Ethereum Due Diligence Committee Call #5

Transcript

[Music] [Music] [Music] [Music]

[Music] so [Music] [Music] so [Music] [Music]

so [Music] [Music] so

[Music] so so [Music] so

[Music] so [Music] [Music] [Music] [Music]

[Music] [Music] [Music] so [Music]

[Music] [Music] [Music] so in uh the stop light system and

uh or the green light system whatever the traffic light system would be a fair way to represent it and as i've described this i've always said that solo staking is top then pool staking and then centralized exchanges and what the eddc is doing is working through those pool exchanges to help rank them in terms or not rank them but vet them in terms of viability and i developed this and have shared it privately a little bit um and have had very mixed reviews about whether it is a uh beneficial tool or whether it is an ultimately harmful tool for the community and before i continue to push it or think about it i just would

like to get feedback from this group and i realized people on the live stream or people who view recording will see it but i i'm hesitant to tweet it or post it until i've actually until i feel comfortable that it's the right move i think this makes complete sense personally yep make sense to me yeah i'm on board with this so regardless of whether it makes sense is it appropriate does that make does that i think it's appropriate you know i think the the counterpoint is i think it's very appropriate

the counterpoint is going to be you know from the security standpoint or from whatever standpoint you see are these centralized exchange stakings like is sticking with coinbase like that much worse or whatever and so like there are people who are mad that it's red but i think like breaking down you know what stoller staking what's non-custodial for over 32 what's custodial and what's centralized exchange thinking that makes a lot of sense to me okay and i i plan to supplement this with um likely a video and possibly a blog post that that kind of highlights this is not about personal funds security

this is a combination of personal fun security and network security uh because they're all kind of tied together and while if if i stick with coinbase i i'm pretty confident i'm gonna get my funds back what i'm not confident about is that if everyone sticks with coinbase that the network remains healthy so that's the uh that angle makes complete sense two comments hank one i think what you just said about combination of network security and personal fun security really needs to be implicit or made clear right in the maybe the words at the top or maybe it's made very clear right in the in the words in the color i don't know but i like what you said

i'm just saying i think you need to make that implicit be explicit and that's key the other thing is a really minor thing i don't know i'm not going to give an opinion yet on the uh the top three but just the wording in the bottom one it seems to me it'd be better to say staking via a centralized exchange that's not capitalized centralized in exchange the action the verb is staking and it's via a centralized exchange just seems clearer to me i don't know exactly what you think oh and then the other comment i'll make on the green one it just seems to me that again one of the things they liked me at consensus or at least different teams would

they'd have me evaluate their product because even though i had a career in tech and i used to code back in the 70s and 80s uh and then i managed products clearly 2005. i really looked at this whole ecosystem ever since i and i have for the last uh five years i've been in it trying to wear the hat of a of a more newbie person and a less technical person and that's really hard i mean i trained as a double e2 but i mean i'm not i'm not as close to it as like poor terence who's in the github every day and living it so i can kind of wear the idea of being outside anyway the thought is as a noob on solo staking it would be good if you also just be clear that's running your own

hardware and software at home and keeping up with the technical crap it's exactly why i haven't done it i'm more than technically competent to do it i just don't want to spend the hours to think about it which is why i haven't done it yet and i want those those are probably well those are great but it doesn't talk to the news you're right now i want to move on with the vetting and i appreciate i deeply appreciate this time because i i've really had a difficult time with this um i appreciate you pointing out that i need to explicitly state that those two purposes because i some of the hesitant feedback i've

received is that uh the only way this can possibly done is to be like a two-factor array or like a matrix and that for me makes it more complicated and i i just was so so interested in making it as simple to consume as possible and i think that statement kind of meets that bar without over complicating it so that's helpful awesome wouldn't it be possible to have it a two-dimensional by saying that one is the risk your personal risk and funds involved and the other is the risk for the network and then one custodial would be in the in the center basically and the

