Reorganisation of the proxy page

docs/learn/learn-proxies.md

@@ -8,18 +8,30 @@ slug: ../learn-proxies
 ---
 import RPC from "./../../components/RPC-Connection"
 
-Polkadot provides a module that allows users to set proxy accounts to perform a limited number of
-actions on their behalf. Much like the Stash and Controller account relationship in
-[staking](learn-staking.md), proxies allow users to keep one account in cold storage and actively
-participate in the network with the weight of the tokens in that account.
-
-Check out our Polkadot YouTube video that explains what proxy accounts are:
+Much like controller accounts in
+[staking](learn-staking.md), proxies allow users to use an account (it can be a stash account in cold storage or another account in a hot wallet) less frequently but actively
+participate in the network with the weight of the tokens in that account. Proxies can be viewed as an "extreme" version of a controller account, i.e. proxies are allowed to perform a limited amount of actions related to specific [substrate pallets](https://docs.substrate.io/reference/frame-pallets/) on behalf of another account. Check out the video below about proxies.
 
 [![Proxy Accounts](https://img.youtube.com/vi/1tcygkq52tU/0.jpg)](https://www.youtube.com/watch?v=1tcygkq52tU)
 
+
+## Why use a Proxy?
+
+Proxies are great to use for specific purposes because they add in a layer of security. Rather than
+using funds in one sole account, smaller accounts with unique roles complete tasks for the main
+stash account. This drives attention away from the main account and to proxies.
+
+## Creating Proxies
+
+:::info
+
+To create a **proxy account** read [this support article](https://support.polkadot.network/support/solutions/articles/65000182179-how-to-create-a-proxy-account).
+
+:::
+
 ## Proxy Types
 
-You can set a proxy account via the Proxy module. When you set a proxy, you must choose a type of
+You can set a proxy account via the Proxy pallet. When you set a proxy, you must choose a type of
 proxy for the relationship. Polkadot offers:
 
 - Any
@@ -33,18 +45,18 @@ When a proxy account makes a `proxy` transaction, Polkadot filters the desired t
 that the proxy account has the appropriate permission to make that transaction on behalf of the cold
 account.
 
-### Any Proxies
+### Any
 
 As implied by the name, a proxy type of **Any** allows the proxy account to make any transaction,
 including balance transfers. In most cases, this should be avoided as the proxy account is used more
 frequently than the cold account and is therefore less secure.
 
-### Non-transfer Proxies
+### Non-transfer
 
 Proxies that are of the type **Non-transfer** are accounts that allow any type of transaction except
 [balance transfers](learn-balance-transfers.md) (including [vested](learn-DOT.md/#vesting) transfers).
 
-### Governance Proxies
+### Governance
 
 The **Governance** type will allow proxies to make transactions related to governance (i.e., from the
 Democracy, Council, Treasury, Technical Committee, and Elections pallets).
@@ -57,7 +69,7 @@ governance proxies or watch our
 
 :::
 
-### Staking Proxies
+### Staking
 
 The **Staking** type allows staking-related transactions, but do not confuse a staking proxy with the
 controller account. Within the staking pallet, some transactions must come from the stash account, while
@@ -66,18 +78,18 @@ controller account makes day-to-day transactions like setting session keys or de
 validators to nominate. The stash account still needs to make some transactions such as bonding extra funds or designating a new controller account. A proxy doesn't change the _roles_ of stash and
 controller accounts, but does allow the stash to be accessed even less frequently than using a controller account.
 
-### Identity Judgement Proxies
+### Identity Judgement
 
 The **Identity Judgement** proxies are in charge of allowing registrars to make judgement on an account's
 identity. If you are unfamiliar with judgements and identities on chain, please refer to
 [this page](learn-identity.md#judgements).
 
-### Cancel Proxies
+### Cancel
 
 Proxies that are of the type **Cancel** allow accounts to reject and remove any time-delay proxy 
 announcements.
 
-### Auction Proxies
+### Auction
 
 Proxies that are of the type **Auction** are accounts that allow transactions pertaining to parachain 
 auctions and crowdloans. The Auction proxy account can sign those transactions on behalf of an account 
@@ -86,122 +98,14 @@ proxy can do. Before participating in a crowdloan using an Auction proxy, it is
 check with the respective parachain team for any possible issues pertaining to the crowdloan rewards 
 distribution.
 
