Governance as an Attack Vector

Transcript

some vulnerabilities in the five protocols because of their governances and I'm glad to have the chance to share that with you. Uh I'm head of search in BlockFull where we look at coordination as our main goal. So broad scope of things that's what been taking us into governance and into Dows and we're basically a big group of gov nerds where we see over the last few years we're exploring AI for governance. We were exploring reputation systems for non-putocratic governance and well being service providers on a few different dows we started finding some of the vulnerabilities that we're going to bring. The idea what we look at is governance security. So beyond code

audits not only uh uh faulty code can destroy your system but also anyone playing inside the rules that gets to manipulate the rules for their own profit. Uh, one of the nice things that we've been feeling during this time as we're building this is to make those governance systems resilient and trustless. And to see the trustless manifesto published recently was a very good nudge that we're working in the right direction and that it makes sense to work towards this uh defense beyond just centralization. So governance exposes some risks but it's what allows us to make our systems resilient. So we need to also make governance resilient

so those systems can benefit from uh from that part. If you haven't read this article super recommend you do like it's worth you one. And the main goal here is to create effective ways to measure the trustlessness of a system uh in a way that we can standardize. That's how we've been working towards analyzing those risks. And well, let's jump into it. Uh the goal is to always find an attack before it appears, right? When you're when you're trying to make defense, especially uh when we're talking on a code level, if it's too late, it's too late. No way to go back.

And the first moment we found that let us uh start looking into it was the NS DAO last year. Uh we realized that the delegated supply on ENS DAO was just too small to make sense with their size of their treasury. the voting power was too cheap, the treasury was too big, and we were like, "Okay, why is no one arbitrageing this?" Uh, turns out that just because they hadn't realized, uh, ENS was sitting at $120 million without counting their own tokens on the treasury. So, this is just if and stables and the total possible voting power at the moment was worth $65 million. The voting power that was actually being used was of about 24. So, let's say $25 million, take 120 million

home. That's a good that's a good arbitrage. I I would take it if I didn't care for protecting the Dell also. Uh but not only economically viable attacks are the risk, but also ways that make them cheaper and make those attacks even more profitable. Uh ENS as one of the examples of the things in ENS DO that would make this easier uh is their governance implementation for voting delay. So whenever a proposal goes uh to vote before between proposing and start voting there is a voting delay that's where you have time to actually discuss the proposal to actually get more aligned delegates to to join this delegation pool and vote and ons it

became quite clear that having a weak governance stack and bad economic conditions is going to make for an easy attack. So we need to look at the weak governance stack because bad economic conditions just go up and down. We're all in crypto for a while. We know that a bare market just comes tomorrow or next month and suddenly uh all your token prices are down and your stables on the treasury remain the same. Suddenly the arbitrage is worth it. Uh basically at this point we keep monitoring ENS DAO. There's still a very good arbitrage to make. But now with a stack that has a security council in place, a vetoing body composed of different entities that can look at a proposal and say this is a drain. We're not playing this game. This proposal doesn't go through. So it would just be

a waste of cash to try to arbitrage that. Uh there's also full case of how we solved this if anyone is interested to look at this one. Uh but this is old news, right? Like Dows have problems. People don't vote, treasuries get robbed. Yeah. But this is how we say things when we're in a normaly bias perspective. All right. Like no, it's not going to happen in my D. It's not not on the sex that I use. We're just too big to fail. we're safe and well we all know how how this goes on that story. Uh but on Dow so far this has led to some some problems and currently it's on DeFi Dow also starting to show up uh as we're analyzing. I bet it's been

there for a while but no one has been really looking too much into governance security. So over Ethereum's time life, we have about half a billion dollars uh stolen directly inside the rules of a DAO either by getting the Dows to buy back your tokens or just transfer the treasury to me. Different strategies, same result, Dow loses money, open source stops getting funded, defy pools and incentives get drained and someone gets really rich hidden somewhere in the world. Uh but in the last 12 months as we started looking into this, we've already solved the ENS case with the $150 million total loss that we could uh could have had there and have over the last year since then identified something that is even more worrisome

for us. That is attacks on protocols uh vulnerabilities on protocols that actually control true governance uh user funds, right? Like have access to change oracles to move not nice not nice things to to see while you're researching and that found we found up to $4 billion so far at the highest point of the of the curve for beautiful bull market. It was at a 4 billion uh dollar exposure total which is not money we want to lose from our users.