other ones would be more towards on the on the one axis that is the alternate idea and the third idea is a venn diagram i'm not opposed to any of those i think it's worthwhile pursuing all of them but at this moment as i'm moving you know trying to get it out i feel like first we do it simple and then we expand it to make to make it more uh more informational if that makes sense because it's such a new concept to so many people that i wanted to begin with the ground floor and then as i grow get into the dimensional array and the venn diagram so that people can suss out what it really means for them

at any rate i do appreciate the time i feel like thank you phillip for that feedback and thank you kirk i'm good awesome so let's go now to the eddc full vetting page which thank you super fans for following um we're just going to continue where we left off with with steak fish so what country is your business based out of malta i definitely think this is a green it's one of the friendliest regulatory environments for crypto companies um are you confident that you are adhering to all the necessary regulation for the jurisdiction you are in yes but we've been marking this as yellow until we get further information disclosures

uh how much control do you have over users funds do you hold zero one or two keys yes i presume that means they have control over user funds but there's not enough information there if they have full control over users funds that would be a red would you agree yeah i'd agree with that uh do you have any insurance in case funds are lost no we will refund any fees at the event

that slashing that has not been caused by client or network failure bugs has occurred well it's what it is i'm not sure if i acted too quickly but in the spirit of relativity um no it's red yeah yeah i i would also say it was red i'm you know it'd be nice if they can guarantee all the funds to be refunded but if enough people stay with them that might not end up being viable if a cataclysmic event happens where they get slashed with the nth degree so you know i just i i find the

statement a little questionable but you know we're red anyway so we don't need to stick on it uh what is your company's history in the cryptocurrency space our sister company uh f2 pool was founded in 2013 and is the longest running mining pool stake fish has been running validators for blockchain projects from 2018. that's consistent with my experience with stake fish so far it does meet that standard of having been in the space and being knowledgeable about the space so i would say put that at green would everyone agree yeah yep perfect

who are your team members and what other academic and professional backgrounds our key team members are wang chung who has been running the f2 pool a key infrastructure project of the proof of work space from 2013 without many any major hiccups christian new cara who has two decades of experience managing infrastructure and security for enterprises who has been supported with 14 years of experience building performance critical fervor's diapers uh that was my fault madison i i made a snafu and i muted you

and i'm sorry somebody's mic has a lot of feedback right now and i was trying it's not yours but i did mute you trying to resolve that and i i'm so sorry i think it's kirk i will meet there you go yes it was kirk all right so i'll just repeat uh who are your team members and what are their academic and professional backgrounds our key team members are wong chun who has been running f2 pool a key infrastructure project of the proof of workspace from 2013 without many major hiccups christian luchera who has two decades of experience managing infrastructure and security for enterprises danny sokahina who has 14 years of

experience building performance critical server-side applications and services and has consistently contributed to open source projects i'm not as familiar with these individuals so if anyone's familiar with these individuals or know the team i do know of f2 pool but yes okay perfect you're writing this down uh i still think it's fair to give them the

same benefit of the doubt but i do think that we should follow that up with verifying it it's not their fault that we that we're not familiar uh it doesn't mean they've they've failed a standard it means we're just not aware um so by flagging it and still assuming that it's green then i think we give them the benefit of the doubt unless uh if you are using smart contracts have they been audited yes our batch deposit contract has been audited by runtime verification the link to the audit report is available here so i think we decided last time that we're going to stick

this as yellow correct so no auditing would be red auditing would be yellow and no smart contracts would be green is that how we do it but then there's not many that would fit into the green category well they actually say the audit report is available uh i don't have the ipfs link didn't open but green is audited by reputable otters and runtime verification is reputable on uh auditor and it is available for review uh that is our technically our green standard all right um so thanks for pulling it up because

that gives us definitely more structures that we we needed and i've forgotten about that uh runtime verification um yeah kirk yeah i'm just asking a process question as i've said before i'm not evaluating these individuals right now but the process question is this when somebody says our batch deposit project has been audited that's cool and i go okay that's cool and it's going to be green because it's audited what i don't know the answer to and this doesn't say so i depend on you guys to say is does this company have three other security holes where something isn't their batch it could be i have three contracts and the abc contract is audited or a is audited but b and c

