Seeing this protection mechanism now. So if the G$ donors stop backing it - then all of a sudden it won’t be useful for gas anymore - does this not create the potential for an even worse cascading failure? - where vulnerable people start depending on G$ for gas - and then one day they can’t anymore.
Thanks Will for taking the time to comment
Using G$ as a gas token doesn’t pose any systemic risk to the Celo ecosystem.
- at any point G$ can be removed if there’s no liquidity
- if the price of G$ goes to 0 then the nominal amount of G$s to pay for gas will be infinite. ie the lower the price the more nominal G$s you will have to pay for your gas, rendering it useless to pay for gas and thats it.
- Since most of the gas fees are going to be burned (in the upcoming gip) then liquidity is not a big concern, certainly nothing that can cause systemic risk
- The main risk in such an extreme case is that any G$s still in the community pool not spent will lose their value, but in the last couple of years G$ has proved far more stable than most tokens and even Fiat currencies. (see dashboard.gooddollar.org)
Regarding using “existing structures”, well gasTokens is an existing structure, and while swapping to Celo is a good technocratic solution (which we have considered) it is not a good UX solution.
Having a UBI token as gas token both enables easy onboarding to web3 without the need to worry where you gonna get your crypto and your gas and also strengthen the support for UBI which the Celo community and founders are committed to.
In Solidarity
I’m a fan of G$ and support the overall mission however, I am going to vote ‘No’ on proposal ID 138 because adding a new gas token introduces systemic risk to the network and I’m not convinced all the risks have been properly discussed and mitigated.
If G$ value drops below some critical threshold, either because of an economic attack or code vulnerability, then the network could become spammed to a halt due to ‘free gas’.
Also, as far as I understand, using a token other than CELO to pay gas fees reduces the overall value of CELO since 0 CELO would be burned in transactions that pay gas fees with G$. Is that correct?
Have you considered less risky options like using a paymaster instead?
2 Likes
Hi all,
Here is the on-chain proposal that has been issued.
1 Like
Hi @Patrick The burn rate for gas will be the same irregardless of what token it is paid in, and ultimately the final token burned will be in CELO, so the concern isn’t founded. The way it will work is G$ will be swapped for CELO at the last mile, so actually increasing the value of CELO.
As Hadar explained above, if the price of G$ goes to 0 then the nominal amount of G$s to pay for gas will be infinite. ie the lower the price the more nominal G$s you will have to pay for your gas, rendering it useless to pay for gas and thats it.
The objective here is to enable the 130,000 wallets already holding G$ to use those tokens to pay for usage on Celo, therefore benefitting the overall network growth and adoption.
1 Like
Hey Patrick,
As i’ve replied to Will above, if the token price goes to 0 then the actual gas costs will be infinite, because the actual gas costs are based on the price oracles for the gasTokens. So in order to spam you would need to make G$ price very high
Blockquote The way it will work is G$ will be swapped for CELO at the last mile, so actually increasing the value of CELO.
I am not sure this is how it works. Where would it be swapped? My understanding is that when you pay gas in say cUSD, nodes actually receive cUSD, but that the protocol ‘discourages’ gas payments in ERC20s by making them slightly more expensive than gas payments in CELO.
Blockquote if the token price goes to 0 then the actual gas costs will be infinite, because the actual gas costs are based on the price oracles for the gasTokens. So in order to spam you would need to make G$ price very high
Also double checking here, when $G price goes to zero, would gas costs in dollar terms go to infinity or would the number of $G tokens required go to infinity (keeping dollar costs more or less unchanged)?
1 Like
You are right, Anna was wrong, G$ won’t be swapped it will be burned, thus supporting UBI.
Gas prices are determined relative to Celo according to the price oracle. Each gas token has a price oracle with its current price in Celo.
So yes the number of G$ tokens would go to infinity. If Celo price goes down relative to G$ then less G$s are required to pay for the gas.
1 Like
I think it has no problem to use G$ as gas fee in transactions G$ - G$ (transfer / send / withdraw / distribute G$) which takes over 80% transactions of G$ wallets. If G$ value decreases, it needs more G$ for gas and vice versa. User can see & confirm gas fee before doing.
For swap / other transactions (G$ - other coins, liquidity, farm), may still use Celo as gas fee.
The gas fee (by G$) can be burned or paid nodes for handling transactions. Nodes can swap G$ or keep it.
1 Like
How fees are handled after GingerBread hardfork (the current situation) is detailed in CIP-52.