Looking at all these attacks we identified patterns we're trying to work those in standards. So this is also an invitation for all security nerds to reach out join uh we're talking with EF on how to push this further and one of their requirements is for us to work with a broader uh amount of teams. We cannot be creating standards by ourselves because we might be blindsided in some point. So everyone who wants to look into how do we standardize governance security through a more we're governance nerds. we need more security nerd perspective in some of our flaws here. Uh it's very welcome to join. But what we what we came up to uh with this was a framework for analysis and defense

based on four different verticals. We're looking at economic conditions, token distribution governance implementation, and activity. Economic conditions is basically is it profitable? Right? Does it cost more than it has on the treasury? Then I'm not going to do it. Uh that goes to also token distribution that is understanding if the power can even be acquired like oh it costs 10 million to rob 150 but the liquidity is 1 million. So that's then you have to slowly compound your attack until you're ready and that's what we want to identify before it happens. Uh the governance implementation so things that could make it much easier. So can your governor contract be spammed? Can I make 10,000 proposals on mainet? And now I have to

vote for one for it to pass and delegates have to vote no on 10,000 and let's see how that goes for you to defend uh and governance activity. So not only are those tokens available to defend, but are they actually paying attention? Are the investors in the US allowed to cast their votes or they going to have regulatory trouble and let the Dow go down just not to get this trouble? So all of those things matter when we're measuring how we defend those treasuries. Uh oops, this is repeated. Uh and the challenge here is not only to solve this because solving this is easy.

Put it on a foundation. Let them call the shots. Now they can just veto everything. But you lose a lot of the things that make it worth it doing right. You lose trustness. You lose resiliency. Now you're bound to the laws of the country where the foundation sits. you're bound to incompetence uh in a centralized uh entity or corruption whatever uh you all know why we do things in a decentralized manner and we believe that getting holders to take part is the is the way here when we say holders we're not talking like millions of people in retail we're talking understanding alignment with stakeholders and investors that if you are holding millions of dollars on a Dow token that governance is what keeps your assets safe so okay you want to put at

liquidity provider 60% of what you have, but let leave 40% at at a delegate you you see alignment with. Find a security team and hire them to represent you or get get that uh that voting power you have being useful for the security of the DAO, not just to make a small LP fee that's not really going to move your needle. Uh the thing is a few in the Dow today can already make decisions alone. Both ENS and unis swap need not many delegates of the top ranking to pass things. And right now we're just lucky that those are not abusing their powers. Some of those are centralized exchanges. Some of those are early investors or uh early

contributors. But well, it's still just lucky that they don't change alignments, that they don't move for their own benefit inside of the collective. Beyond that, a lot of power sits on centralized exchanges. And that's how most of the attacks we've mapped came to be. It's basically much harder to identify uh 10,000 wallets getting $5,000 from like a diff from a few sexes and then getting suddenly everyone delegates and votes and proposes at the same time. And when you see the attack is set, voting power has been counted, there's not enough voting power to counteract. and you're going to sit and watch for the seven days of the process how we cry about the

destruction of the Dow that's been built for years. And even worse than that in my opinion is to see delegates that have that delegation that have an investor that have a big holder that are behind them saying like hey you can represent me that you can keep the Dow safe and both on compound and unis swap most of those top delegates don't vote. Uh this is starting to change on unis swap curiously with Duna now being legally compliant apparently encourages investors to participate. Who would have said? Uh but on comp is specifically we see Humpy that's like the the comp attacker. He's been trying for over a year doing his moves trying to take power. He's more active than most of the

other delegates and that's just absurd in my perspective. And those conditions together we've been calling it the quorum crisis. The quorum crisis is a absurd lack of participation in Dows that makes although the market cap is bigger than the treasury the active market cap is just can be ignored and they leave us exposed and if we're exposed we have to assume Lazarus knows those types of attacks they've only took like they've taken $500 million. Wow. Okay. I find a lot of money but compared to scale of attacks over all time that's not that much but if this becomes a pattern uh on on our research been pointing so many of those different

