# Audit of Period 48 amendment proposals

This article is the result of an audit of currently proposed amendments by Nomadic Labs.
It aims at making the community aware of what is in the proposals and warn them in case something may harm the safety or the liveness of the chain.

The Tezos mainnet currenlty runs its 48th [voting period](https://tezos.gitlab.io/009/voting.html) which is a proposal period during which delegates
can inject protocol amendment proposals. The top voted protocol that collected more than 5% will be promoted to the next (exploration) voting period
in which supermajority is required to proceed to the following one.

Because most of the voting process focuses on a single proposal, the various teams that regularly propose changes to the Tezos protocol usually syncronise
off-chain to propose all the wanted changes simultaneously in a combined proposal so having many proposals during a proposal period is rare. The only cases
where several proposals have been made in the past were to:
- incorporate late feedback: for example in period 16, two versions of the Babylon proposal were injected because it was discovered that in the first one (PsBABY5nk4JhdEv1N1pZbt6m6ccB9BfNqa23iKZcHBh23jmRS9f) the binary format of endorsement was not backward compatible;
- when a feature is still controversial at proposal time, several versions are proposed to let the delegates vote: for example, in period 10, two versions of the Athens proposal were injected because the roll size reduction (from 10,000 to 8,000 tez) was not consensual.
In both cases, the various proposals have the same authors.

In period 48, Nomadic Labs, Marigold, TQ, Tarides, and DaiLambda have proposed an amendment named Granada. Granada contains several consensual features
and one more controversial one called Liquidity Baking. We chose not to inject a version of Granada without Liquidity Baking because delegates who
disagree with the Liquidity Baking feature already have an efficient way to signal their disagreement and, if they become a majority, stop the feature:
the [Liquidity Baking escape hatch](https://tezos.gitlab.io/010/liquidity_baking.html#escape-hatch).

Anonymous developers have however chosen to propose versions of the Granada proposal without the Liquidity Baking feature. We took the time to review them
to check that these anonymous developers are not trying to fool the delegates and that, shall one of these proposals be chosen by the delegates, no harm
to the security of the chain would follow.

## Method

For each of the proposals, we have:
- checked that code is available,
- checked the difference between the proposal and Granada, also ensure that only (or mostly only) the protocol code has been changed, or checkout only the protocol's `lib_protocol` directory.
- checked that hash is correct using the command `tezos-protocol-compiler -hash-only src/proto_XXX/lib_protocol`

## PtGRANADsDU8R9daYKAgWnQYAJ64omN1o3KMGVCykShA97vQbvV

This is the original Granada proposal by the core dev teams, Nomadic Labs, Marigold, TQ, Tarides, and DaiLambda, as advertized on
- https://forum.tezosagora.org/t/granada-ptgranads/3185
- https://blog.nomadic-labs.com/announcing-granada.html
- https://forum.tezosagora.org/t/announcing-granada/3183

The source code is available at:
https://gitlab.com/tezos/tezos/-/tree/master/src/proto_010_PtGRANAD

Nomadic Labs contributed to the development and the review of all the features of the Granada proposal.

## PsmarYW3qFVZUNYwJaYvPEYG96N3awx5SpYs3PxiAWmCzRBAhY8

- https://forum.tezosagora.org/t/psmaryw3q/3265
- https://forum.tezosagora.org/t/psmaryw-granada-without-liquidity-baking/3256

The source code is available at:
TODO: check hash is the same
https://gitlab.com/mariella_charbonneau/tezos/-/tree/a7db72c38ea7a29456a0c4d9afb149f593e234dd

This proposal was very easy to review because the difference with Granada is very small. The
only change in the protocol code is on a constant called `liquidity_baking_sunset_level`. This
constant is a level after which Liquidity Baking stops. Granada defines this level as `2_032_928`,
which is a level that is far enough in the future to ensures that the Liquidity Baking subsidy can
be sent in all blocks until a future proposal postpones the sunset. This proposal sets the level
to `0` which makes Liquidity Baking immediatly inactive.

The migration from the Florence protocol is identical to the one of Granada so the smart contracts
necessary for Liquidity Baking will be originated evenso, without the Liquidity Baking Subsidy,
they will likely not be used much.

The Liquidity Baking Escape Hatch is also kept so delegates can signal in their blocks their will
to keep or stop the subsidy but since the subsidy is already stopped this flag has no effect.