isn't in other words we're turning them green on audits without actually asking the question of how thorough and what's the coverage can scope that's the feedback for you guys to talk about yeah and i can also watch for runtime verification um we use them for the ef2 deposit contract and they're heavily used um in the industry and it's one of the best out there i i would like to point out that in our role as as due diligence this is a first pass it is not it is not exhaustive and so my my understanding is that we take what is offered at face value

and then continue to iterate on that to improve the quality of the vetting um we had discussed earlier if we stop at every block to dig in then we could end up spending a week on each individual block which prevents the ultimate goal i agree i think from from that discussion it's green for now obviously we'll further look into it and dig deeper this is really just the first pass um describe your staking setup do you have your own servers

if no which hosting provider are you using which clients are using how many nodes are you using do you have some sort of redundancy built in we will be using multiple hosting providers aws google cloud azure and digital ocean across multiple regions at a minimum one in asia europe and america we've built our platform primarily using prism and lighthouse with the plans to integrate additional clients after the beacon chain is stabilized we plan to have at least 10 nodes with additional ones deployed depending on how many validators we manage we can quickly and programmatically spin up validators in the rare event one of our existing nodes stop functioning properly based on our experience running validators and other proof of stake networks

we prioritize double signing protections and real-time monitoring and incident management systems over redundancy measures we have applied the same level of discipline on running infrastructure on other networks to our beacon chain validators so i think we have uh we have a a rating guide for this one as well is that correct superfoods yep so uh exactly i do like those rating guides we should continue to develop and use those 100 makes it a lot more efficient

um who is invested in your business is there venture capital is there a token if there is a token what is it used for state fish is fully self-funded by wong chun we do not have any tokens and do not have any plans to issue one for the foreseeable future so i think that would be green according to the system we came up with how much are you charging for your sticking services a one-time flat fee of 0.18 until withdrawals are enabled i think that's a neat pricing structure i'm kind of interested by it i'd like to so i definitely personally feel like that's green but i'm interested by how that would play

out in the long run agreed that's the best price of structure i mean for me personally i would like that one the best you know yeah well i mean right now it's 60 but if goes to 3k then it's suddenly anyway it's sort of uh it kind of and i don't want to steal time it implies a prefer a built-in early bird um system awesome so i think let's move to the next one staker by ankar encore i apologize if i'm butchering the names uh who are your team members and what are their academic and professional backgrounds chandler song ceo ankar stanley wu cto of ankar

mohammed kiraz security researcher at encore senior lecturer at cyber security at dan montfort montalford university suliman uh cardos blockchain researcher ankar associate professor at batman university dmitry sullivan senior blockchain developer at ankar ex-cto of la token uh so does anyone know any of those people i'm not personally familiar with them but that again as the previous doesn't make it incorrect just not known to us exactly i don't know any of these people i know

la token la tokens um an aggressive exchange with their own uh digital asset uh that you know it's a little controversial but i think that's fair to be green i would like to i i know that your screen was scrolled over um but we had been beginning with the country of origin on these good call yep that is totally my fault that's a big deal so what country is your business based out of u.s uh i think that would be green what's the rating system for this again

do we have one we don't but lemboshi actually posted something today about what for estonia that well i'll point to once we get to estonia that might indicate our first one that we don't give green effectively what we're trying to evaluate is are you operating the business legally or you know we're not lawyers but from our perspective or from what we can gather legally in the country you're doing so like uh you know malto it's gonna be green switzerland's gonna be green because of their crypto regulations you think of green for usa u.s uh united kingdom and israel um estonia go ahead i might be tempted to argue that the us could be trending

yellow but yeah it's difficult to really uh but in interest of the benefit of the doubt i think it's most fair to uh see i i would argue also that that that's kind of why i was picking out a little bit i really do think that uh it i could go one way or the other i'm not gonna be butthurt if it's green but i still think there's a caution on u.s i would even argue that for great britain as well and the only reason i say that is because it's uncertain we don't have a definitive uh feeling yet set in stone in the u.s of which way we want to go with that and we don't necessarily have the most welcoming laws and they're checkered throughout states versus like a gold standard for agreeing

