S.10 Ep.11 $170M to Fix Ethereum Security (After Another Major Hack) | Griff Green

Transcript

Welcome to the greenpill.network podcast. We are exploring how technology, community, and new forms of coordination can build, fund, and accelerate what matters in the 21st century. We are talking to builders, thinkers, and innovators who are pushing the edges of what's possible from on-chain capital allocation to Ethereum to AI alignment to a reimagining markets and governance. If you want to learn more, visit our website at greenpill.network where you can download the greenpill books for free, play with some of our projects, or join the Telegram, or participate in the network. All right, today I have Griff Green who is coming on the show to talk about the DAO Security Fund, the dao.fund, new public goods funding initiative that is all about Ethereum's security. Uh security is obviously one of the big public goods of blockchain

networks, and Griff is just really passionate about exporting more security to the Ethereum space and working with top people in the Ethereum space on making sure that it's a secure blockchain ecosystem. Griff's an OG. He's the co-founder of Giveth, one of the earliest and most persistent builders of crypto-native public goods funding. I look at him as a mentor. We rap. Uh I think this is probably his fourth or fifth time on the greenpill podcast, and uh I think it's just really a pleasure to talk to Griff and to riff about how we're going to be turning this coordination theory into actual on-chain impact with the dao.fund. So, without further ado, enjoy Griff Green. Hey Griff, what's up?

GM GM. Good to see you, Owocki. Likewise. Well, we're here to talk about the dao.fund. So, you want to remind us what that is and what you've been up to? Sure. Yeah, so uh the DAO is an old project from back in the day, uh my original project, and it was had like this catastrophic hack in 2016 where the hacker stole like $50 million, and the DAO at the time was the largest crowdfund that ever happened. And so, it had 14% of all ETH in existence in it. And uh you know, we recovered from the hack, Ether Classic emerged, like that's a whole story in itself. But, fast forward 10 years, given AI risk and like old contracts just not being feeling safe

enough, we actually had to move some of the funds that were still in recovery mode, uh and we decided to stake them and use the revenue from staking these old leftover funds uh were that are still claimable by the original people who could claim it. Um we're we're using the revenue from staking to actually fund Ethereum security. And uh and so, the DAO Security Fund is uh me, Taylor Monahan, Jordi Baylina, Vitalik, uh Alex Van de Sande, uh Lansky, and PC from Seal 911, founder of Seal 911. So, uh the seven of us are on a multi-sig that kind of decide uh the high level of how to spend these funds, but we're

doing it from a DAO-style approach, which I think is really fun and I'm very much inspired by Gitcoin. Uh we're doing these rounds where it is uh you know, there's different like our first round is a quadratic funding round, but then in a few months we'll do another round that will be a different DAO tooling, and um and we'll have different DAO experiments every quarter, basically, give or take, uh funding Ethereum security every time. Great. Well, the integration that I want to do here is that security is a public good for all blockchain users. Um And uh I think what's incredible is that there's 74,000 ETH, which is roughly $172 million at current prices for

Ethereum security. Uh I think that's the staked principal amount, and so the yield will be on the order, if I'm doing my math correctly, about 5 mil per year. And so, I'm excited to see what you can do to increase the security of the Ethereum ecosystem, especially with Mythos out and all of these hacks that have happened in the last 48 hours, it feels like, boy, just in time. So, um yeah, did I get those numbers right first off? Yeah, yeah. I mean, it's effectively we're earning 4 ETH a day. So, 5 mil right now, hopefully more, hopefully not less than 5 mil. You know, it is about 5 mil, but it's really dependent on the price of ETH, so you know, if ETH goes up, we have more money for security. If ETH goes down, we have less.

Right. Yeah, there's a reflexive cycle there where you make the system more secure and more valuable, and so it you have more money and it becomes more secure and valuable. So, uh I think there could be an upward spiral there for sure. I hope so. I hope so. >> Yeah. Well, I I want to get more into the DAO fund, but before we do that, maybe we could do some context setting over the last 48 to 72 hours, there's been a rash of hacks in the Ethereum ecosystem, but also in Web2. I think I saw Vercel and and Lovable got compromised, and then there's also this Aave uh KelpDAO Layer Zero situation.

And um you know, I'm wondering if we can paint with a broad brush the situation we're in. Are we in a a new era when it comes to security? And then I really want to get into details about this Arbitrum decision that it sounds like you were a part of, and uh how DeFi is going to be secured in the future. So, yeah, uh paint us a picture of the of the world we're in from a security perspective right now. I mean, it feels like a mess, and it's not just Web3. I mean, Web3 it's very obvious because there's a dollar sign behind all these hacks, but there's just countless hacks all over the place. Like you said, Vercel and and um you know, but I think it's also understated and it doesn't make the news how many white hat solutions there are also coming through.