## PtGRENLBgC4kALRCjYwBAgDNSvK9ZDCst7cRQ1aNP9Ke1cZDwnY

- https://forum.tezosagora.org/t/ptgrenlbg/3277
- https://forum.tezosagora.org/t/psmaryw-granada-without-liquidity-baking/3256/10

The source code is available at:
TODO: check hash is the same
https://gitlab.com/kirimoch/tezos/-/commit/a42ab8c50357a6e9d4c2230dcb425dbc1b0b7ced

This proposal removes all the code that is related to Liquidity Baking from the protocol
code base. The only user-visible differences with PsmarYW3qFVZUNYwJaYvPEYG96N3awx5SpYs3PxiAWmCzRBAhY8
are that the Liquidity Baking smart contracts are not originated and the bakers cannot
set an escape flag in their blocks.

## PtEdoTezd3RHSC31mpxxo1npxFjoWWcFgQtxapi51Z8TLu6v6Uq

This is the hash of the first Edo proposal. On adoption this protocol will immediately fail with `Incompatible_protocol_version` as it is expected to update from Delphi only. The chain will stop.

## Others

These proposed hashes seem to have been chosen to carry messages rather than being true hashes of protocol code.

/!\ No code has been advertised for these hashes.
TO CHECK: `tezos-client` should prevent you to vote for them (right?) unless `--force` is used.
If a protocol with no available code for its hash is adopted, nodes will keep trying to fetch it from the distributed DB and the chain will stop moving forward.

- PtGxSEBUHxTHiSxiSxAxTESTxoFxTHExEMERGENCYxMSG3SEkQs
- PtGxSEBUHxBAKERxBRoADCASTxSYSTEMxTEZoSxderpxx6bsL3U
- PtGxSEBUHxTHiSxGRANADAXPRoposaLXisXNoTXGoooDx6Y1FUP
- PtGxSEBUHXthereXisXaXbakerXoverde1agatedx13376siwry
- PtGxSEBUHXxPLEASExSENDxHELPxHoDLGANGHoDLGANGx7BNY3A
- PtGXSEBUHXFARMxDEXxNFTxRPCxSEBxSEBxSEBxSEBxSE3GRJJC
- PtGTHEXCHANCELLoRX1SXoNXBR1NKXoFXBA1LoUTTZBTC7AwbQm
- PtGxRAKxNxSTAKxALLxYoURxTEZoSxrxBELoNGxToxUSx7Bzcfn
- PtSEBSEBSEBSEBSEBSEBSEBSEBSEBSEBSEBSEBSEBSEBS5VTrmo
- Ptezosti11youbezostezosti11youbezosbezosbezosAH6zwu
- PtPLENTYDEFiDoTCoMxPLENTYofDEFionTEZoSRiPETHxCKT7dp
- PtCRUNCHYxNETWoRKxTEZoSxASxAxSERV1CExPLATFoRMD4GMZL
- PtBARTxBULL1SHxARTxUNSToPPABLExARTxBARTBARTBA6jefXM
- PtSPACEFARMDoTXYZFLAMEDEF1FLAMEFLAMEF1REFLAMEC43qUk
- PtDaotdaoxTDAoxTEZoN1ANSxTACoDAoxTACoTACoTACo4z8QHD
- PtBoHNERDYLDoHVXPRoxBoNERDiLDoxBDVXPx666xGAP3D9UdEy
- PtEASTERNxTURKEYx1SxWESTERNxARMEN1AxARTSAKHAM3tv5NV
- PtCH1CKENxtchickentchickentchickenXbockXbockX6kjJkR
- PtHdaoXobjktXsyncXhicetnuncDoTxyzHERExANDxNoW8ffnzM

## Conclusion

Among the proposals that have been injected in period 48, three proposals do what their authors claim:
- PtGRANADsDU8R9daYKAgWnQYAJ64omN1o3KMGVCykShA97vQbvV, the Granada proposal,
- PsmarYW3qFVZUNYwJaYvPEYG96N3awx5SpYs3PxiAWmCzRBAhY8, a variant of Granada with a straightforward deactivation of Liquidity Baking,
- PtGRENLBgC4kALRCjYwBAgDNSvK9ZDCst7cRQ1aNP9Ke1cZDwnY, a variant of Granada with a complete removal of everything related to Liquidity Baking.

The other injected hashes would cause the chain to halt.