So... it took me some time, but I've created a formal BSIP for the topic. It doesn't have an official number yet, I suppose it's going to be number 0017. Will create a PR later today.
There are a few points in there that require discussion. Please head over to https://bitsharestalk.org/index.php/topic,23334.0.html to participate.
Also, this has become a lot more complex than I initially thought, so this NEEDS a review by community members.
BSIP: 0017
Title: Revive BitAssets after global settlement
Authors: Peter Conrad <[email protected]>
Status: Draft
Type: Protocol
Created: 2016-10-27
Discussion: https://bitsharestalk.org/index.php/topic,23334.0.html
Copyright: Public Domain
#BitAssets, i. e. market-pegged assets (MPA) like bitUSD and prediction markets
(PM) in BitShares can suffer a "global settlement" event. After global
settlement, the asset is effectively rendered useless. This #BSIP proposes
a protocol change to enable resolving a global settlement so that affected
assets can be "reset" and put to good use again.
Market-pegged assets, aka #SmartCoins, and to some extent Prediction Markets are
among the core features of the BitShares blockchain and as such provide one of
our USPs.
MPAs can suffer a "black swan" event. A black swan occurs when the least
collateralized short position has insufficient collateral to buy back the
borrowed SmartCoins at the current feed price. What happens then is that the MPA
is tagged with a "settlement price", defined as the collateral ratio of the
least collateralized short. All short positions are closed automatically, by
collecting sufficient collateral into a settlement pool and paying out the
remainder to the short's owners. MPA holders can use the forced settlement
operation to receive their share from the settlement pool in exchange for their
MPAs. (Actually there's a bug that prevents this currently, but that's the way
it is intended to work.)
A technically quite similar mechanism is used to settle PMs. In a PM, shorters
and holders are betting on the outcome of a specific event. Once the actual
outcome has materialized, the PM is settled by setting a settlement price.
Both MPAs that have suffered a black swan and PMs that have seen settlement are
effectively dead. They can still be transferred or traded, but they can no
longer be shorted. Eventually, all significant holders wlll have settled their
positions, and some dust will remain scattered all over the place, where the
value of the dust position is lower than the fees required to get rid of it.
Allowing MPAs and PMs to be revived after a settlement event will greatly
increase the usefulness of both types of assets. Increased usefulness will
hopefully boost adoption.
After a global settlement, the value of the unit in question is fixed relative
to the underlying asset. This means that any exchange of an amount of the
asset in question for the underlying asset at the settlement price does not
financially damage the previous owner of the exchanged asset.
Reviving bitassets is beneficial for the network as a whole. This justifies
decisions in favour of the network, as long as financial damage to anyone is
avoided. Any acceptable financial damage must be in the range of rounding
errors that are to be expected when dealing with the assets in question.
In that regard, the "override_transfer" permission, which usually regulates
forced transfers of a bitasset by the issuer, can be ignored for the purpose of
reviving an asset.
A new operation will be introduced that performs the revival. The fee for this
operation SHOULD be significant, because it is a computationally intensive
operation.
The operation has a single parameter, the asset to be revived.
The operation requires a signature from the asset's issuer authority.
The operation can only be invoked under the following conditions:
To execute the operation, all open positions of the asset to be revived are
looked up and handled as described below.
In the following, SWAN is the asset to be revived. BACK is the asset backing
SWAN.
Forced settlements have an expiry date. After that date, they are cancelled if
the underlying asset has a settlement_price. For SWAN this is the case, so these
are resolved automatically after some time. Because "some time" can be quite
long though, it is better to resolve this in a quicker way.
Resolution: cancel them all at the time of the black swan. This is a softfork.
Limit orders can either buy or sell SWAN. In the case of a sell, the order holds
some amount of SWAN. Sell orders MUST be cancelled to revive the asset.
Buy orders SHOULD be cancelled, because the price offered may be based on
outdated information.
Resolution: Cancel all orders where either the asset to sell or the asset to
receive equals SWAN. An index on limit_order_object::price::quote::asset_id will
be added to speed up lookups.
Calls on SWAN are resolved when global settlement happens. So at the time of
revival none of these exist.
However, calls may exist with SWAN as collateral. Suppose that DUCK is an asset
that is backed by SWAN. Calls on DUCK cannot be cancelled.
Resolution: Modify DUCK to be backed by BACK instead of SWAN. Modify all DUCK
calls accordingly. Remove price feeds from DUCK.
This solution requires further discussion.
A vesting_balance_object can hold a vesting balance of SWAN for a given account.
Vesting balances can vest with different strategies (linear or coin-days).
Resolution: for every non-zero vesting balance of SWAN, create (if necessary) a
vesting balance for BACK with an equivalent vesting policy and adjust balance
and policy parameters accordingly.
