Cosmos-sdk: Governance Quorum

[alexanderbez]

3053 was recently merged and prior there was only a bit of (offline) discussion afaik. I think some people might have more to say on the matter. At the very least, if we continue to keep the current model, documentation should be updated more clearly at the very least (i.e. what is quorum, why is it needed, attack vectors, etc...).

/cc @jaekwon @sunnya97 @fedekunze @gamarin2 @zmanian

---

For Admin Use

• [x] Not duplicate issue
• [x] Appropriate labels applied
• [x] Appropriate contributors tagged
• [x] Contributor assigned/self-assigned

[cwgoes]

Ref https://github.com/cosmos/cosmos-sdk/issues/3062

[gamarin2]

I'll post my take on it. Please note that everything that follows is about mainnet governance, with real-value deposits.

1) Quorum as spam prevention mechanism: I don’t think this is the goal of a quorum. This is the goal of minDeposit. In the current model voting No or NoWithVeto will forfeit the minDeposit. So if we have a single quorum (like in current model), minDeposit is the real spam prevention mechanism, and quorum does not add anything to it imo.
2) Two Quorums: This idea was suggested so that most voters would not have to go through spam proposals. There would be a first quorum to filter spam, and a second quorum for the actual vote. If the proposal is spam, people just have to ignore it and the deposit will be forfeited for failing to pass the first quorum. My take on this idea: I think this is too complex for launch. Also, in practice, spam can be intelligently crafted. I don't think validators will just not vote, they will vote NoWithVeto if they see something spammy, and therefore quorum will be met.
3) Quorum to give legitimacy: Yes, but in our system I think it adds unnecessary complexity. Our voting period is 2 weeks, more than enough for all validators to vote (and they will). Here is the issue: if in practice all validators vote all the time, then we don’t need quorums. If not, then quorums might open vector of attacks. If average voting is 30% of bonded stake, and quorum 33%, then someone with 5% of stake could censor some proposals by not voting (even moreso now that we don’t punish validators).

In conclusion, I don't think we need a quorum for launch. Our system without quorum is sufficiently resilient for mainnet and has the benefit of being the most simple. For spam prevention, we have minDeposit. For the rest, we lack real world data. Any sophisticated quorum mechanism should be implemented after we have real-world data to back up not only the need for it, but also the validity of the proposed model.

[cwgoes]

This needs to be prelaunch - the quorum was implemented without discussion and was not agreed upon.

[jackzampolin]

@sunnya97 Can you take care of ensuring this is documented?

[zmanian]

Yeah Quorum could also be remove prelaunch. We need to have a dicussion about it after the GoS upgrade happens.

[alessio]

Removing prelaunch label for now.

[jackzampolin]

@alessio We added a quorum at some point w/o discussion and a discussion about this is needed prelaunch. I agree that it shouldn't block launch.

[cwgoes]

Hmm, we at least need to confirm that the amount of the current quorum is OK.

[sunnya97]

It's a genesis configurable param. But yes, we need to decide what to put in the hub launch genesis.

[gamarin2]

We can always start with a quorum of 0...

[jackzampolin]

We just need to choose the param for launch. Going to track that work elsewhere, and leave this issue as a place to discuss Quorum more generally

[jackzampolin]

This feature seems to be working well and we have had no issues with it yet. Going to go ahead and close this. Please reopen with more details if you do.