So, it's kind of like a an AI race between the white hats and the black hats. Part of the DAO fund, one of the things we're doing is we're collecting all the top security experts in Ethereum and putting them all in a chat room, right? And we already we're about halfway through. I'll actually announce the rest probably tomorrow when this uh uh podcast goes out, we'll have the final uh 100 uh that we're adding to the group. But anyway, so I have this token-gated chat room for just the top Ethereum security experts. And like these guys are already they're all using AI. Uh not all of them, but a lot of them are using AI, and they're not attacking crypto stuff trying to find vulnerabilities. They're trying to

find vulnerabilities in TypeScript, you know, in JavaScript, in in React, and they're finding them, and they're reporting them. And so, the the exploits we hear about, but honestly, I think that it's um I don't think it's as as as as grim as it looks because there's also all these teams are making crazy updates all the time. I don't know if you noticed, but like I have to update soft like critical software like almost every day it feels like. And I think that's because, you know, behind the scenes, what we don't see is everyone is leveling up their security. And that you know, it's it's a race, but I think uh there are more good guys and then bad. And

especially having Mythos and uh and Claude um re re like slowly releasing AI and doing it in a very responsible way, I think we're going to be way better off uh like in in the next, you know, over the next 6 months. You know, over the next 6 months. Little transition period, still a little scary. There's a lot of legacy code out there. So, It feels like it's short-term bearish and medium- and long-term bullish. Uh and in the end, we're going to have these systems that are almost formally verified because they're so Lindy, they've been out there uh for so long.

Yes, absolutely. And I think even formal verification all of a sudden becomes reasonable for a lot of this like very important tooling. So, I had a I had a take today, and I just wanted to run it by you to get your feedback. So, the Lindyness of a system is the idea that however long something survived, the longer it's likely to keep surviving. Uh like Bitcoin is super Lindy because, you know, it's been around for the longest. And um I think that my like my hot take is that Mythos, the Claude model, taught us that Lindy doesn't accrue evenly over time. Pre-AI, each year added a little bit of Lindyness, but post-Mythos when AI can hack, test, and iterate on everything, time gets denser, and so Lindyness accrues faster uh post-Mythos and post-AI. Would you agree with that

take or disagree, and where would you disagree? I would definitely agree for the most part. I mean, I think there is a versus there is a a level of like probably an anti-pattern there, too, that is like kind of fighting against Lindyness if you don't update enough. Like Bitcoin's super Lindy, but the quantum threat is also real. So, there's a little bit of a Lindy isn't the is one dimension of of a multi-dimensional system that you also have to account for like, are people actively maintaining it? You know?

Um >> [laughter] >> because >> there's Bitcoin which never upgrades, and then there's projects that upgrade all the time because they're centralized, and the real way to go is a middle path between those two things is what Mythos and quantum have have maybe taught us. Absolutely. I mean, you can't techni- technological um you know, like um progress is guaranteed. So, we're going to have to continue to mitigate whatever new ideas come up with the new technology that occurs. So, Okay, well, I want to get into it. You were on the Arbitrum Security Council, and you guys hacked Kim Kim Jong-un from North Korea.

Tell me about that. Let's get into it. I know. It's so great. I mean, it's like I I you know, I had a hot take on Twitter. I was like, Kim Jong-un has been nuking our portfolio forever to fund his nuclear program, you know? So, like finally, we can actually strike back. I mean, it was it's a really rare thing, and and honestly, it it almost I can't believe that it happened. Uh and I wish I could say we could do this a lot, but it's really a rare circumstance where um we were actually able to hack North Korea. Uh or I mean, it wasn't really a hack, but we were able to uh you know, actually take their funds from them and freeze them. So, So, so

just the facts, what I understand to have happened is that uh KelpDAO was hacked on the layer zero bridge and that created a bunch of systemic risk in DeFi because the Aave pools or other pools that relied on KelpDAO ETH uh were imbalanced. North Korea is suspected to be the attacker and the funds that they had on Arbitrum, which were about $70 million, were revoked by the Arbitrum Security Council. That's just the facts that I'm aware of. Did I get that right? Pretty much. Yeah, I mean I think I can give a little more uh color there. It was like um rseth is a collateralized like EigenLayer staked ETH version that KelpDAO manages. They have uh uh most of

their money is sitting on Ethereum, but about 18% 18.5% of it were scattered across various L2s using layer zero bridge. And a hacker which almost certainly is North Korea. There's a lot of um behind the scenes evidence for that. Uh even talking we talked with legal law enforcement and lots of people that they're very certain it's North Korea, although it's hard to disclose this evidence pub- publicly. And uh so what North Korea did is they were able to kind of hack a validator and uh and and convince it to take all the money that was in all the bridges and send it to them on Ethereum mainnet.