which is you know i would i think we've all come to that same consensus like like a switzerland so if we compare us to that i think it falls a little short and you know that's a good point it's you know if if these stakers are custody and customers funds you'll most likely need money transmitter licenses to operate in the united states but that that's the that sort of thing like all the others would also need money transmitter licenses if they're taking us customers now no one's excluding u.s customers right or specifically saying we're not taking u.s funds or they can't even check that they'd have to kyc for that and they're not kyc right yeah so if

that's the by the way if that's the it's a little hairy for all of them in that scenario yeah i know i think the thing the thing that would really make sense is for us to find a third-party entity uh another third-party entity who already has you know you've got like the cia factbook or something that has already sort of ranked these countries i don't know that as a due diligence committee for for beacon chainstaking that we really have the bandwidth to delve into you know those assessments as well other than maybe they're publicly acknowledging where they are incorporated or something yeah that's fine so i think green for now subject to

change obviously uh are you confident that you are adhering to all the necessary regulations for the jurisdiction you are in uh the answer would be yes we've been marking that as yellow for everyone and as supervisors writing that out uh how much control do you have over other users funds do you hold zero one or two keys we use bls threshold signature to make sure not a single party owns all the keys does that it doesn't tell me

if they hope you know who who still owns those keys is it you know i i just i i was okay i got two concepts mixed up and i i'm trying not to speak out of my league um but i do know of another company that is that i consider very reputable doing a similar approach um i don't know if they're doing it the same way but um the other company who is doing a similar approach is is well regarded for doing that terence do you have any any insight into that um personally i have not any inside of this personally i will probably give you a yellow pending this is a good trending towards a good direction

but we do need more details um like to basically get yet yet to green yeah so you know and the reason yeah the ones we've given green in the past is customers making maintain control the withdrawal key uh you know so we've given two of those who have said that uh that green we gave bitcoin sweet screen even though they didn't say that's how they set it up i would be interested in learning to make sure not a single party owns all those all the keys and is one of the keys owned by the user or all the keys not owned by the user that's i don't know if it's appropriate to go

back and revisit bitcoin suites right now because when we're talking relatively uh these could actually be this could be the same answer as bitcoin swiss stated in a different way um and i i don't know where to take that it just it is what it is yeah to me that's the one that like uh we can look into further after after we're done with these evaluations we'll obviously do further due diligence this is for time's sake and that's when we can look into further so what is our uh coding for this i think yellow for now what do you guys think yep uh

superficial why do you think that two is the same or similar answer to using a bls threshold signature because isn't bls combined signatures assuming that they're using uh the bls equivalent of a multi-sig so i wouldn't have implied so personally i wouldn't imply that the answer to implies using a bls threshold signature oh no no i i did not the the point is the two doesn't imply anything that it too it could be interpreted in any way and to to give them a green based on something that's so wide open for interpretation while giving a yellow to something that is narrow and more

specific okay and that's that's why i flagged this as needs review but because it's not appropriate now to go back and re-evaluate bitcoin suites in the middle of things yep makes sense do you have any insurance in case funds are lost blank so that would be a red it's presuming that there was a no or didn't feel comfortable answering that uh what is your company's history in the cryptocurrency space anker was founded in 2017 and has been a leading web 3 infrastructure provider helping over 4 200 individuals and one over 100 companies with node and staking infrastructure and so while i'm not personally familiar

i know that i have i've listened a bit of due diligence i lagged out didn't i uh i went out as well i couldn't hear anyone yeah you're lagging out there a little bit uh i have heard colin uh say that he is is familiar with this company and and their a bit of their history so based on what they say and based on his recollection it seems uh like this is fair all right then i would say green based on that you're using smart contracts have they