An index on vesting_balance_object::asset::asset_id will be added to speed up
lookups.
Balance objects (not to be confused with account_balance objects) contain
genesis balances, possibly with linear vesting. This should be a rare case in
BitShares-2.0, but it is a possible case and requires resolution.
Resolution: all balances of SWAN are replaced with equivalent balances of BACK.
An index on balance_object::asset_type will be added to speed up lookups.
Blinded balances are part of the stealth feature of Graphene. A blinded balance
has only an asset id, but no (visible) amount. The only visible thing is the
total of all blinded balances of that asset type, which is a field in the
asset's dynamic data.
Resolution:
Note that the pair (SWAN, blinded_settlement_object) creates a kind of virtual
asset that should not be mixed with "pure" SWAN balances by existing user
interfaces.
An index on blinded_balance_object::asset_id will be added to speed up lookups.
This object type does not exist yet. It is introduced by the mechanism to handle
blinded SWAN balances, as described above.
Resolution: blinded_settlement_objects holding SWAN are immediately converted to
BACK.
This is what holds the actual balances of an account. Each such object refers to
a specific account and asset. Account_balances of SWAN can be converted into
BACK at any time via the forced settlement feature.
Resolution: account balances of SWAN are converted into BACK immediately.
This object defines (among other things) if an asset is in global settlement.
Resolution:
The latter requires discussion.
This object logs the existing amount of SWAN (total and blinded). It also
contains the fee pool.
Resolution: set accumulated_fees to 0 and adjust current_supply accordingly.
The issuer will be compensated for the lost fees by receiving the remainder of
the settlement_fund. After all the previous resolutions have been executed, the
current_supply and the confidential_supply must be 0.
It has turned out that force-settling an MPA requires a valid price feed even
when the MPA has a settlement_price set. This is clearly a bug, since in that
case the settlement price is independent from the price feed. Furthermore,
publishing price feeds is no longer possible after a black swan, so the time
when settlement is possible at all is limited to the expiration period of the
price feed of the MPA.
This needs to be fixed. See https://github.com/cryptonomex/graphene/issues/664#issuecomment-254056746
for a discussion.
This parameter defines the minimum required time between a global settlement
event on an asset and the revival of that same asset. The parameter will be
modifiable by the committee and defaults to 4 weeks (28 days). See discussion
below.
A quick cycle of global settlement and revival is likely to cause confusion
among an asset's users (holders and shorters). There is even limited potential
to abuse this feature. Therefore it is reasonable to enforce a minimum time
before revival, allowing users to get informed about the asset's situation and
the resolution process that affects them.
As described above, assets may exist that use SWAN as collateral. Short
positions in such assets must be resolved somehow. The proposed resolution is
quite harsh, in that it modifies the asset that uses SWAN as collateral.
It is reasonable insofar as SWAN effectively represents the value of a fixed
amount of BACK, which means that an asset backed by SWAN is actually backed
by BACK. The proposed resolution only makes that explicit.
There is a related comment in the source code (https://github.com/cryptonomex/graphene/blob/f1b19b15629cd02669a94f2af16eeaec7f54b3f6/libraries/chain/include/graphene/chain/protocol/asset_ops.hpp#L160 ):
If this asset is used as backing for other bitassets, those bitassets will be
force settled at their current price.
This is not reflected in the actual implementation AFAICS.
Better suggestions are welcome.
As described above, the revival operation will set the whitelist flag and
permission of the revived asset. The purpose of this is to prevent the asset
from immediately becoming active again, before the issuer has a chance to
modify other asset parameters. For example, after reviving a prediction market,
the owner might want to update the asset description before starting the next
round of predictions.
An exchange holding SWAN will have its SWAN exchanged for BACK just like anyone
else. The exchange will probably have SWAN balances in its internal ledgers,
which belong to the users of the exchange. The exchange MUST be notified of the
settlement and it MUST modify its internal ledger, replacing SWAN balances
with BACK balances.
Exchanges SHOULD perform this operation independently from the revival, i. e.
before the revival is triggered. They can do this by force-settling their SWAN
holdings.
Users holding SWAN will have their holdings replaced with an equivalent amount
of BACK, at the settlement_price. This does not damage the holder financially,
see above.
The issuer of an asset to be revived should know what he is doing. Invoking the
revive_asset operation is a wilful act. If he isn't happy with the effect of the
operation he simply should not invoke it.
Issuers of assets backed by a revived assets are affected too, but they have no
choice. See discussion about Dependent Assets above.
This proposal discusses a set of changes to bring back a "stuck" asset into a
usable state.
Not all shareholders need to understand the technical details of the proposal,
however, they should be aware of the implications of these changes. It is
particularly important to understand how the revival of an asset affects the
different parties, i. e. holders, shorters, traders and issuers.