-### Anonymous Proxies
-
-Polkadot includes a function to create an **Anonymous proxy**. Such type of proxy is the only way of accessing a designated primary account. That is, it generates an address but no corresponding private key. Normally, a primary
-account designates a proxy account, but anonymous proxies are the opposite. The account that creates
-the proxy relationship is the proxy account and the new account is the primary. 
-
-:::danger Use extreme care with anonymous proxies. Once you remove the proxy relationship, the primary account will be inaccessible.
-
-:::
-
-![anonymous proxy](../assets/proxy_anonymous_diagram.png)
-
-:::note Explainer video on anonymous proxies
-
-Learn more about anonymous proxies from our
-[technical explainer video](https://www.youtube.com/watch?v=iWq53zXo7dw&list=PLOyWqupZ-WGuAuS00rK-pebTMAOxW41W8&index=28&ab_channel=Polkadot).
-
-:::
-
-### Time-delayed Proxies
-
-We can add an additional layer of security to proxies by giving them a delay time. The delay will be
-quantified in number of blocks. {{ polkadot: Polkadot :polkadot }}{{ kusama: Kusama :kusama }} has 6 
-seconds of block-time. A delay value of 10 will mean 10 blocks, which equals to 1 minute of delay.
-The proxy will announce it's intended action and wait for the number
-of blocks defined in the delay time before executing it. The proxy will include the hash of the
-intended function call in the announcement. Within this time window, the intended action may be
-cancelled by accounts that control the proxy. Now we can use proxies knowing that any malicious
-actions can be noticed and reverted within a delay period.
-
-:::caution The Polkadot-JS UI cannot handle complicated proxy setups
+## Removing Proxies
 
-The Polkadot-JS UI cannot handle complicated proxy setups (e.g. a proxy -> multisig 
--> an anonymous proxy which is part of another multisig). These complex setups must be done using the 
-[extrinsics tab](https://polkadot.js.org/apps/#/extrinsics) directly.
+:::info Removing proxies
 
-These complex proxy setups should only be performed if you are comfortable enough interacting directly with 
-the chain, as you will be unable to sign extrinsics using the UI.
+The remove proxies read the section "Removing Proxies" on [this support page](https://support.polkadot.network/support/solutions/articles/65000182179-how-to-create-a-proxy-account).
 
 :::
 
