DAO Vulnerabilities & Resilience

Transcript

check check all right cool this is working awesome so thank you so much for coming post lunch break my name is kelsey nabon i'm a researcher at rmit university in australia i also do work leading the governance research team at block science a complex systems r d firm that's distributed but kind of based in the u.s and today i want to talk about dow vulnerabilities so this is a mapping methodology that's come out of my phd research but is being practically applied in the space by myself and some of the teams i work with as well as others so i'll try and break it down i'll see how i go for a time but if

you have a question i'm definitely available afterwards to have any conversations so the topic of my research is on resilience in decentralized systems and i'm a social scientist so i'm really interested in the social outcomes of these technologies so not just the technical dynamics of cyber security but you know what happens when people use these tools and do they help us to adapt and transform in response to crisis or changes in environment so that's kind of my working definition and that's taken out of the literature and resilience in socio-technical systems and so this is just one figure that's off a blog post so you can find some of

the things i'm speaking about today in in more detail but really what i had to do to be able to begin to analyze resilience in decentralized infrastructures was to come up with models for assessment and analysis and so this is one of those where i'm starting to break down a what is its purpose or objective what is the animating purpose that this organization exists for who are the stakeholders involved what are their threats so uh as an ethnographer i'm interested in the perspectives of the community themselves rather than overlaying my own perspective necessarily so what are the threats that the different stakeholders perceive

and then what are the vulnerabilities of each stakeholder and that comes from work out of science and technology studies where the point of identifying vulnerabilities is to thus address those as an opportunity to enhance resilience so that's what i'm trying to do when evaluating dows and maybe a way that you can think about how this might apply to your own project as well we then move from the analysis to the action space so at multiple scales of a decentralized organization how do you start to think about the responses to the threats that have been identified or the vulnerabilities and that can be be looked at from two perspectives so if you're thinking about

assessing vulnerabilities in your own dao or a dao that you participate in you might want to think about ways to address those as a researcher with my kind of ethnographic hat on i'm thinking about what is the community doing to adapt so what are the novel or interesting ways that dows are actually responding to their own changing environments and i found various different interesting things from you know the way that dao is organized so using subsidiarity or kind of multiple working groups or this breakdown into kind of sub-dials and core working groups or stewards or whatever they're called across different projects um to many other things around

you know the governance of algorithmic pipelines so how do you actually govern algorithms in a sustainable way to use those as tools to help you address or flag threats and then the feedback loops so how do you kind of communicate these findings either more broadly as a researcher or within your own organization to create kind of closed loops around this analysis and assessment so here's another map just another way of looking at some of the same methodology but out of a different uh blog post on my substack

and this looks at the multiple systems um that i've mentioned so uh there's a really great paper called introduction to cryptoeconomics that talks about uh these systems as uh multi-scale uh so the micro level the meso the organizational and then the macro so the whole of dao ecosystem i also have break and broken it down here into endogenous threats so what what emerges from within the dow itself that might be a vulnerability and exogenous so what's coming from outside that could be perceived as a threat and potentially turned into an opportunity and so i wanted to emphasize also what

this methodology is not i've seen the language pop up which is amazing if people want to use this idea or adapt it or apply it or whatever but what it what it's not it's not critical study of daos it's not saying you know does are bad because they're too technically focused or they're plutocratic or whatever it's actually about uh an analysis an organizational analysis so what is going on what are the dynamics that are happening within this uh within this organization or this this system uh it's not fully comprehensive so in the next slide i'll talk about some of the different um buckets where we can identify vulnerabilities it's not a fully comprehensive technical

or illegal or other analysis but it's one tool in a toolkit it's also not an endpoint so an area of research i'm really interested in at the moment is how do you better begin to assess your action space so if you want to develop interventions or policy responses to vulnerabilities that you've identified in a distributed way amongst your community how do you actually begin to do that so in practice and the reference here is actually to a blog post with a very detailed analysis which was done quite rapidly of lido so in response to the dao vulnerabilities post

the cto actually reached out and said this would be really helpful it's great for the community for them to see that we're kind of critically assessing our own dao and governance design across different spectrums and so these are some of the things that we learned from that analysis and this one was done in conjunction with the research team at block science so social vulnerabilities that emerged from a methodology which included conversations with people digital ethnography which is like a observation analysis of online channels so social media channels internal communication channels documentation from the forums and so on so

