Properly define trade limits

[sqrrm]

This is a Bisq Network proposal. Please familiarize yourself with the submission and review process.

The current state of affairs when it comes to trade limits isn't perfect, an example is bisq-network/bisq#4482

I have looked through the code and I'm still not 100% sure what limits we have in all cases, but I've started refactoring the code to make it understandable. I would then like to set limits that are reasonable, easy to follow in the code and also update documentation.

My current understanding of fiat limits

For non risky methods, time after account creation and signed accounts that are selling, time after signing

0-30 days: 0.25 * MAX_LIMIT = 0.0625 BTC
30-60 days: 0.5 * MAX_LIMIT = 0.125 BTC
>60 days: MAX_LIMIT = 0.25 BTC

For signed accounts that are buying, time after signing

<0 days: 0.01 BTC
0-30 days: 0.01 BTC
30-60 days: 0.5 * MAX_LIMIT = 0.125 BTC
>60 days: MAX_LIMIT = 0.25 BTC

Proposal

I suggest that we change it to

First case

MAX_LIMIT no matter the age. That means 0.25 BTC trade limit for all non risky methods immediately and selling for risky methods.

Second case

<0 days: 0.01 BTC
0-30 days: 0.01 BTC
>30 days: MAX_LIMIT = 0.25 BTC

[chimp1984]

I dont understand why sellers have limits. Anyone remember a reason for that? If not we have to remove that.

[ripcurlx]

I dont understand why sellers have limits. Anyone remember a reason for that? If not we have to remove that.

Don't remember myself why BTC sellers have also the staged limits.

[chimp1984]

Reducing account age protection to 1 months is a too risky change IMO.
Lets just fix the things which do not make sense (that seller has limits).

For signed accounts that are buying, time after signing

<0 days: 0.01 BTC
0-30 days: 0.01 BTC
30-60 days: 0.5 * MAX_LIMIT = 0.125 BTC

60 days: MAX_LIMIT = 0.25 BTC

I dont understand that. Can you explain it in more details?

[gordonel]

Kinda 50/50 here, but I'd love to see higher limits for users that have been signed long enough. Swapping 1-2 BTC for fiat per trade would be great.

[sqrrm]

@chimp1984 The proposal is to remove any restrictions for account types that are not risky, so only those that get signed would have restrictions. There also would be no restrictions for signed types accounts that are selling.

Current limits for buying with a signed type account is:

• unsigned can buy 0.01 BTC
• up to 30 days from being signed, can buy 0.01 BTC
• more than 30 days from being signed, but less than 60 days, can buy 0.125 BTC
• more than 60 days after being signed, can buy 0.25 BTC

@gordonel it is possible to trade larger amounts for safer fiat transfer methods, the most common ones like SEPA and Zelle are considered risky though so they max out at 0.25 BTC.

[MwithM]

Would aging still apply to small fiat markets, where signing isn't required?

Except face to face and and other cash based methods, is quite hard to know if there's no chargeback risk at all. For those and alts, aging doesn't make much sense.

Also, I think that if just after signing buy limits would double to 0.02 btc it would increase likeability to go through signing process and make effects of signing more evident to newcomers.

[m52go]

Overall this sounds great. Should help reduce market fragmentation, increase trade sizes, and encourage sellers to sell.

Would aging still apply to small fiat markets, where signing isn't required?

Also wondering about this. Assuming account signing will eventually be implemented for buying with high-risk payment methods in any new market, does it make sense to impose aging limits during the bootstrap phase or not? I'm not sure.

[chimp1984]

After reading the excellent docs at https://bisq.wiki/Account_limits I would suggest following changes:

Remove seller restrictions for both account signing and account age. Sellers have no limit restrictions beside the limit defined by the payment method. For SEPA or Zelle they could sell 0.25 BTC just from the start.

Remove account age rules, as they are overrules anyway from the account age signing for buyers. Keep the existing rule there but make it easier to communicate as its just the time after getting signed which counts. When the account has been created has no relevance.

Time after getting signed Maximum Trade Size (Buy) Maximum Trade Size (Sell)
Day 0 0.01 BTC 0.25 BTC
Day 30 0.125 BTC 0.25 BTC
Day 60 0.25 BTC 0.25 BTC

I did not find any reason why we should apply the restrictions to sellers, if anyone remember any reason please chime in!
@mpolavieja Do you remember any reason?

To further reduce the hurdle with the limits we should find alternative ways to earn trust. There have been some ideas floating around but none matured yet to become concrete...

[pazza83]

Hi as a new user of Bisq I am all for clearly defining trade limits.

So reading from the wiki it says:

Account limits apply to fiat payment accounts with chargeback risk. The intention is to limit damage a malicious user can do to others while allowing honest users to start trading immediately with no KYC and utmost privacy. Currently, account limits are implemented with two mechanisms: account aging and account signing. These mechanisms only apply to fiat payment accounts—altcoins accounts have full trading capability right away.