Essentially what happens, for every non-Celo token, is that the base fees goes to the FeeHandler contract (instead of the Governance Contract aka onchain Community Fund). From there 20% gets sent to the Carbon Offsetting fund and the remaining 80% gets swapped for Celo and then that Celo gets burned.
For Mento assets this swap is done with Mento itself, for non-Mento assets (we don’t have any at the moment), there’s a enabled list of exchange pools that could be used and a smart contract figures out the best price possible among them.
The tip portion of the fees still go to validators. Validators are free to do with this token whatever they’d like unrestricted.
So TL;DR, if we enable GoodDollar as a gas token, 80% of the fee will get swapped for Celo and burned, 20% will go to the Carbon Offsetting fund, where it may get converted to ReFi assets.
Hop this helps,
7 Likes
Thanks for the clarification, @martinvol!
Given the huge impact GoodDollar has on the Celo Ecosystem and 100,000+ people worldwide, I’m fully supportive of this proposal. One of the value propositions of Celo has always been the ability to pay GAS with an ERC20, and I think we need to push for innovation on this front.
If there are ways we can add some safeguards in case a specific metric (e.g., the price of G$ relative to Celo price) drops below a certain threshold, we would revisit this proposal and re-evaluate.
1 Like
Thanks for clarifying the burn mechanism, I did not understand correctly how it works now.
x-posting my message in Telegram because I’m curious to hear how these risks are being addressed:
To be clear, I appreciate the work that G$ is doing and support making it easier for new users to access the Celo network. My intention to make sure that we are moving thoughtfully and thinking through the potential risks before committing to an irreversible decision.
The two main risks I can think of are associated with oracle attacks and malicious minting. In an oracle attack, if a malicious user were able to pump the price of of G$ then a very small quantity of G$ could be used to DDoS the network with spam transactions, making Celo network unusable and potentially causing validator nodes to crash (which we’ve seen happen in the past with significant spikes in traffic) leading to a network halt.
Has there been an analysis regarding how much it would cost to carry out this sort of attack?
Does the oracle use a TWAP?
If so, how long is that window?
What analysis was done to ensure this time window is the most expensive for an attacker to exploit?
If the oracle is using a real time price feed, then how are we guarding against flash loan attacks?
Who controls the oracle contracts?Regarding risks associated with malicious minting, if an attacker were able to gain control over the mint function, then they could again DDoS the network with spam transactions, leading to congestion and potentially a network halt.
What are the conditions under which new tokens can be minted today?
What is the governance process that owns making changes to the mint function?
Is minting G$ algorithmic or manual?
1 Like
First, I am a big fun of what GoodDollar is doing! And definitely I appreciate and am super excited about the partnership between GoodDollar and Double. Sorry for being late in this discussion. I notice that the thread started back in March, long before our collaboration. I totally see the value of enabling 130K G$ wallets to interact with Celo projects and the friction of paying gas in Celo. My intention here is to figure out the right solution so all Celo projects will benefit from it.
Based on @martinvol post, I believe the execution depends on solid on-chain liquidity for <CELO, G$> directly or indirectly via multi-hop routing. Right now, the on-chain liquidity for <CELO, G$> is really thin. Of course, Double can help G$ to address this issue. More importantly, the price of G$ on-chain needs to be managed. There will be constant selling pressure on G$ due to converting G$ to CELO and if there won’t be enough buying demands for G$, then the price of G$ will be tanked. Have you thought about the price impact on G$ and what’s your plan to address the selling pressure? I worry that if these two issues are not addressed, the solution won’t work as intended.
I do echo concerns raised by @Patrick @WillRuddick. Instead of a solution that paying gas in G$ and then convert to CELO, have you thought about an alternative solution that uses something like AA (Account Abstraction) and/or Proxy service, where the G$ is converted to CELO via the same on-chain liquidity and pay the gas on behalf of the user in CELO? This solution will achieve the same goal without adding unknown risks at the Celo chain level.
Again, I am rooting for the enabling 130K G$ wallets to interact with all CELO projects. It seems to me that the key for this to work is to maintain solid on-chain liquidity for <CELO, G$> and manage the on-chain price of G$ well. Hope my 2 cents here are useful.
1 Like
Chiming in here as a few folks have asked for my thoughts on this proposal.
I think this is an exciting proposal that represents a big step forward for the Celo network. If this passes, G$ will be the first token that is not governed by the Celo Governance contract (unlike cUSD, cEUR, and cREAL) to be added to the gas currency allowlist, which would be a huge milestone. Congrats to the GoodDollar team for blazing the trail here!
