Sapling withdraw-only discussion kickoff

General
22

Yeah I get the hesitation around hard-coding readiness criteria, but relying purely on “best judgement“ at this scale feels a bit underdefined, especially when you’re talking about effectively sunsetting a pool that still holds a non-trivial share of funds.

I agree that tying decisions to specific custodians like Coinbase doesn’t make sense for a decentralised system. But at the same time ignoring custodial reality entirely also feels risky, since a large chunk of users are indirectly dependent on them whether we like it or not.

Maybe the middle ground isn’t strict metrics but clear signals. For example, wallet support is already strong, that’s good. But for something like Ywallet still being 50/50, that’s actually a signal worth understanding before pushing timelines too aggressively.

I do think setting an end date is necessary, otherwise migration drags forever, but the success of that depends less on the date itself and more on how clearly the ecosystem understands why now. QR might actually be the first argument that’s strong enough to make that shift stick.

23

I strongly support communicating this direction as early as possible.

I’m looking at it mainly from a libertarian / NAP perspective. Freezing legitimately owned funds is obviously a serious intervention in property rights, so under normal circumstances I would strongly oppose it.

But once an authorization mechanism becomes practically quantum-breakable, I don’t think “doing nothing” is neutral either. If the network knowingly continues to accept a mechanism that no longer reliably distinguishes the legitimate owner from an attacker, the predictable result is theft.

So at that point there may simply be no clean NAP-compatible option. The choice becomes one between two bad outcomes: freeze some unmigrated funds, or knowingly allow third parties to steal them.

For me, this makes early communication extremely important. The earlier the community states the principle, the more libertarian the eventual intervention becomes, because users get years — ideally many years — to migrate voluntarily.

There is a huge ethical difference between freezing funds unexpectedly during a crisis and saying far in advance:

“This authorization mechanism may eventually become unsafe. If that happens, it will be retired. Please migrate while it is still secure.”

That does not make freezing good. It makes it less arbitrary.

And I think Zcash could gain a real governance advantage here by settling this basic principle before there is an emergency. Bitcoin will probably face a similar problem with old quantum-vulnerable coins, and I can easily imagine that becoming a massive philosophical conflict there exactly when rapid coordination is needed.

So my preferred principle would be something like:

Known quantum theft from a legacy mechanism should not be treated as a legitimate transfer of ownership, and vulnerable mechanisms should be retired after a long, well-publicized migration period.

Maybe quantum recoverability eventually gives us an even cleaner way out of this dilemma, but if not, I’d much rather have this debate now than during an actual quantum emergency.

24

Where we are now:

  • Ironwood is quantum recoverable
  • Orchard is withdraw only
  • Sprout is going to be deprecated at NU7
  • Sapling is not quantum recoverable
  • Sapling’s share of shielded txs is 6% yesterday
    • Of that 6%, 62.8% of it is miners doing the mandatory shielding of transparent coinbase rewards
    • Presumably a large chunk of the remainder is them doing shielded payouts, but that relies on some speculation.
  • Now that Zakura-common exists, shielded coinbase to Ironwood is 2 times faster than shielded coinbase in Sapling. (Note, Sapling is uniquely fast for shielded coinbase, and a full user proof is nearly 15x faster in Zakura’s Ironwood code)
  • Sapling has no hardware wallet support, whereas Ironwood is supported in Keystone and the imminently releasing ledger
  • Some mining pools have begun using Zecd for processing Ironwood shielded coinbases.

So it seems like shielded coinbase is the last thing happening in Sapling, which several pools have already begun conversion to using Ironwood with.

Any other reservations for making it withdraw only?

2 Likes