The Payment methods page has some information about account signing but not enough to note here.

@m52go has made a super good video All About Account Limits on Bisq (Fiat Only) it covers the technical aspects well but does not really answer my question on the reasons for account limits.

I expect account limits have grown with Bisq over time through lots of discussion between contributors but have not been documented in a way that makes it clear and obvious to new users; what are the reasons for account limits?

If anyone has a link about where I can find more information about the reasons for account limits please share a link below.

I think the reasons for account limits could be more clearly defined. Once they are better defined it will be much easier to have a conversation and reach consensus about how they should be set. For new users such as myself it would be nice to know why these were created. Often reasons can be forgotten over time for example in the discussion above about why sellers have limits.

Current account limit reasoning definition

• Account limits apply to fiat payment accounts with chargeback risk.
• The intention is to limit damage a malicious user can do to others
• To allow honest users to start trading immediately with no KYC
• To allow honest users to start trading immediately with utmost privacy.
• Currently, account limits are implemented with two mechanisms: account aging and account signing.
• These mechanisms only apply to fiat payment account
• Altcoins accounts have full trading capability right away.-

My questions based on the current account limit reasoning definition

Should account limits apply only to fiat payment methods with chargeback risk?
Should account limits apply only to fiat payment methods?
Should account limits apply only to altcoin payment methods?
Should account limits apply only to all payment methods?

Is Bisq goal to allow for trading immediately?
Is Bisq goal to allow for trading with no KYC?
Is Bisq goal to allow for trading immediately and with no KYC?
Is trading with no KYC more important than time taken to trade?
Is trading with no KYC important enough to make a user wait; 1 day, 1 week, 1 month etc?

Is Bisq goal is allow honest users to trade?
How does Bisq define an honest user?
Is an honest user defined by their counterparty, the bank, by Bisq? Can one persons honest user be abother persons dishonest user?
Is Bisq goal to not allow dishonest users to trade?
How does Bisq define a dishonest user?

Is Bisq goal to allow for trading with utmost privacy?
What is utmost privacy?
Who does upmost privacy apply to (counter parties, mediators, contributes, third parties)
Can upmost privacy be different from one user to the next. Is it defined by the individuals or Bisq?

Do altcoins accounts have full trading capability right away, I think the limit is 2 BTC? Why is this?

My questions based on not fully understanding reasons for Bisq's account limits

Are account limits used to limit losses to users?
Are account limits used to limit losses to the DAO / Bisq as a project?
Are account limits expected to grow as Bisq grows; in BTC terms / fiat terms,
Or... are account limits expected to lower if BTC where to increase in price;
Is there a trade off between account limits and liquidity?
Is there a trade off between account limits and trade volume?
Is there a trade off between account limits and Bisq success?
What impact would increasing account limits have on users, on contributors, on the DAO?
What impact would decreasing account limits have on users, on contributors, on the DAO?
Is there a shared consensus among all stakeholders for the above answers? is one needed?

I also think the reasons for having account aging and account signing could be better defined.

I get the impression from reading between the lines that the account signing / aging protocols are a cause of friction for users and contributors. More problems, more support issues etc. Maybe this is me getting the wrong end of the stick?

Apologies for the wall of questions. They are rhetorical in nature, and a way for me to try and be a logical as in documenting my thought process if only to help myself! Please don't feel I want an answer to all.

Main question is the last one:

Is there a shared consensus among all stakeholders for the above answers? is one needed?

As a user of Bisq I think there I am confident that Bisq can achieve what it desires. But it first has to be clear about what that is :)

[chimp1984]

I try to summarize the important motivations:

Account limits are in place as protection against chargeback scams and as loss limitation for mediators and arbitrators in case they make a mistake and pay out to the wrong trader (that happened and they had to pay from their pocket for their mistake, which can be very expensive with a 2 BTC trade).

So payment methods with no chargeback risk (like altcoins) do have the max limit of 2 BTC and that limit is only in place to limit mediators/arbitrators risk exposure.

Bisq's first priority is security. If its not secure to trade on Bisq is has failed. Of course there is no 100% security but that is the priority number 1.
Second priority is privacy. This is Bisq's value proposition and what makes it different to other exchanges.
Next priorities are usability and liquidity. If nobody uses Bisq because its too hard to use or too low liqidity we have failed as well.

I think the answers to above questions can be derived from those priorities. I guess there might be different shades as all those main priorities overlap and have their trade-offs. With being too extreme on security we will lose users and liquidity, so we have to find the right balance. The discussion in that proposal is an attempt to re-balance.

