Risk of Market Manipulation Attack - need to be considered SERIOUSLY

[Markus]

I think I like the idea of keeping the margin requirement at the highest price in the past hour as a solid way of keeping a lid on this kind of manipulation.  Something else to consider with respect to BitUSD and market depth is that there is no reason why people could keep open bids on the blockchain far outside the trading range to profit from any rapid manipulations.   

Another limiting factor on this kind of attack is that anyone who attempts to 'walk the book' would have to pay the highest price for all shares and a HUGE fee because the way the market matching algorithm works they wouldn't get to take advantage of the asks that are lower than their bid. 

So I suspect that the initial bid/ask spread will be very wide and a substantial market depth will be achieved before anyone would be willing to trade.  This combined with the relatively high initial value of the system (estimate 60 million) and the cost of attacking this would be very high.  Especially since only those invested in its success will initially own it.    Also unlike most traditional exchanges where people have long delays getting money into or out of the exchange, in this case the money is already there!

If I had to be the cost of such an attack would be greater than the cost of a 51% attack on bitcoin when it had a similar market cap.

For a big mature market this kind of attack is unlikely to succeed. A safety net is needed for the very beginning of the main chain but more so for the bunch of cloned chains (for other assets) that will spring up soon. These might have very thin markets for quite a while. Are we gonna bother about these here or shall their developers fix this task?

What has been discussed in this thread and the previous one are really two different scenarios.
A) One margin call triggers the next in a chain reaction (unintentionally)
B) One where the price is manipulated down to an extremely low level to then exploit the rebound.

Keeping the margin requirement at the highest price of the past hour helps against B).

What about A)?
Shall we always trust that the order book will fill up quickly enough to prevent large sudden swings from happening?
How many people are kicking themselves for not having had a buy order in at BTCe at 103 $ a bitcoin two weeks ago?
If there are several 10 million BitUSD outstanding, how many sell-orders do you think will be online? Enough? BitUSD holders do not have an incentive to post sell orders when they are not watching the market. They do not hold any volatility risk, so why should they. The few traders watching a starting short squeeze might sit back a while before daring to catch the falling knife - and in the end they might not have enough purchasing power to stop the avalanche …

[bytemaster]

I agree that this scenario is a possible risk, especially in the early stages when market depth is shallow.

My suggestion would be:
Instead of using the best bid of the last block why not use a trailing average of the last, say 12 blocks - or one hour? This will give everybody else a chance to notice the attempted attack and prevent it by filling the orderbooks.

In addition to this what about having two different prices. One for triggering margin call of existing short positions and one for determining required collateral for new short positions. The first could for example be the highest price of the last hour, the latter the lowest price of the last hour.
This would prevent step 2 in the attack as the required collateral for the 1 000 000 000 BitUSD could not be so easily manipulated down.
Most times these two prices would be very similar and the spread only come into effect when volatility increases.

The exact number of blocks and the type of average is of course a matter of fine tuning.

I think I like the idea of keeping the margin requirement at the highest price in the past hour as a solid way of keeping a lid on this kind of manipulation.  Something else to consider with respect to BitUSD and market depth is that there is no reason why people could keep open bids on the blockchain far outside the trading range to profit from any rapid manipulations.   

Another limiting factor on this kind of attack is that anyone who attempts to 'walk the book' would have to pay the highest price for all shares and a HUGE fee because the way the market matching algorithm works they wouldn't get to take advantage of the asks that are lower than their bid. 

So I suspect that the initial bid/ask spread will be very wide and a substantial market depth will be achieved before anyone would be willing to trade.  This combined with the relatively high initial value of the system (estimate 60 million) and the cost of attacking this would be very high.  Especially since only those invested in its success will initially own it.    Also unlike most traditional exchanges where people have long delays getting money into or out of the exchange, in this case the money is already there!

If I had to be the cost of such an attack would be greater than the cost of a 51% attack on bitcoin when it had a similar market cap.

[Markus]

I agree that this scenario is a possible risk, especially in the early stages when market depth is shallow.

My suggestion would be:
Instead of using the best bid of the last block why not use a trailing average of the last, say 12 blocks - or one hour? This will give everybody else a chance to notice the attempted attack and prevent it by filling the orderbooks.

In addition to this what about having two different prices. One for triggering margin call of existing short positions and one for determining required collateral for new short positions. The first could for example be the highest price of the last hour, the latter the lowest price of the last hour.
This would prevent step 2 in the attack as the required collateral for the 1 000 000 000 BitUSD could not be so easily manipulated down.
Most times these two prices would be very similar and the spread only come into effect when volatility increases.

The exact number of blocks and the type of average is of course a matter of fine tuning.