And so when they had all this rseth, they're like, how do we get the most money out of it? And uh Aave had the best liquidity opportunities. So they bridged it so they uh maxed out the liquidity that they could on mainnet and then they bridged a bunch to Arbitrum and also maxed out the li- liquidity in um uh on Aave in Arbitrum. And so the interesting thing here is that the rseth was actually bridged from mainnet by North Korea onto Arbitrum. So that rseth on Arbitrum is actually collateralized by the mainnet ether directly. So unlike all the other L2s uh that are kind of

out of luck, all the people who had rseth on those L2s that rseth that was supposed to be on on the mainnet side collateralizing them is gone, right? So they have these tokens that don't have collateral. The rseth on Arbitrum actually was collateralized. And so uh so it's kind of a a weird situation. And uh when North Korea had all that ether that they pulled out of uh Aave by taking a loan against the rseth, they um just let it sit there. And this is very uncommon. It's so uncommon that a lot of people question if it is North Korea cuz usually second North Korea gets the ether, they actually try to uh you know,

circle cy- cycle through the ether. They move it. They launder it right away. To prevent us from doing what we did, right? So there is some question, is this really North Korea? But um the theories the theories are that like they just were working really hard on this hack and they had other hacks that they were trying after they succeeded with uh KelpDAO. There was actually systemic risk uh throughout DeFi. Uh almost all the layer zero bridges shut down because they were worried about this exploit being thing and so the the the working theory is and then there's a lot more details here, but that North Korea was still trying to exploit the other layer zero bridges and then they were working so hard. Maybe

they just needed a day off. >> [laughter] >> They didn't Like I mean, who really knows? They're still humans back there. Sure they're powered by AI, but you know, the AI is still the humans is still running the show. So this is what makes this a very unlikely scenario to ever be repeatable because it's very rare that the hackers just kind of leave money sitting in one spot. In this case for two days they left it sitting in this one address. You're speed running these deliberations. Like this is decentralized governance on steroids. How many calls did you have over the deliberations? Like I mean, this is not a decision to take lightly, but you also had to act fast. That Yeah, there's a there's a precedent setting here and and I'm really excited to see uh how the

precedent is set for other DeFi projects in layer twos. Yeah, I mean I can't speak directly to any of the deliberations cuz it's supposed to be all confidential. Uh I can tell you what I thought and I can tell you like the high level uh situation, which is uh there's a 9 of 12 uh security council of which I was elected to along with uh 11 other members. And uh we basically have the same power as the Arbitrum DAO has to upgrade the protocol in whatever way it needs to be upgraded. The only difference between Arbitrum DAO and their voting like upgrades and ours is that we have emergency powers.

There's certain things that have time locks and things like that that we can circumvent. So this is one of those uh situations where we were able to use our emergency powers. And we're only supposed to use our emergency powers to uphold the Constitution, the Arbitrum Constitution. And uh in this situation with North with it almost certainly to be North Korea, $70 million uh really uh which is a huge amount of money that that are are other people's users' funds and this whole situation with the like the contagion in DeFi, it it really each one of at least nine of the security council members uh agreed that

this was the right thing to do. And uh >> getting uh So uh people who've listened to our episodes before know that you were a part of the white hat group which recovered the funds from the original DAO hack and this feels like a little bit of a fractal uh of that to me. Do you Are you getting flashbacks when you were in in the deliberations? 100%. It's actually incredibly similar. And uh you know, I will say so the white hat group we rescued the DAO, uh we rescued the Parity multisig hack, which was the largest one we did, $200 million. $70 million, this is the third largest recovery effort I've ever done. Uh although we did a lot of smaller ICOs back in the day, too. This is like 2017-2018, the white hat group was effectively what SEAL 911 is today. Kind

of the behind the scenes people you call when something goes wrong. So 2017, we're mostly helping ICOs and lots of them much smaller than $70 million would mess up and we'd help fix them. And so we did a I've done a lot of these recovery efforts, actually. And uh I think the biggest lesson, which no one we're not there yet because everyone's still like, "Yeah, we we Kim Jong Un, you know?" Um but the the saving rescuing the money is always the easiest part. It's distributing the money back to the users.

