The point of making it "hard" to do is that it means it is less likely to happen. People need to know that it is "hard" so they can trust the system.
In my original idea I probably didn't make it clear enough that:
1) Only a delegate could make the proposal
2) The act of making the proposal must come with a non-refundable fee of large magnitude ($1 million) that is paid to shareholders
3) Majority of delegates must approve
4) Must happen quickly, ie: not effect balances over 24 hours old.
A hard fork costs a network millions and those millions will be paid if it will save the network 10's of millions.
The presence of such an automated system means that the network can "capture" the millions a hard-fork would have caused.
Because the fee is so expensive, no one would dare cry wolf or use this option lightly.
Because the fee is non-refundable even if the delegates vote "no" then it is not likely to be paid unless there is already support/consensus.
But perhaps most importantly, the fact that a procedure exists means that suggestions to hard-fork to bypass the pre-established procedure will be roundly rejected.
I think you have to view these thinks like pressurized systems, if you don't provide a release valve then they can explode under heat.
I think that the community should establish some very sound guidelines prior to the event that server to minimize moral hazard:
1) An exchange that didn't use cold storage... is ineligible
2) Failure to use multi-sig...
3) ....
All of that said, with BitUSD there is almost no reason to keep your funds on exchanges any more. So perhaps a VERY HARD policy on this would be best.
BM's proposal has merit; a hard-coded anti-theft/seizure protocol would make the platform more attractive to investors and provide a measure of protection to delegates and other stakeholders.
Eligibility criteria/rules such as suggested above, while necessary, are subject to corruption when the consensus seeking mechanism is voluntary (ie. democratic decay into cronyism via voter apathy).
I would suggest the only way to adequately mitigate the moral hazard created by a rollback protocol is to implement a mandatory voting mechanism. The protocol would look something like this:
1. Theft/seizure incident
2. Eligibility test
3. Delegate rollback proposal w/fee
4. Rollback proposal pushed through client
5. Users must vote before completing next transaction
If voter participation is mandatory:
- Delegates will not propose rollbacks unless they are in the best interest of the community, otherwise they risk getting fired
- Delegates will not propose rollbacks unless they are compliant with the eligibility criteria, otherwise they risk getting fired
- The potential for gaming the protocol through cronyism/apathy is reduced
Handling of the rollback assets is another issue:
Burning dilutes the individual profit motive but introduces a moral hazard for the voting body, as the value of the voter's assets will necessarily increase from the burn.
So it may come to pass that delegates, who are likely to be large stakeholders in a given asset class, will contrive to have assets seized/stolen that they may be burned and thereby made more valuable.
The rollback fee may mitigate this effect somewhat, but may also serve to motivate fraud on a larger scale wherein the fee is simply a cost of doing business (ie. banks laundering money for drug cartels and paying fines that are small in relation to overall profit).
Too many contrived burns would cause mass devaluation through loss of confidence, broken pegs, etc. The same holds true if rollback assets are retained (seized?) by the bank rather than burned.
A true rollback, ie. return of assets, combined with a large fee and mandatory voting would seem to present the least profit motive and consequently the least moral hazard.
Someone gaming the system would have to incur a great deal of effort and expense to simply return the system to a prior state.
However, as previously mentioned, there is theft/rollback/theft/rollback loop that may cause delegates to permit the theft rather than pay recurring rollback fees. In this scenario it might be cheaper to let the theft occur than attempt to correct it multiple times (this is also true for burns - there will be a large threshold where allowing the theft/seizure is cheaper than correcting it).
The final option would be to direct rollback assets outside of the system to a third party, with the obvious choice being charities or similar organizations.
The fatal flaw with third party distributions is achieving consensus as to allocations, particularly as the Bitshares platform is global.
Gaming/conflicts of interest also become problematic.
TL;DR: Implement a rollback protocol with concise criteria, create a mandatory voting mechanism and burn rollback assets.