Account age signing was added after we had a serious SEPA chargeback scam. The account age limits turned out to be not enough protection so we needed to improve security. This is also the reason why we have to be very careful when "tuning" this feature. It was basically the only feasible idea how to protect Bisq against scammers in a way compatible with Bisq's vision. If we weaken that protection by increasing the limits too much and chargeback scammers come back it would have a terrible reputation damage and we have to question if Bisq's security model is sufficient. If we fail on security Bisq has failed.

Is there a shared consensus among all stakeholders for the above answers? is one needed?

I shared my point of view. I assume many core contributors share more or less a similar view, but best they respond themselfes ;-).
I think the main values of Bisq are well documented and we intentionally wanted to keep them minimal. The flavours how they develop is the result of the people working on Bisq and shaping it. As it is an open project the outcome is open as well.

[pazza83]

Account limits are in place as protection against chargeback scams and as loss limitation for mediators and arbitrators in case they make a mistake and pay out to the wrong trader (that happened and they had to pay from their pocket for their mistake, which can be very expensive with a 2 BTC trade).

Thanks for explaining your point of view. I thought that was the reason for account limits. In the definitions of the accounts limits I referenced it does not make this clear. Perhaps if this consensus is shared it could be added.

Bisq's first priority is security. If its not secure to trade on Bisq is has failed. Of course there is no 100% security but that is the priority number 1.
Second priority is privacy. This is Bisq's value proposition and what makes it different to other exchanges.
Next priorities are usability and liquidity. If nobody uses Bisq because its too hard to use or too low liqidity we have failed as well.

Thanks. I agree with Security and Privacy being 1 and 2.
You don't mention immediacy.
I do not think being able to trade immediately should have a bearing on account limits. I would be happy to sacrifice immediacy to maintain more security and privacy. Being able to trade immediately is currently a reason given for choosing account limits size. Perhaps this could be removed? I think speed of trade fits more into accessibility and usability of Bisq. Both of these are important to Bisq and should be taken into account when choosing account limits. But both are less important than security and privacy.

I think the answers to above questions can be derived from those priorities. I guess there might be different shades as all those main priorities overlap and have their trade-offs. With being too extreme on security we will lose users and liquidity, so we have to find the right balance. The discussion in that proposal is an attempt to re-balance.

So liquidity is important too :) Perhaps this can also be added to a definition of reasons for account limits. I agree there is a trade-off to be made.

Account age signing was added after we had a serious SEPA chargeback scam. The account age limits turned out to be not enough protection so we needed to improve security. This is also the reason why we have to be very careful when "tuning" this feature.

I really like the account signing / aging feature. I would sacrifice immediacy for more security.

My observations are that all the current popular fiat payment methods based on data from Keybase's bisq#growth-alerts channel are:

1. Zelle (requires signing)
2. Revolut (requires signing)
3. SEPA (requires signing)
4. National Banks (requires signing)
5. Faster Payments (does not require signing)

*would be interesting to see data from a full year. Not sure is this has been published anywhere?

I think the account signing feature provides a positive appearance to Bisq traders. When I have used Bisq to purchase BTC the following is true:

• I look for accounts to buy from that have been signed and are aged
• I avoid buying from accounts that have not been signed are new
• I avoid buying using payment methods that have no signing method

As a UK based user this means I mostly avoid the GBP market (faster payments) and buy on the EUR market (SEPA).

I would be a proponent on making all fiat accounts have a signing mechanism. I think this would increase buyer confidence.

I think the main values of Bisq are well documented and we intentionally wanted to keep them minimal. The flavours how they develop is the result of the people working on Bisq and shaping it. As it is an open project the outcome is open as well.

Thanks can you point me to where these are well documented? I had trouble finding clearly defined vision and values.

How you get where your going, what methods you use to get there will change a lot, but should your vision and what you believe in should be clearly defined from the outset?

[m52go]

*would be interesting to see data from a full year. Not sure is this has been published anywhere?

See "Most common payment methods" in this post.

I would be a proponent on making all fiat accounts have a signing mechanism. I think this would increase buyer confidence.

Really? The general sentiment is that signing is a necessary evil. Is lack of signing the reason you avoid Faster Payments?

Thanks can you point me to where these are well documented? I had trouble finding clearly defined vision and values.

Perhaps this wiki article helps?

[pazza83]

*would be interesting to see data from a full year. Not sure is this has been published anywhere?

See "Most common payment methods" in this post.

Thanks, that link is not working for me? Also has Trojan pop-up?

I would be a proponent on making all fiat accounts have a signing mechanism. I think this would increase buyer confidence.

Really? The general sentiment is that signing is a necessary evil. Is lack of signing the reason you avoid Faster Payments?

Yes, when buying BTC seeing the seller is using a signed account gives me more confidence. I like seeing the little tick on the badge! This along with with the seeing a good account age of increases my confidence about the person I am buying off.