That's where things get really messy, really complicated. Everyone's got different opinions and like that's the hardest part. So you know, we're not through the yet, basically. You know like we have uh we have a long ways to go and it's definitely having flashbacks, especially with the white hat group ETC rescue. So when the hard fork happens for Ethereum, you know, 14% of all ether in in existence was in the DAO. Uh the hacker took a third of it and we took the other the other well, it was more like 30% 70%. So we had effectively 10% of all ether Ethereum, like the market cap of Ethereum in our in our control at one point. And then when the hard fork

happened, it took it away from us, but we still had it on ETC. So we had 10% of all ETC in existence. And at the time, you know, this was before Bitcoin Cash. This was before these hard forks were really understood how they would work. We didn't think Ether Classic would be worth anything. It was kind of mind-boggling that it was. And so we made a crazy decision and it was a wrong decision. Um but we decided to try to sell the ETC. And there was no DEXs at the time. This is 2016, okay? Like we couldn't go to Uniswap. So we went to centralized exchanges, uh Poloniex, Kraken, Bittrex and a couple others and

and we actually started selling ETC. But then uh Polo froze us and Kraken froze us and they're like, "No, you can't do that. You know, who is this? Are you hackers? Like what's going on?" And so uh so then we're in a predicament and we learned first off, you got to give users uh back the assets in the form that they gave it. You know, we were planning on giving them ether back uh but instead, that was the wrong decision. We needed to give them back the ETC. And and there are lots of reasons for that decision, but you can read old blog posts. Uh but what's especially relevant to today is there were three parties that all had to come to decision about how we're going to give them money back.

So there's Poloniex, Kraken and the white hat group. And all of us were holding these this ETC uh separately. And we but we had to dis- figure out like how are we going to agree to give it all We all wanted to give it back to the users. We all had to come to an agreement on how to do that. So we ended up drawing contracts up where uh that would return to money to the users in a way where everyone could deposit it at their own leisure and users could claim, right? And that was how we came to a consensus with working with them uh where it makes sense. We can refund the users, give the money back to the

DAO token holders and Polo doesn't have to trust us and Kraken doesn't have to trust us. They can deposit it straight back into the contract. And I think we're going to run into a similar situation here Because Arbitrum DAO I mean we on on the technical side what happened was that, you know, the North Korea the hackers had I mean almost certainly it was North Korea, but the hackers had the money in an address. We used a kind of a little hack to upgrade the layer one layer two bridge to just let us say that we were them depositing in it into the bridge. But well, say we basically used like a forced inclusion

in a way. It's like this inbox thing. I don't know how to explain it without getting too technical, but we told we told the Arbitrum network to say, "Hey, pretend we are them. We're moving the money to 0x DAO, you know, 0x DA0, and which no one has a key to. And and so we did that really quickly and boom, now the money's over there. And so now we have Arbitrum governance. Arbitrum governance can do something with that money.

But you know, this is a little more complicated because the white hat group was like really four people. And you know, Kraken and Polo have CEOs, right? And so you know, the two CEOs and the four guys in the white hat group were all able to kind of make a decision and say this is how we're going to distribute funds. Now we have three DAOs involved. We have Aave DAO, Kelp DAO, and Arbitrum DAO. And Arbitrum DAO holds $70 million. We're kind of like Kraken or Polo in this situation.

And then you know, Aave and Kelp they both have a large set of users with different needs. So now these three DAOs need to decide together how is the $70 million going to get distributed to their users. Also Kelp DAO still has you know, most like all of their RS ETH is technically still collateralized. So they have all this ETH, you know, $200 $300 million worth of ETH sitting in their No, it's more than that. It's almost a billion dollars worth of ETH I think sitting on on mainnet. And so this $70 million goes into that batch and how are we going to return the money to the users? How are Aave has all their users

that you know, have deposits that were basically withdrawn with RS ETH collateral. How are they going to be relieved? It's just kind of it's a huge mess. It feels I mean you said this earlier, but it feels like the thing that you went through with the white hat group which was four people, but with four DAOs and it's going to be much more complicated of a political situation because of that. I mean it's hard enough to come to a decision within one DAO. Now three DAOs I've heard. Yeah, into one into one answer they have to work together to get one decision.