-## Why use a Proxy?
-
-Proxies are great to use for specific purposes because they add in a layer of security. Rather than
-using funds in one sole account, smaller accounts with unique roles complete tasks for the main
-stash account. This drives attention away from the main account and to proxies.
-
-Anonymous proxies, in particular, can be used for permissionless management. In this example below,
-there is a multisig with four different accounts inside. Two of the accounts, Alice and Bob, have an
-anonymous proxy attached to them. In the case that the multisig account wanted to add or remove
-Alice or Bob or even add in a new account into the anonymous proxy, the anonymous proxy would take
-care of that change. If a multisig wanted to modify itself without an anonymous proxy, a whole new
-multisig would be created.
-
-![anonymous multisig proxy](../assets/multisig_proxy_diagram.png)
-
-## How to set up a Proxy
-
-### Using the Polkadot-JS UI
-
-- [Creating a Proxy](https://support.polkadot.network/support/solutions/articles/65000182179-how-to-create-a-proxy-account)
-- [Creating an Anonymous Proxy](https://support.polkadot.network/support/solutions/articles/65000182196)
-
-### Removing Proxies
-
-Under the [accounts tab in the Polkadot-JS UI](https://polkadot.js.org/apps/#/accounts) there is blue button next to the account that has proxies.
-Hovering on the blue button lets you click on a link that says "proxy overview", which displays a pop-up 
-window like the one shown below. In this pop-up window, you have an option to clear individual proxy accounts
-or all of them. Under the hood, the UI is calling the extrinsics `removeProxy` for individual accounts and
- `removeProxies` for clearing all of the proxy accounts.
-
-![Remove Proxies](../assets/remove_proxies.png)
-
-The procedure for removing an Anonymous Proxy is different and there are a few functions on the extrinsic page 
-that will help do this.
-
-:::warning There is no way to get access to the primary account after deleting the anonymous proxy
-
-`removeProxy` or `removeProxies` do not work for anonymous proxies. You must use the 
-`killAnonymous` function which must be called **from** the *anonymous* proxy. 
-This means that the anonymous proxy must be added as an account to the Polkadot-JS UI.
-
-:::
-
-The following steps can be used to remove your anonymous proxy:
-
-- **Step 0**: You need to know the following information:
-
- - the **account** you created the anonymous proxy from
- - **type of proxy**, index (almost always 0)
- - **block height** it was created at
- - the **extrinsic index** in the block (on most block explorers, you will see the extrinsic ID listed as something along the lines of "9000-2" -> 9000 is the block height (block number) and 2 is the extrinsic index. You can find this information by looking up your account in a block explorer.
-
- ![anon proxy info](../assets/kill-proxy-1.png)
-
-- **Step 1**: Go to https://polkadot.js.org/apps/#/accounts (make sure you are on correct network).
-- **Step 2**: Click `Proxied` and add your address, name it `ANON PROXY`. You should now see this address
- in accounts. Now you need to call `killAnonymous` from the anonymous proxy. It is important to note that anonymous proxies *work backwards*; the original account acts as the proxy.
-
- ![add proxy to delete](../assets/kill-proxy-2.png)
-
-- **Step 3**: Go to https://polkadot.js.org/apps/#/extrinsics
-- **Step 4**: Call extrinsic `proxy.killAnonymous` using the selected account ANON PROXY and the following parameters:
-
- - Spawner: (original account)
- - Proxy type (kind of proxy)
- - Index 0 (almost always, but can be seen in creating extrinsic)
- - Block number x
- - Extrinsic index y
-
- ![call extrinsic](../assets/kill-proxy-3.png)
-
-- **Step 5**: Submit and sign extrinsic
-
- ![sign extrinsic](../assets/kill-proxy-3.png)
-
 ## How to view your Proxies
 
 To view your proxy, head over to the Chain State (underneath "Developer") page on
@@ -273,5 +177,71 @@ The required deposit amount for one proxy is equal to:
 {{ polkadot: <RPC network="polkadot" path="consts.proxy.proxyDepositFactor" defaultValue={330000000} filter="humanReadable"/> :polkadot }}
 {{ kusama: <RPC network="kusama" path="consts.proxy.proxyDepositFactor" defaultValue={110000000} filter="humanReadable"/> :kusama }} * num_proxies
 