I wanted to start by saying I’m supportive of this proposal 
With that said, I do think the Celo community needs to move quickly with a few small changes to mitigate some small risks that might come with this. As an aside, as I see it, CGP 138 is just the first step of two proposals, and if I’m reading it correctly, it carries no risks at all since it is just registering an oracle and not yet turning on the gas currency.
As for the future second proposal, here are the risks and mitigations as I see them:
Oracle Manipulation
With only one oracle reporting the price of G$, there is risk that the operator of the oracle could manipulate the price of G$ to increase its price such that someone with even a small amount of G$ tokens could flood the network with extremely cheap transactions.
To mitigate this risk, validators could chose to limit the number of G$ gas paying transactions that they include in a new block proposal to some fraction of a full block (e.g. 20% of a full block or 10M gas), so that the network would continue to process other transactions while the attack is happening. This can be done without a hardfork and a change to the blockchain client that cLabs could potentially roll out quickly (assuming validators support it).
This attack can also be mitigated by increasing the number of oracle providers reporting on the price of G$. I encourage all node operators to consider throwing their hat into the ring here to help operate an Oracle.
Market Manipulation of G$
Market manipulation represents a similar risk to oracle misreporting, but can be carried out by anyone, even those not running the oracle. This risk is directly proportional to the amount of liquidity in DEXes with G$ pools. There have been a few folks pointing to the thin liquidity on Uniswap.
However, I think most people are unaware that there exists a GoodDollar reserve AMM that is part of its protocol which has $652K in cDIA (Compound DAI) liquidity on Ethereum. It is my understanding that the oracle is reporting the price of this AMM and not the Uniswap pool on Celo, which makes this attack significantly more expensive. Regardless, the mitigation above solves this attack as well.
Governance Failure
Another risk is that the governance process that governs the G$ token’s proxy contract is compromised in some way. This represents a new type of risk, since up until now, all gas currencies have been governed by the Celo governance contract (which is in turn governed by staked CELO holders).
If such an attack occurred, this could allow an attacker to upgrade the contract to mint a large amount of G$ tokens and flood the network with transactions.
Currently, a 5 of 9 multisig governs the G$ token on Celo, which is close to the 6 of 8 threshold that is becoming a common recommendation, e.g. here. I invite the multisig holders to share more about the steps they have taken to mitigate this risk.
Regardless again, having a limit on how many G$ transactions validators include in a block would also dramatically mitigate this risk.
Bridge Failure
Since the G$ token is bridged from Ethereum, there is in theory a chance that a bridge hack could cause some trouble to the Celo network. However, in practice, it appears that this risk is low.
Most bridge hacks steal funds that the bridge is custodying on Ethereum. If that were to happen, the value of G$ would fall on Celo but the supply would not change. Instead of stealing funds, a hacker would have to do the inverse and mint G$ on Celo.
Luckily, I’m told there is a cap that limits how many G$s the bridge contract can mint, which is set to 300M G$ per day (~50K USD). While I haven’t been able to verify this independently, if this is indeed the case, at current gas prices, regular users could compete with $50K worth of gas per day by raising their gas cost by 7x, which would still result in transactions that cost less than 1 cent per transaction for cUSD transfers.
Finally, once again, any issues arising from such an attack would also be mitigated by the Celo client change described above.
In summary, all risks appear easy to mitigate with a small change to the Celo client. Importantly, this change would not require a hard fork and would only require validators to upgrade. Given that, it can likely be rolled out relatively quickly and with minimum disruption. For this reason, I’m excited about this proposal and I’m looking forward to seeing the community consider it.
8 Likes
Thanks, Marek, for a well thought out assessment of the risks that come with adding the GoodDollar token as a gas token on Celo. I’d like to reiterate that cLabs is supportive of the GoodDollar proposal, and want to ensure that we do due diligence to mitigate the risks listed above.
We are happy to report that the cLabs blockchain team is planning to include such a change (allowing validators to set limits on the fraction of G$ gas paying transactions for inclusion in a new block) in the next planned blockchain client release.
1 Like
Thanks for the write-up and for providing straightforward suggestions on how to mitigate the potential risks. If these suggestions are implemented, I’m 100% convinced the potential upside of this proposal outweighs the downside. I hope other Celo stakeholders will agree and also vote Yes.
Thanks everyone for supporting this proposal. The G$ price oracle is now live and running and has successfully reported for the first time
We are taking the concerns of the community into account and will do our best to address them in the next proposal which is will be for actually activating G$ as gas token.
3 Likes
the idea is very good it could also reduce the coins in circulation
1 Like