Repay April 2020 security incident victims

[cbeams]

This is a Bisq Network project. Please familiarize yourself with the project management process.

Board: https://github.com/orgs/bisq-network/projects/16

Description

Repay victims of the April 2020 security incident per the plan detailed in proposal bisq-network/proposals#209 (approved in Cycle 12).

Rationale

The rationale is covered in the proposal linked above.

Criteria for delivery / Measures of success

All victims have been repaid per the plan laid out in the proposal above and the follow-on proposals that nail down certain specifics. Once everything has been clearly decided, this section may be updated to reflect the exact plan.

Risks

n/a, completing this project is required. Risks of not doing so were assessed prior to the approval of the proposal linked above.

Tasks

See the project board at https://github.com/orgs/bisq-network/projects/16

Estimates

No estimates given as completing this project is not a budget-discretionary item.

[cbeams]

Assigned @ripcurlx, as he has agreed to own this project going forward. Thanks, Christoph!

[ripcurlx]

I'll post in this issue every cycle an update on the current victim repayment state.

Cycle 15 report

[chimp1984]

@ripcurlx When did it start? The numbers seem pretty low to me if it was a full cycle/month. Which tool are you using? Is it available?

[ripcurlx]

Cycle 16 report

[ripcurlx]

@ripcurlx When did it start? The numbers seem pretty low to me if it was a full cycle/month. Which tool are you using? Is it available?

The numbers where so low as there was an issue with the filter propagating in the network. After this was solved the amount of fees distributed increased as expected.

[ripcurlx]

Cycle 17 report

[cbeams]

Note that I asked @jmacxx to add a footer row with totals to the repayment tracking report. See bisq-network/support#528.

[ripcurlx]

Cycle 18 report

[cbeams]

I just ran the repayment report locally, pasting it here as a general update:

[ripcurlx]

@cbeams Thanks Chris! I forgot to report on this over the last cycles.

We had an issue between 26th and 30th of January 2021 as the filter object wasn't delivered properly within the network.
Besides that payout is progressing faster than expected because of the increased trading volume.

[chimp1984]

Ah wow, another 2-3 strong months and we have completet that hopefully!

[ripcurlx]

A quick update on the current payout state. We are nearly at 70% USD value payout.

[chimp1984]

The diff to the last update (3.2.2021) is 65397 USD, so that would result in an average of about 39238 USD / month.

With a total of 235,831 USD worth of BTC having been lost, it would take between 20 and 30 months to repay victims at this rate. (bisq-network/proposals#209 on on 14 Apr 2020)

So whats missing: 235 831 USD - 164 536 USD = 71 295 USD. That should be less than 2 more months if we get similar volume. Luckily we did much better as expected. 12-13 months instead of initially estimated 20-30 months. One reason for that discrepancy thought is likely that the share of BSQ payment is way lower as initially estimated/expected.

[ripcurlx]

... and we are close to 80%

[ripcurlx]

Slowly getting closer to 90%...

[ripcurlx]

And more than 90% payed back 😄

[ripcurlx]

Cycle 25 report

[ripcurlx]

I'll probably deactivate the filter tomorrow.

[ripcurlx]

That was quicker as expected. I just deactivated the filter for the victim repayment

[ripcurlx]

We are still paying back two victims as they weren't paid back complete. It is kind of my fault, as I only focused on the total payback number, but didn't look at the single repayments 😬

[danielv1234]

I thought the amount would be paid in btc regardless of the value. . Big loss for me as victim. I did lost my btc, not USD or some kind of fiat.

[ripcurlx]

Cycle 27 report

Victim #5 still getting paid back all other addresses were removed from the filter.

[ripcurlx]

I thought the amount would be paid in btc regardless of the value. . Big loss for me as victim. I did lost my btc, not USD or some kind of fiat.

Based on the consensus in bisq-network/proposals#249 I monitored the USD value.

[invertedbobb]

Not too happy with this of course myself, being victim #4.
From the proposal mentioned by @ripcurlx i understood that the initial attempt would be to compensate USD value, which has been achieved at this point now that the price of BTC has been going up again strongly lately. I also understood that after the USD compensation, attempts would be made to keep compensating up to the BTC value. This could even be at a lower rate than before if the Bisq team is getting into trouble because of the compensations.

Of course i'm happy that the Bisq team has put in efforts to compensate the victims in the first place, considering the nature of the project and risks we take as users. For which i would like to thank all that have helped to realize the compensation so far.

However, right now i'm still at a 76% loss in BTC, which is more than i had hoped for of course.
The discussion currently seems closed where i was under the impression that there was still potential to go beyond the USD value and compensate the BTC as much as possible and reasonable. I probably paid more in trade fees on Bisq than i got compensated in USD value since the security incident 😄.

All that being said, is there still any discussion possible on if and how further compensation would be possible?

[danielv1234]

Someone should open new proposal, for paying remaining btc value, but with lower percentage from Bisq income.

[MwithM]

I know that the victims wanted to be paid in BTC, but that was not a realistic solution. Victims could have asked for a credit to buy the BTC missing if they were so optimistic about the future price of BTC.

Keep discussing to be paid in BTC one year and a half after the start of the repayment makes absolutely no sense, as we already know that being paid in BTC is much better than to be paid in USD, which was uncertain back then.

I'm quite happy that the DAO was able to keep the promise to repay the victims of the incident. I still find missing a full report on the incident and some measures and increase the checks to make sure it won't happen again though.

[danielv1234]

From the start, discussion was for repayment loss. We did not loss USD, we send Monero, and we lost Btc.
Also, discussion was for full BTC repayment, and USD value when send will be counted only as pure information .
There was no proposal for credit, there was only proposal for BSQ coins equivalent, but this was not a good solution, because someone can sell and take price down.
We did not request an specific time for repayment, also, it took almost 6 months until filter were implemented and payment started.
Also, payment were not possible that time for bech32 address, and we paid high fees to move those funds.

Below proposal for repayment :

bisq-network/proposals#209

"The simplest and most direct way to repay victims over time is in BTC using Bisq trading fees paid in BTC (as opposed to trading fees paid in BSQ). @chimp1984 has laid out in #205 how this can be implemented technically using Bisq's Filter mechanism.

Each victim will provide a bitcoin address to which repayments will be sent. In the proposed Filter-based implementation, one of these addresses will be randomly selected for each trade whose fees are paid in BTC, such that the victim directly and immediately receives that BTC."