been audited yes by two auditors stair tech and viosin uh does anyone know sir tech and bsn i've never seen that those names doesn't mean that they're not legit i just don't know i think that yeah that's go ahead that's easy yellow yup agreed uh describe your staking setup do you have your own servers if no which hosting provider are you using which clients are using how many nodes are you using you have some sort of redundancy built in staker has a marketplace for no node providers where people can

uh can spin up a server on their own use public cloud or use anchors one click appear that would set up via dot com to contribute to the network and earn extra commission for anchors infrastructure it has built-in redundancy in multiple locations with private racks and up to 10 gigabytes per uplink or 10 gigabytes uplink terence can you provide some perspective on this i think that you have some some knowledge here yeah first and foremost anchor had a slashing incident a couple weeks ago i'm sure you guys all heard of that 10 of their validators got slashed because they had the risk conditions where of

their staking setup did not have a surround vote protection that to me was pretty concerning so um i'm pretty sure they have fixed it for for now but given that incident i'm slightly still concerned and uh for the set up i will probably give it yellow since it's comparable with stateless and the testing all have very similar setup here so my question becomes is it is it appropriate for us to include because a lot of this in due diligence is including information that we're a bit aware of

from the ecosystem um with nothing against anchor if if they were otherwise yellow and this is all that i knew i would be okay with yellow but the fact that we have a additional history tends to cloud my perspective yeah definitely i definitely agree on that front and whether or not that fits your knob is still concerning investment yeah i would i would personally even endorse maybe adding like a a column on the side just saying whether there's been any known adverse events with relation to any of

these pools and this would just be considered one of those adverse events yeah so james i actually completely agree with you but we did say in the last meeting that we for processed types of questions we wanted to keep it in the discord channel and then yep uh after so i wouldn't i wouldn't recommend doing that i agree with the thought though completely and uh if you post it on the discord channel i would definitely say you know i think we should do this for future meetings and we can discuss it there yeah my bad no no no no problem uh so so what are you thinking overall you guys yellow

yep i would even be fine with putting it as a red because i mean the incident for me they showed that they they that there at least were some technical um difficulties or at least they didn't i mean if they if they're slashing protection doesn't include um surround voting then this is concerning and this kind of if due diligence doesn't include the things that we know then is it really due diligence if we say well that you know we know about this thing that happened but we're probably not going to include that in our due diligence i don't know if that's if that's uh

really due diligence yep i agree so it sounds like red is the consensus yeah yeah awesome so let's mark that one as red then we have who's invested in your business is there venture capital is there a token if there is a token what is it used for uh previous investors pantera capital lemons lemonis lemnis gap dhvc ngc there is a token called an kr token it's used for provider insurance to compensate potential slashing laws

governance to propose metric changes profit sharing in the network uses a liquidity token for a bond like ethereum called a that stands for the underlying ethereum plus future staking rewards i think according to our process that would be yellow is that correct i believe that's what we discussed yesterday perfect and i'll just stick that as yellow uh how much are you charging for your staking services each stakers received between 77 to 86 depending on how they leverage the liquidity token ae

there are opportunities to stake a or oncur tokens node providers receive 12 the team receives 2 percent to maintain the project and pay gas fee to upgrade smart contracts based on our prior evaluations i would stick that as green would you guys agree yep yep all right stake wise oh and before we move on um just just as a comment uh maybe this is also

process related but um what i also found concerning regarding the incident was the way they were communicating their their their foundings or the the the incident to the outside so it took them i guess 48 hours to respond um to make a public statement about that and to bring any public stating that statement about that there was no communication on any channel and and that is this is not the best practice i would say so i don't know where it fits in but

maybe also process related we need to find a way how to include that i think as madison said and i again with the other point that was brought up that was process related we're definitely discovering improvements we could make to the process but we have a commitment to finishing this round with this process and then doing a process improvement round so definitely valuable definitely worth bringing up and making a note of um but also best to wait until after we finish this round agreed uh so stakewise what country is your business based out

of estonia so this is interesting and i want to direct people now to uh nolan or lemboshi's post in the discord uh he linked a decrypt article talking about how a thousand cryptocurrencies lost licenses in estonia as because of strict regulation so in this scenario i actually say that we have either yellow or red so i'm certainly not an expert in in that regard but it's um fair to say that in estonia it's pretty easy to

