. Otherwise, this group has the ability to include novel mechanisms that Ren can't have, due to Stacks's architecture.

[getify]

@hstove would it be fair to conclude that they don't actually have a non-custodial "bitcoin write" solution...yet?

[hstove]

I'm not exactly sure what "bitcoin write" means specifically, but they support sending BTC based on events from other chains (just like any BTC bridge)

[getify]

@hstove sorry, that's the term I've heard used/thrown around, to describe the challenge of having a system that's automatable (without human interaction) performing "write" to the bitcoin blockchain -- which obviously requires private keys -- and thus, where and how are those private keys stored securely so the automation can use them but the general public cannot. As I understand this problem, that's the main limitation preventing full "round trip" from Bitcoin-to-Stacks-to-Bitcoin.

[hstove]

Yeah, and sorry for sounding flip in my last message - that wasn't my intent. I think you described it well. Ren uses threshold signatures, which is basically the approach used by all similar protocols (like Thor). The idea is to use cryptography to "combine" every staker's public keys to create one giant "multisig". This is a challenging problem, but there are existing projects who utilize this approach.

[cargocultscience]

Is this space still being used for this project? I see that there is an upcoming spaces on the 12th regarding a whitepaper, yet nothing has been discussed here AFAIK.

https://twitter.com/herogamer21btc/status/1601277608574214144

[diwakergupta]

Yeah most of the Stacks blockchain devs have been (and continue to be) heads down on 2.1 (first building, now testing), so there hasn't been much to share here. But I would expect to see a lot more regular updates and public discussions on this subject once 2.1 is (nearly) out the door! FYI @igorsyl

[diwakergupta]

sBTC whitepaper was released yesterday: https://stacks.org/sbtc-nakamoto (link to whitepaper)

More detailed description is in SIP-021.

[ReadyPlayr18]

What is expected to happen if STX price drops 75% relative to BTC and the collateral pool becomes smaller than the peg wallet? Just trying to understand if there's a (even if unlikely) scenario stackers/signatories might be incented to collude w each other and drain the peg wallet.

[ReadyPlayr18]

Let me ask this another way -- what are the circumstances under which >70% of all STX collectively decide to deliberately steal the BTC, consequences be damned? "The peg wallet's BTC is now worth $0.01 more than our STX, so let's just steal the BTC!" isn't exactly how people with a lot to lose think.

If sBTC existed right now, it would require the cooperation of at least 22 entities to move the BTC (see https://app.sigle.io/mattystx.id.stx/ihmlyalZrqnwNp7TBza54). Contrast that to Bitcoin, where the top 3 Bitcoin miners can double-spend deep-pocketed exchanges any time they want. I'd be a lot more worried about Bitcoin failing from miner collusion than sBTC failing from Stacker collusion.

If this was live on 1/16/22 and the STX collateral was worth $200M while the peg wallet held $100M BTC, after one year the STX collateral is worth $26M and the BTC is worth $49M. So the question is whether $23M or an 88% gain is enough incentive for peg wallet signatories to collude? And imagine this is 10 or 100x that scale. Would $230M or $2.3B be enough for peg wallet signatories to collude? 

And worth noting, this isn't the same scenario as BTC miners colluding. If BTC miners collude and compromise the chain, the value of the BTC goes to zero bc no one trusts it anymore. If peg signatories collude and destroy faith in sBTC and/or STX, sBTC and/or STX can go to zero without affecting the value of BTC earned by the dishonest peg signatories. 

Look, I hope the answer is peg signatories will be decentralized enough to overcome potentially significant incentive to collude. But if I'm an institution considering sBTC defi on Stacks, I'm going to need to get very comfortable that risk is lower than the counterparty risk of wBTC on ethereum. 

[jcnelson]

So the question is whether $23M or an 88% gain is enough incentive for peg wallet signatories to collude?

I think it's nowhere near enough incentive.

If they pull it off, the attackers would split the $23M at least 22 ways, for a best-case average payoff of at most just over $1 million. In order to actually keep and spend that money, the attackers would need to plan on spending the rest of their lives in countries with no extradition treaties with the countries of the folks they just defrauded, and would need to adopt a low-profile lifestyle in order to avoid getting caught by the private eyes that the defrauded players would almost certainly send after them. That's the improbable best-case scenario.

To even have a shot at this, they'd need to somehow cash out their BTC before they got caught in a way that doesn't link identifying information to their gains. That pretty much precludes directly using exchanges, who definitely won't send you that kind of money without being reasonably sure you are who you say you are. I'd imagine that the set of people who would willingly give you market rate for $1 million of stolen BTC without doing KYC/AML is very small, and likely to be shrinking, given how easy it is to track stolen cryptocurrency these days and both (a) prevent it from being sold and (b) arrest the people who try to do it anyway.

So, the attackers are looking at trading a possibility of $1 million each, along with the guarantee that they'll each have to drastically uproot their lives to avoid legal punishment for a clear and easily-traced case of theft and fraud. I don't know about you, but I don't think $1 million is worth it to the current STX holders. I don't think it's even in the same few orders of magnitude.