Yes, the increased confidence I have when trading with signed accounts means I prefer to use SEPA and Revolut payment methods. I avoid Faster Payment.

Might adding signing to Faster Payments increase trading volume?

What do you see as 'evil' when it comes to account signing?

Thanks can you point me to where these are well documented? I had trouble finding clearly defined vision and values.

Perhaps this wiki article helps?

There is no mention of vision or values in the introduction. It does nicely define the mission though, but a mission is not a vision :)

[sqrrm]

@pazza83 Signing between traders happens after a successful trade with a seller that can sign and the buyer that isn't yet signed. For a market to have signing some accounts need to be signed by either an arbitrator or by some other means. This takes time and is likely disruptive to the market.

The data stored to track the signed accounts affects privacy negatively. It's not terrible, but clearly better if it can be avoided from a privacy perspective. You mention that the signed check mark feature inspires trust. I'm not really sure that's a good thing, we live in a world of "Don't trust, verify." Having said that, aged accounts could get some similar UI feature to show they are old enough.

Suggested limits

From the discussion I see no objections to removing all time limits for sellers, be they account age or account signing type. Buying will then have the following limits

Account aging

0-30 days old: 0.25 * MAX_LIMIT = 0.0625 BTC
30-60 days old: 0.5 * MAX_LIMIT = 0.125 BTC
>60 days old: MAX_LIMIT = 0.25 BTC

Account signing

unsigned: 0.01 BTC
0-30 days since signing: 0.01 BTC
30-60 days since signing: 0.5 * MAX_LIMIT = 0.125 BTC
>60 days since signing: MAX_LIMIT = 0.25 BTC

Changing the minimum

The reason 0.01 BTC was chosen was to make it unprofitable to cash out stolen bank accounts. If we raise this too soon it might make it profitable again. I think keeping this value low enough to deter scammers only makes sense. The other option is to remove it and accept that there will be scams. I think that would be rather bad for Bisq's reputation.

[pazza83]

@sqrrm thanks for explaining the reasons why signing can be disruptive and cause problems with privacy. All makes more sense now.

Is signing not a form of "Don't trust, verify."? Trades using a signed account have at least been verified by one other user as having matching account details. It also demonstrates that they have at least completed one successful trade. In a perfect world signing would proves that the user's given account details are correct.

Trades from users using accounts that do not require signing cannot be verified in any way prior to trading.

Having said that, aged accounts could get some similar UI feature to show they are old enough.

This would be good 👍

For new users Bisq can be a scary place to trade. Some changes to the UI would make it less so. Even a simple thing like showing account age in the offer column for payment methods that do not require signing would help. This is done for payment methods that require signing.

[chimp1984]

Account aging

0-30 days old: 0.25 * MAX_LIMIT = 0.0625 BTC
30-60 days old: 0.5 * MAX_LIMIT = 0.125 BTC

60 days old: MAX_LIMIT = 0.25 BTC

Account signing

unsigned: 0.01 BTC
0-30 days since signing: 0.01 BTC
30-60 days since signing: 0.5 * MAX_LIMIT = 0.125 BTC

60 days since signing: MAX_LIMIT = 0.25 BTC

I think we should remove the limits for methods where no signing is used (and only account age is used). We have seen with the SEPA chargebacks that the account age is not sufficient anyway, so why should we keep it as protection when it has failed already and only cause friction for new users.

Showing account age thus is for sure still a good weak tool for "reputation".

[sqrrm]

PR at bisq-network/bisq#4744 which removes limits for all types of trades except buying with signed account types. Limits as suggested

unsigned: 0.01 BTC
0-30 days since signing: 0.01 BTC
30-60 days since signing: 0.5 * MAX_LIMIT = 0.125 BTC
>60 days since signing: MAX_LIMIT = 0.25 BTC

[sqrrm]

Implemented and merged

[mpolavieja]

@chimp1984

I did not find any reason why we should apply the restrictions to sellers, if anyone remember any reason please chime in!
@mpolavieja Do you remember any reason?

I am sorry I saw this proposal too late. Maybe I undertood it incorrectly, but I was not aware that BTC sellers ever had trading limits in fiat transactions.

As far as I remember there was a very serious problem for sellers getting their account signed by performing a successful sell transaction (they could get a stolen account signed, and the real owner would not notice or complain about receiving unexpected money). But as long they don't get signed, I don't see the problem of being able to sell the max amount from day 0 as there is no chargeback risk with them.

[chimp1984]

We do not sign the seller only the buyer as far I know (@sqrrm can you confirm?).

[sqrrm]

Right, only buyers get signed. The first month after the signed witness release I think both parties got signed but later we changed it to only the buyer getting signed.