become e-resident and then open up your own business um there was regulation and there was regulation beforehand this was more or less the case that a lot of companies thought that they would comply that where they didn't with the law so and i don't know how that relates to to whether that is a green or not but just wanted to put out there it's a good point so i'm reading through this article it's really about

the companies that are established in estonia just not actually having a connection there they're more just like headquartered there or they're more of an office there in name only yes and and that's because it is it's just more or less um a a forum that you need to fill out to become e-resident and then you go to to your embassy or to the embassy and then um become e-resident and then you can create your own business there and it's just very very simple to do so and so um that attracted a lot of businesses that are crypto related and also because they regulate their their their tax laws

are quite um beneficial in the way that you only need to pay tax when you take money out and then yeah so there are different reasons why a lot of crypto related businesses out there um i don't know whether the current quote-unquote quick crackdown um has it has really a negative impact on this on this column is that loaded is that loaded phrasing should i not call it a crackdown i don't i don't intend to uh i'm not trying to flavor it

by my comment i was just trying to document i think that's the thing i think it's fine you know i think it's uh so it seems like the two arguments here are well if except stakewise's primary clients are not going to be based in estonia right the primary users aren't going to be based in estonia we don't know we can maybe look to see if their individuals their operators are in estonia like if we look up their team member names um but then the other argument is you know this is it's really targeting that this crackton's been

targeting uh scammers and people who are just coming to estonia and not doing any business there whatsoever is that is that a good summary yeah to to short circuit this i think that we're very likely to resolve this to yellow it makes sense instead of working for a long time to determine if we're going to make it yellow to just recognize that that is the 99 likelihood if that seems fair i'm okay with that yep i mean i don't know maybe that's not even due diligence maybe that's like a presumption no i i think we we need to more clear guideline how to evaluate this column

in general because i think if we look closer to what the regulations are in all those countries then we will discover that some of those might not be green but we haven't done that in so yeah and to be fair earlier in my notes i suggested that green was simply that they disclose as in they are incorporated in some country uh and maybe as we progress we can tease that out hey hey guys i hate to do this but uh i have an emergency i gotta deal with um apologize i'm gonna have to hop off real quick okay take care madison thank you sorry about this guys no problem

uh hopefully this call won't end i don't know if it'll end because i was hosting it or not but i apologize for that as well no worries at all take care of yourself take care oh we're still here cool kirk are you comfortable stepping up just for the remainder or we have actually just started steak wise it would also be um okay if we um we could easily finish three on the next meeting i think i'll pass because of the agenda i got this morning i've got a major role in the next meeting that's coming in 15 minutes already starting to think a little about it so sure okay no problem um you focus on that and we will so that leaves five of us um

i'm going to remain silent and give everyone else a chance to weigh in about and let's just try in the next two or three minutes to come to a conclusion and move from there in terms of the direction we want to go in terms of evaluating the last three here uh yeah so the direction being do we want to continue evaluating with madison offline or do we um you know go ahead i think it kind of feels like a natural breaking point here i think given the having this round today really flowed well and i think if we i see no

reason why we can't maintain that and and do these last three in the next meeting okay um can i ask does anyone have available bandwidth to begin uh looking at the country question as far as finding kind of a third-party metric that we might use as a plug-in here to say if they're on this list or if they have this ranking or that we use as a proxy does anyone have bandwidth for that yeah i can start doing oh god i'm pretty interested in it so i can i can be one of the people that help with that yeah i'd be happy to engage with that as

well if it's helpful okay uh jay khan and michael if you guys want to just and again the intention really is to just find an already prepared list that we can use as a safe reference that kind of plugs in and if we don't find something that plugs in that's absolutely okay okay all right so i guess we will plan to catch up on friday or wednesday wednesday i'm sorry apologies and i feel like we could probably get through the rest of these um yeah all right thanks everybody for your time yeah thanks everyone bye bye