Bitcoin.org: How do we handle wallets that support sidechains and other pegged alternatives?

[Cobra-Bitcoin]

It's my understanding that GreenBits will soon add support for Blockstream's Liquid Network sidechain. I think this gives us a good opportunity to come up with some framework on how to handle wallets that "convert" BTC into other assets on sidechains, drivechains, or alternative networks. Wallets that support Lightning network will also eventually have similar behavior where coins are converted to some other thing (in the case of Lightning, between onchain and offchain).

This raises some issues: do we allow these wallets in the first place, and how do we judge the security of the alternative chain or network? Should wallets that don't effectively communicate the risks of converting BTC into other assets on different networks not be allowed? I was thinking the following guidelines could be added:

• Wallets must make clear to users the risks of converting BTC into less secure and more centralized pegged alternatives
• The "total balance" shouldn't be misleading, the balances need to be split apart completely, there is a BTC balance, and a sidechain or whatever balance, and both are completely separate and are never displayed as one or the same
• No excessive encouraging of users to convert their BTC into a more centralized pegged alternative at the expense of Bitcoin, e.g. deceptive advertising like "Convert your BTC into pBTC for quicker confirmations"

I know some people would just prefer that there isn't too much communication, and users just figure things out, since the UX of Bitcoin wallets is already complicated as it is. But it might be good to at least have users know the tradeoffs being made in security here, since it can be easy to misunderstand. Thoughts?

[theymos]

Federated-sidechain-coins can be considered to BTC as USDT and similar are to USD. (Though in fact federated sidechains are somewhat more secure.) So there should be significant warnings and separation.

LN is much more secure than that. It opens you up to a few additional unlikely attacks, but it's more like SPV wallets vs full-node wallets than BTC vs USDT. In the long term, I don't see any problem with auto-opening channels as needed, combining your BTC-proper balance with your LN balance, etc. With LN, you're not trusting anyone with your BTC. For now LN is far too experimental to let people use without a lot of warnings, though.

In both cases, you're not supposed to put all of your BTC into these things, just spending money. They're the wallet you carry around with you, not your bank.

I'll be interested to see how GreenBits handles their integration.

[jdabs]

I like the approach of wait and see how their integration goes, what the GUI will look like, what phrasing GreenBits decides on, user feedback, etc.

Seeing the way they describe swaps and sidechains could be a good place to determine what parts are misleading or missing, if any.

[crwatkins]

Our wallets already convert fiat and other cryptocurrencies; I don't see this as substantially anything new even though the dominations may still be the same in this case (we don't mandate warnings now about converting to Bolivars, sending funds to custodial exchanges, or sending to unreliable relatives) . I personally don't see any need to mandate warnings that will fit on already crowded user interfaces. At best they will be confusing and incomplete. We can't educate users on complex decisions on a wallet screen. We have other avenues for that.

I believe that it is a good thing to talk about these ideas at any time, but I personally don't think I'm sure enough about how this is all going to play out to presume to be able to make recommendations at this point.

[Cobra-Bitcoin]

In the case of converting to alts and fiat, I think in almost all situations, the user knows they're getting an entirely new asset that has nothing to do with Bitcoin. But with pegged sidechains things can be murkier. It's easy to fall into the trap of believing that because the sidechain coins are pegged to BTC, this means the security guarantees are the same. But it's possible to lose _everything_ in a sidechain a lot easier than you would with Bitcoin proper. If wallets don't communicate things, we open the door for users willy-nilly converting their BTC into coins on sidechains without fully understanding the risks (e.g. perhaps to deposit such coins into exchanges more quickly at a later time).

Suppose GreenBits integrates Liquid into their wallet, and it's relatively simple for users to convert their BTC into Liquid coins without seeing much in the way of warnings, risk explanations, etc. Now also suppose they merge balances and Liquid coins add to the total BTC balance. IMO that's just totally deceptive, wrong, and pretty shady, but our wallet guidelines do nothing to prevent that. GreenBits is the first but we will start to see more and more wallets having features where BTC can be converted to other assets pegged to it on different chains and networks. _Eventually_ we're going to need update our wallet guidelines here.

Agreed on the wait and see approach. I got this discussion going because I wanted us to have at least some discussion before we react to how they've implemented things. Maybe it can also influence their direction in some way if they see this discussion before launch. Personally, I think the UX of Bitcoin wallets is already not ideal; I don't see the need to complicate it more with supporting sidechains. Better to just create separate wallets for each chain.

[jgriffiths]

The GreenAddress wallets including GreenBits are BTC only at this time and will remain so for the foreseeable future. We have no plans to integrate conversion to or from any other coin/asset/token/fiat presently.

GreenAddress/Liquid interaction will either be a different wallet app or available by network selection choice on startup, similar to how testnet is now handled on GreenBits (selected at startup and not changeable without logging out). Whether or not we go the network selection route, the wallet is not planned to allow interacting with other networks in a combined interface, as at this time we have no plans to integrate peg in/out functionality into the wallet.

In both cases, you're not supposed to put all of your BTC into these things, just spending money.
They're the wallet you carry around with you, not your bank.

OT since this is orthogonal to concerns about user confusion in multi-coin/token wallets, but GA with a hardware wallet and twofactor is more secure than a hardware wallet alone (degrading to hardware wallet only security in the event your twofactor method or the service is compromised).

Maybe it can also influence their direction in some way if they see this discussion before launch

You can always notify us of any ongoing discussion, or make suggestions for the service by contacting us at [email protected].

[Cobra-Bitcoin]

@jgriffiths Great to hear that!

Working with multiple networks in a combined interface seems like a nightmare, but it can be tempting to implement it that way, especially if you need to draw attention to your product. I'm glad you guys have ignored that temptation and decided to prioritise usability and safety instead.

[wbnns]

Are there any changes anyone would like to see in #3017 as part of this? We were thinking we could add "Sidechains" as a Feature to the wallet pages once one or more of them support it. Lightning will already be available as a selectable feature when it goes live.