[toast]

Did you see dan's most recent reply in that thread? I think his solution in your example would lead to the attacker gaining 400 instead of 1b BitUSD for his one XTS

Here is my thinking...

This attack is only made possible by the insurance system proposed in this thread which can create 'unlimited buying power'.   However, like all things there is diminishing marginal utility as buying power goes from 0 to infinity as the risk of such a market move triggering that kind of event goes to 0.   

So if we consider the likelihood of blowing out a 100% margin position to be very low... then if we provide network-wide insurance up of say 200% margin position then the probability of BTS falling from    1:1 to .25:1 is is more than 2x as unlikely as .5:1.   This puts an upper limit on the potential debasement by market manipulation or attempted short squeezes with thin markets.

Through normal operation BitUSD is taken out of circulation by market fees.   This will correct any small unbacked issuance over time.   Likewise, BTS is taken out of circulation from fees and will correct any new issuance required when a short is blown out.   

This is kind of like a limit on the FDIC insurance payout of $100K per account... in this case our limit is 4x the margin.

[yidaidaxia]

As I'm reading through the related threads, we are now discussing about a concern for non-backed BitAssets.

I saw Bytemaster, Alt and other guys raised good ideas/solutions about how to deal w/ the non-backed BitAssests after the non-backed appeared. I think after refinement, the final solution will resolve the small unbacked issuance which is caused by normal market price fluctuating over time. However, we need to consider about the scenario of  Market Manipulation attack.

If someone has plenty of one kind of BitAssets, let's say BitUSD, when he want to manipulate the market, he will:

1. sell his BitUSD to clear out all the buy orders in the market
2. use another account to issue (for example) 1,000,000,000 BitUSD at the price 1,000,000,000 BitUSD/XTS which required to
    set 2 XTS as collateral in this acount when the price of BitUSD is (for instance) 100 BitUSD/XTS
3. In the mean time, he place a buy order at the same price(1,000,000,000 BitUSD/XTS) w/ 1 XTS.
4. If there is no any other new buy order w/ higher price in about 5 min(block production time), he will get 1,000,000,000
    BitUSD by 1 XTS.
5. In next block, price go back to normal, and the acount selled BitUSD w/ extremly low price get forced margin call and lose
    about 2 XTS.

In total, it costs him about 3 XTS to get 1,000,000,000 BitUSD (plus the cost to clear out the buy orders in the market). And by the solutions to resolve the unbacked BitAssests, the whole system(means everyone in the market) will pay for this 1,000,000,000 BitUSD w/ a huge amount of XTS and this guy could use this 1,000,000,000 BitUSD just like any other BitUSD.

I know, you may argue that to "clear out all the buy orders in the market" and "there is no other new buy order w/ higher price at the same" is almost impossible. But consider about:

1. he could attempt to do this by any price and scale, for example, issue 1,000,000,000 BitUSD at 1,000,000,000,000,000
    BitUSD/XTS w/ 0.000002 XTS as collateral.
2. he could keep monitoring the market and try this(clear out the buy orders and do extremly low price sell-buy) when he
    found the depth of market was shallow enough to do the attack.
3. combine above 2 factors, this potential attack will like a ghost above the market especailly in the initial stage of system or
    some speciall market situation which will cause market not deep enough to pretect from this attack.

After I write through all above, I still think that the attack just could happen at very small likehood, but considering about the attack could and will cause as huge as amount of backed BitUSD, if the attack occurs successfully, it could destroy the system or deeply harm it (considering about it may happen again and people know this factor so the system may destroied at the end anyway if not destroied by just one attack immediately). And the person could have his reason to do it because he will be the first one to know this information so he could leverage this advantage to spend out BitUSD before other people realized the situation or he just want to destroy the system by some other reason with or without direct financial benefit to himself.

So I think to elimate this risk, we need to resolve the root cause - the unlimited freedom of BitAssets issurance price.

After discussion with Alt, Alt and I think we may need to do this:

Set some limitation to issurance price, even a very loose limitation like 10% ~ 1000 or 1% ~ 10000% vs. current market price will benefit to the system risk level control.
or
request additional "waiting time" for a trade with an issurance involved, for example, 2 block time or more. Or just to request the addiational "wait time" for the "big deal" w/ huge amount BitAssets issued(it may be not a good idea since we do not know the actual value of BitAsset or XTS  and/or BitAsset/XTS in future).

Either of above solution could reduce the risk of this issue significantly. And notice that it's just the limiation for issurance instead of for all trades so the impact to market freedom should be acceptable.

By the way, I think this limitation makes sense to the philosophy of the system - BitAssets is designed to pegged to real assets and in the "real world", the trade(and traders) is always w/ some limitation in price setting(or some factor could be converted to) at least by now and in near future..

Thoughts?