-## Resources
-[Proxy pallet documentation](https://crates.parity.io/pallet_proxy/index.html)
+## Anonymous Proxies (aka key-less anonymous accounts)
+
+:::info
+
+To create an **anonymous proxy account** check out [this support article](https://support.polkadot.network/support/solutions/articles/65000182196).
+
+:::
+
+:::note Explainer video on anonymous proxies
+
+Learn more about anonymous proxies from our
+[technical explainer video](https://www.youtube.com/watch?v=iWq53zXo7dw&list=PLOyWqupZ-WGuAuS00rK-pebTMAOxW41W8&index=28&ab_channel=Polkadot).
+
+:::
+
+:::danger Risk of loss of funds
+
+Read carefully the text below and before performing any action using anonymous proxies on {{ polkadot: Polkadot :polkadot }}{{ kusama: Kusama :kusama }}, experiment on the Westend testnet.
+
+:::
+
+Anonymous proxies are not real proxies. Proxies that we described so far are _existing accounts_ assigned as proxies by a primary account. These proxies act on behalf of the primary account reducing the exposure of the primary account's private key. Remember, the more often we use an account's private key to sign for different things, the more we expose such key to the internet increasing the visibility of that account. The purpose a proxies is thus to draw the attention of potential attackers away from the primary account, as proxies' private keys will be used most of the time to perform actions on behalf of the primary account. We can imagine proxies as bodyguards of a VIP, loyal and ready to risk their life to ensure the VIP's protection.
+
+Anonymous proxies are new accounts that are _created_ (not assigned) by a primary account. That primary account then acts as `any proxy` on behalf of the anonymous proxy. Note that, to avoid confusion, in this section we will refer to `Anon` for anonymous proxy. Anon are not real proxies, they are **key-less anonymous accounts** as they do have an address but do not have a corresponding private key and, in some sense, are anonymous and belong to nobody. Nobody owns the Anon, as nobody has a private key to control it. The use of the Anon is strictly bound to the relationship between the Anon and the `Any` proxy (not necessarily the one who created the Anon in the first place). Once that relationship is broken, the Anon will be inaccessible (even if visible on the Polkadot-JS UI). Also, Anon accounts are non-deterministic, this means that if we lose one Anon, the next one we create from the same primary account will have a totally different address.
+
+Anon accounts cannot sign anything because they do not have private keys. As a consequence, Anon cannot act as proxies (which is controversial given their original name), and cannot be included in multi-sig. An Anon account acting as a proxy will not be able to sign anything on behalf of the primary account, and an Anon within a multi-sig will not be able neither to initiate nor to approve any call.
+
+:::danger 
+
+Once you remove the relationship with `Any` proxy, the Anon will be inaccessible. Also, Anon accounts cannot sign for anything. For example, do not include Anon in a multi-sig account.
+
+:::
+
+### Why bother about Anon accounts?
+
+Despite their complexity and associated dangers, Anon accounts have a few important benefits:
+
+- **Enhanced security**. Anon accounts cannot be stolen because they do not have private keys. The only accounts that have full access to the Anon are `Any` proxies. Security can be further increased if the `Any` proxy is a multi-signature account.
+
+- **Simplified and secure account management at corporate-level**. Probably the greatest benefit of using Anon accounts is for the management of complex account relationships at corporate-level. Let's take for example 3 Board members Alice, Bob and Charlie. They create a multi-signature account `ABC 1` holding the treasury of their company, and they use it to create the anonymous account `Anon`. They transfer the treasury to the Anon, and they decide to add the multi-signature account `DEF` composed by Dan, Eleanor and Frank (Finance Team) as a staking proxy of Anon to delegate all staking-related actions. After some time, Charlie decides to leave the company. Alice and Bob just have to create a new multi-sig account `ABC 2` (with Carl, the new member of the Board), add it as `Any` proxy to the Anon, and remove `ABC 1`. The rest of the relationships between the Anon and any other proxy stays the same, and the process will always require 4 signatures (two to add ABC 2 as a new proxy, and two remove ABC 1). Without the Anon, the funds will stay on ABC 1. If Charlie leaves, Alice and Bob will have to create ABC 2 with Carl and transfer all funds to it from ABC 1, remove any proxy from ABC 1 and add them to ABC 2. This procedure must be repeated for any modifications of the Board membership. The procedure not only requires much more signatures (4 signatures for each proxy in the case of a multi-sig with `threshold=2`), but it also exposes all funds to potential attackers every time the Board changes its members.
+
+:::caution Removing anonymous proxies
+
+The procedure for removing an Anon is different from the one used to remove proxies. Visit the section "Removing an Anonymous Proxy" on [this support article](https://support.polkadot.network/support/solutions/articles/65000182196).
+
+:::
+
+## Time-delayed Proxies
+
+We can add an additional layer of security to proxies by giving them a delay time. The delay will be
+quantified in number of blocks. {{ polkadot: Polkadot :polkadot }}{{ kusama: Kusama :kusama }} has 6 
+seconds of block-time. A delay value of 10 will mean 10 blocks, which equals to 1 minute of delay.
+The proxy will announce it's intended action and wait for the number
+of blocks defined in the delay time before executing it. The proxy will include the hash of the
+intended function call in the announcement. Within this time window, the intended action may be
+cancelled by accounts that control the proxy. Now we can use proxies knowing that any malicious
+actions can be noticed and reverted within a delay period.
+
+:::caution The Polkadot-JS UI cannot handle complicated proxy setups
+
+The Polkadot-JS UI cannot handle complicated proxy setups (e.g. a proxy -> multisig 
+-> an anonymous proxy which is part of another multisig). These complex setups must be done using the 
+[extrinsics tab](https://polkadot.js.org/apps/#/extrinsics) directly.
+
+These complex proxy setups should only be performed if you are comfortable enough interacting directly with 
+the chain, as you will be unable to sign extrinsics using the UI.
+
+:::