How Polytone Supports Outposts

With Polytone, users have one account for themselves, and one account with each outpost they interact with.

Why? Consider the listing flow for listing a NFT on Stargaze using Polytone:

During step (4), the Outpost needs to execute a message on the user's behalf, as it is info.sender on the NFT Listing message. To allow for this, Note modules may be configured with a controller, there are two rules about controllers:

1. Only the controller may execute messages on the Note module.
2. The controller can set the message sender to whomever they'd like.

As a result of the first rule, outposts that are controllers can execute messages on user's behalves, making step (4) possible.

The second rule means that user's outpost accounts can be entirely separate from their regular accounts. This is useful because:

1. An outpost can be deployed without a polytone deployment, because rule one scopes message execution to ones the outpost allows.
2. A security vulnerability in the outpost will not impact a user's main remote account.

I suspect this will allow for very safe outpost configurations.

The goal of outposts is to provide an easy way for other chains to interact with the home chain. Polytone does most of this work as, for actions that do not require a token transfer, users get async message execution on the remote chain. For actions that do require a token transfer, an outpost is required as the ICS-20 and ICS-721 standards do not specify a way to transfer tokens and do an action once those tokens have been transferred. Outposts are then needed, as they can abstract a transfer, then callback, then action flow into one message from the user's perspective.

For token-transfer actions like swapping or selling, outposts can set the receiver to a user's regular Polytone account (or ICA account!), and then don't need to expose any non-token-related actions in their API!

For example, because Stargaze only requires a NFT to be sent to list one, the only thing a Stargaze outpost needs to be able to do is NFT listing. For all other actions, a user can use their regular Polytone account[^1].

In summary, outposts built with Polytone:

1. Can IBC transfer tokens and perform an action on transfer completion like ICS-999.
2. Don't require the remote chain make Polytone its default interchain accounts system.
3. Can be written with very well scoped security permissions.

[^1]: and let me tell you, Polytone is good. Worry not about protobuf encoding or ICA's lack of callbacks. Just execute regular CosmWasm messages and get a callback when they're done. From the perspective of smart contract authors, this is the exact same pattern as CosmWasm's submessages and replies.