we found that some critical functions were person dependent instead of function dependent so when you have a crisis such as a massive shift in token price which changes the balance in all the liquidity pools it can't be reliant on the right person knowing the right thing to do which is like messaging someone else on telegram to tell them whether to communicate that publicly to the dow or not that has to be process oriented and a function and if the right you know head of something is on leave there's a organizational bucket for for that to be filled anyway um technical shout out to my colleague barada who did a lot of this analysis looking at governance voting interfaces so finding

some really really interesting things about how you could potentially co-op uh co-op a web address um and actually compromise the voting interfaces that that the dao was using uh economics so we were talking about liquid staking for this specific analysis and so the ways in which um liquid staking could become kind of like a curve wars or this like winner takes all market that that ratchets up and actually that has sort of semi-unfolded uh in the community since this analysis was done uh by something uh by an analysis by someone called sasha who um was also engaged by the dow to look at some of the kind of effects of lido on

the broader ethereum ecosystem and whether the dow should limit themselves or not and they recently voted not to which is quite interesting thinking about incentives and incentive alignments in the consensus of ethereum and then legal so legal emerged which i ended up adding back to the original methodology around some daos not being registered entities so obviously it's a massive risk in terms of liability to the founders and participants in any dow um they chose not to register but then and there's uncertainty around uh the future of the kind of organizational structure who owns specific ip so lido has a first mover advantage on the liquid staking

market but could someone copycat them um could someone who owns the registered domains are they registered to individuals which creates kind of um a lack of redundancy and so on so that's a bit of an example of of this methodology in practice and so really my findings here are kind of threefold that i've pointed out so one vulnerability identification across the kind of socio technical economic legal and let me know if you come up with other dynamics as an analysis tool both to analyze dao's kind of externally looking in and create kind of a communication feedback

loop as well as for daos themselves to start to think more reflectively about their own kind of governance practices and organizational structures and how they might actually build in uh greater adaptivity in line with their purpose to become more resilient organizations um the identification of these and then as i mentioned before like how they how you might actually begin to assess uh the relevant interventions to these vulnerabilities and rank them in terms of um priority of importance as well and then more broadly this kind of assessment of some of the organizational and governance dynamics is starting to foreground the social

dynamics of daos and so looking at the institutional infrastructure that coincides with these technical infrastructures and so that's one of the broader kind of findings out of my research across case studies in in quite different areas when evaluating resilience is really around what are the kind of institutional infrastructure so the ways of organizing and the processes that need to work alongside you know great technology to actually make it viable in practice and so i have many writings on that if you're interested in ipfs in open hardware and metaverse things there's some other kind of major case

study areas for me alongside daos so thank you [Applause] i have three minutes left if anyone would like to ask a question otherwise i'll move to the side for the next speaker and be available after this yeah i didn't think i'd have a question but i actually do um yeah so with um like governance as we have it now like regular voting it's obviously um you know there's less engagement and it's harder to do dows i think are great in that they bring that closer they can be more frequent people can vote more often and have that

but we still have governance tokens separate from the product tokens do you think we'll ever progress to a point where governance becomes an intrinsic part of some product in a sense where it becomes part of the mechanisms um in a more uh connected way um or i'm just sort of just wondering if that's everything that could could come to be i'm curious how you would conceive of or articulate your understanding of governance in some of the research and the writing i've done part of that was with zargham from block science credit where credit stu we talk about governance as the kind of ability to steer the system so anything that is part of steering that system towards its sort of shared purpose

and so i think it's really important just to point out that it's broader than the token distribution or voting with the token and it's kind of uh you know governance can be enacted in a bunch of different ways in terms of setting you know the boundaries of of how you uh influence and and steer an entire system so is that implicit in the technical infrastructure yeah i guess as an example let's say there's some threshold for some activity and governance would be uh to say that that threshold will be changed um would it ever be the case that the use of the system and if people are leaning a certain way with the number you would then shift that threshold incrementally

anyway based on the use and so the action of using the product becomes the votes if you will like an adaptive system yeah there's really interesting um dynamic mechanisms around that i'm actually writing a paper at the moment on signaling systems which was going to look at conviction voting which was something developed out of block science um the way that one hive integrates that is dynamic to pass proposals so based on the conviction by the community they're they're staking and depending on how much money is in the treasury that's easier or harder to pass um as alongside the um the conviction against it

i've written about this in in two papers and then i'm doing the signaling one so happy to discuss that more but yes and i hope things go more in that direction getting i'm getting this you