---

The other side of this line of reasoning is whether or not there exists an "incorruptable" set STX holders who represent at least 30% of the locked STX. If such a set exists, then it doesn't matter what the price of STX is relative to BTC -- that pegged-in BTC isn't going anywhere it's not supposed to go. I think it's relatively straightforward to prove that such a set exists: have these STX holders publicly disclose who they are, and take actions to build trust with the community and would-be investors. For example:

• The entity holding the STX could incorporate in a jurisdiction that will take swift punitive action against them if they try and steal the BTC.
• The entity holding the STX could regularly get it audited by 3rd parties, and disclose the audit's findings.
• The entity holding the STX could contribute to the growth of the STX ecosystem, such as by investing in STX businesses or hiring STX developers (showing that they have skin in the game for the long haul).

Now, of course this "incorruptable" subset can't unfreeze the peg if over 30% of the locked STX are evil. But, they can ensure that there's no payout for evil STX holders who would try to steal the peg's BTC, which would severely discourage economically-rational attackers.

---

It's all well and good to be concerned about what happens if the price of STX plummets versus the price of BTC. I think lots of system design options will be on the table if there's a protracted period of time for which this is the case that can be brought to bear to de-risk the possibility of systemic failures such as this. However, of all the things I worry about that could break sBTC, a sizeable fraction of the stacked STX falling into the hands of criminals who would burn their lives down for $1 million each is pretty low on my list of plausible failure modes. The things that actually keep me up at night include:

• What happens if there's a security vulnerability in most of the sBTC stacker daemon implementations that lets someone just steal the BTC that way?

• What happens if there's a major exchange breach and lots of STX falls under the control of a single evil entity who can freeze the peg?

• What happens if there's a popular smart contract that holds lots of STX, and it gets hacked or commandeered, leading to the above?

• What happens if too many stackers outsource the peg maintenance responsibility to a few third parties, and they get hacked?

• What happens if enough stackers drop offline that the peg freezes for a protracted period of time?

• What happens if the peg wallet recovery script ends up being no good? How might we de-risk this possibility?

• What happens if Bitcoin miners decide to fuck with Stacks and the peg by reordering or censoring transactions? What are the system parameter choices necessary to prevent X% of the mining power from degrading the quality of service, for some given X?

And so on. Mostly banal things.

[ReadyPlayr18]

So the question is whether $23M or an 88% gain is enough incentive for peg wallet signatories to collude?

I think it's nowhere near enough incentive.

If they pull it off, the attackers would split the $23M at least 22 ways, for a best-case average payoff of at most just over $1 million.

thanks for this additional context. one last observation, i would be careful about dismissing the size of the incentive. sure, maybe $1M isn't enough to move needle for an individual entity. but is $100M? is $1B? 

the $23M incentive in my hypothetical example assumes only $100M sBTC in circulation. there is currently $4B wBTC on ethereum network and a year ago there was over $10B (100x my hypothetical example). 

plus a big part of the sBTC marketing will be that BTC defi can dwarf ETH defi by activating dormant BTC (over 70% of BTC hasnt moved in over a year). and both ecosystems are in early innings of adoption cycle so we can easily 10-100x again from here -- which means the incentives could become quite large. 

for this to be taken seriously by institutions who think in terms of 9 and 10+ figure positions, the incentives can't remotely appear to reward dishonest actors at any meaningful scale. 

all that said, I do agree with you that if it can be demonstrated there are enough (>30%) honest actors managing the peg wallet to provide as many (or more) assurances as the trust required to use wrapped BTC on ethereum, this can capture meaningful share of BTC defi. 

that is essentially the case made in the wBTC white paper (attached) which any institution considering sBTC will surely read: "Wrapped tokens follow the centralized model, but instead of relying entirely on one institution, they rely on a consortium of institutions performing different roles in the network."

it just needs to be clearly communicated that this is a similar model, but one that is built on much more favorable trust assumptions -- which will be required to offset all the other technical risks you mentioned. 
wrapped-tokens-whitepaper.pdf

[jcnelson]

thanks for this additional context. one last observation, i would be careful about dismissing the size of the incentive.

Agreed! The only point I was trying to make above is that $1 million is not really going to move the needle. But you're right that there does exist a plausible price of BTC and STX at which it could. This is why I think it's important to reason about the 30% incorruptable subset, since they collectively prevent such payouts from ever materializing.

[ReadyPlayr18]

there does exist a plausible price of BTC and STX at which it could

agree. plus keep in mind, the # of BTC in peg wallet matters just as much as its price. 100k BTC at $20k presents the same incentive as 10k BTC at $200k

[will-corcoran]

@diwakergupta I would love to listen in to these calls, if there are any (for grants / bounties visibility). Would you mind adding me? Thanks, Will

[diwakergupta]

I'm not running any meetings :) cc/ @igorsyl