dials exposed uh it could be like a serial thing if we find a if more uh qualified actors get to play so we have to see the risk before the problem just like we saw it on ENS we're now seeing it on compound compound faces a very similar situation of what we were talking before but in an even worse position. Uh while the treasury is big and delegated supply and active supply are small not only that is going on but uh compound different from ENS uh has a governance that has access to the protocol itself. The comets are owned and commanded by the governor. So that means that the capture here is not only draining 150 million. This could touch

way more money. not only the Treasury Dow money but my money, your money that that that is another level of an issue and it's been fought against. There are people in compound trying to call that attention, trying to make that move to change that. But at the same time, we still see that Humpy, the leader of the adversarial coalition, the red teamer here, he has more voting power right now than the average turnout. So, uh, recently he was able to block by himself. Oh, we say by himself. I don't know what are those wallets, but let's say it's this coalition of Humpy. He's been able to block a proposal to fund the Guardian Council. The guys that have veto power. Uh so if he attacks now, the

guys that have to veto him, they they just didn't get the funding because he said no. And this council has to be renewed next year. And maybe he can say no again. This is his public power. We don't know how much heo he holds in any centralized exchange. We don't know what addresses that are laying dormant are also theirs. We are still to find that. And if any of you is humpy, please let's chat. Uh we we saw that uh last year in in one of the attacks that happened there. Uh we mapped that saw what was going on. In the end, he passed the proposal and accepted a new product from

the DAO to cancel it himself. He could have taken over and he didn't. So, this is a complex actor to understand, but the opening is still there. And we don't deal with trust. We deal with making guarantees that our systems work and are not capturable out of thin air. So if we have to assume that Lazarus knows Lazarus being generalistic attacker symbol here but is an as an attacker that is wellunded that is creative that's is smart and that knows that we are all normaly biased now nothing's going to happen we're all safe we literally get in touch with D and say like hey guys you are at risk and they look at us and say now nah we're fine believe us like we we got some defenses you haven't seen and I hope they do but

I find that it's more more of an ego and overconfidence thing than anything else. The thing is it's not only getting that 51% supply. There's many other ways to make it cheaper. So even if you're one to one well let me drain it lose money out of the drain compared to my cost but then I'll short the drop and I'll have borrowed some like you can start compiling mechanisms and even like in an unfavorable uh condition still profit on top of an attack like this and if we assume that Lazarus knows it means that we have to know too and knowing ahead of time is what we've been trying to make possible uh we've been trying to put up solutions with some of the doubts that we are working with uh this work has been

mostly funded by unis swap foundation and ENS now uh to try to start making ways for people to know those things I'm going to show are all public and free to use uh if you're interested into keeping an eye on that feel free to go for it the first one is a system to evaluate economic and systemic risks so we have security stages as risk areas and we're mapping that on a dashboard that we're indexing the data ourselves so we don't have to trust anyone on the way oopsie this is buggy uh notification system so you can keep track of different uh changes in in voting power, keeping track of your delegate if they're not voting because we see that delegates that are unactive are one of the main issues, but also the

people that keep their delegation with people who are unactive. So just making sure people know when they can change it and designing new incentive systems so we can bring people bringh holders to care on governance again to delegate again. uh it's we know it's kind of unfair to ask people to say like hey leave your money here not making any profit so we can keep this thing safe. So there are ways that should be explored how around how we can incentivize uh this type of action. Basically it's dangerous out there uh in governance. The idea is to make this anti-capture framework so we can all apply it on different spaces. Again this is an invitation to join and collaborate. We're really looking forward to expand this now beyond the

models we look. We want to be able to look at Lido, a sky that are the three main ones that we are not being able to cover because of the changes of models. We want to make something that is standardized and can be replicated. So, it's taking our time to get to there. But we're already mapping compound uh and unis swap mostly and TVL. Those are the ones that matter the most that we're looking. Uh basically, yeah, we're looking at a few dials in a few different ways to with the goal of making it legible and making things that you need to look in a contract easier to see and track and finding the risks before they're critical. seeing like how for example if there's a big change on how the money from centraliz the supply on centralized exchanges drops a lot and

delegated supply goes up fast that is a good signal you should pay attention to what the happening that's it governance was never easy uh and quoting from the trustless manifesto we choose to build trustless systems even when it's harder uh we hope other people do too and that's it thank you for your attention AMAZING [applause]