Like oh my god. This is a mass comment. The the people haven't seen that this this train is approaching. I'm um you know, I'm curious to zoom back out. We started the episode talking about the DAO DAO fund which is about ETH security and then the most recent ETH security that happened. And you know, I'm wondering if we could swing back a little bit towards the DAO DAO fund and the prompt that I have to start is you know, you've got 10 years a decade of experience in ETH security and now you have this sort of nest egg that you can use to get us out of this cat and mouse game and like massively uh accelerate the defensive portions of Ethereum security. So you know, how do you even start to think

about doing the capital allocation there? I mean obviously you're going to start with the QF round that I think you're try trying to create like flush out all the good projects so you at least have them on your radar, but Exactly. Tell us tell us about the DAO fund and what you got cooking there and then and then maybe we'll weave into the the QF round which is the most immediate action item from there. Yeah, I mean it's a massive amount of capital and the question is how do we spend it in a great way? And you know, there for me the DAO the DAO security fund has two main goals. The primary goal fund Ethereum security. Like I I know we today we have the technology in the crypto space to make Ethereum safer than PayPal.

It is not. It is nowhere near safe as PayPal even though we have the tech to do it. And so I really want to accelerate that bring us there faster. And that's our primary mission. Our secondary mission is to support the DAO space. I'm a you know, my mission my I have not changed. I've I came into the Ethereum space in 2015 and I came into crypto in 2013. And ever since I got here my mission has been the same as always. I I believe we can build something better than governments. And so that's what excites me about this space. We can we can we can actually start you know, engaging people and make decisions from the bottom up as opposed

to top-down coordination especially around public goods because that's what governments are mostly managing. And what's the number one public good that every government leans on for for like their justification of legitimacy? Security. Nation state governance, police, you know, all these things like um there and and there's a really good reason for that. Public goods like security scales has economic of economics of scale beyond almost any public good. It's a lot it's it's way more expensive for every individual to secure their home and secure their space than it is to build a whole city-wide solution for

everybody, right? Security scales so well. It's the same in the Ethereum space. Security scales so well. You know, if if right now we're kind of in that situation where everyone in Ethereum is protecting their own house. Maybe it's more for some people it's like a serfdom or feudalism, you know, where they have walls around Uniswap, right? There's a lot lot going on within Uniswap. But they're securing themselves. I think that we could actually all spend a lot less money on security and be more secure if we can coordinate.

And so besides the DAO security fund doing a lot of funding, right? And that's like that's kind of the the showing point for us to matter. We have $150 million. You have to care about us, right? I mean 70 today. So we matter. But I think more impact is going to happen through coordination. That's and that's really the direction I'm trying to push the DAO security fund and and we've only been live since February. And I think we've actually made huge strides.

I guess we launched Yeah, I mean we kind of launched in around January, February. So yeah, we we we actually like I said before we have the ETH security badges where we got the top 200 experts in Ethereum security ranging everything, you know, it's not just smart contract security. It's threat monitoring, it's academic research, it's like obviously there is a lot of smart contract security and auditors, but then you also have this incidents response, the white hats, the the like legal researchers. There's there's you know, wallet UX. There's so many important pieces of Ethereum security and we got them all there in

one room. The top of the top guys. I don't know why they all decided to fill out my form, but somehow I tricked them into it and now they're all in a chat room talking to each other. And I think this coordination we can start to from there and actually work on larger scale solutions that help everyone a lot. Yeah. I mean I'm I'm pilled on this idea that we can make security a public good as opposed to something you need to build around your own house. And I agree there's economies of scale there. What I think is interesting is you've kind of dressed up this public good ethos that we both share in something that's the most immediate existential risk that it matters to all Ethereans. And I think when people hear regen and public goods

they're like oh those those hippies. But when they hear security it becomes like very activates a safer punk core value even though it's it's still just different ways of looking at the same thing. So from both angles I think it's elegant. I mean you you you showed me the way, man. I'm not going to lie. Like you did a great job with open source funding open source. You know, ETH was always like we're going to fund nonprofits. We're going to fund nonprofits. Yeah, less urgency there. Yeah. through traction, you know? Yeah, I think nonprofits in crypto are probably like oil and water and you've done the most to integrate them. Yeah, exactly. I mean I've tried, but you know, the reason that I keep going back to security is because you wouldn't believe how many nonprofits I've seen lose their money in crypto in every way

you can imagine, you know, sending money to the >> yeah. Yeah, sending money to the right address on the wrong chain, sending like you know, getting fished of course, getting hacked like through smart contract hacks. It's like it's really it's clear that it's not safe for normal people in crypto. Like I feel like there's this weird balance where all the uber nerds they're like this is so secure, you know? But it's not safe. It's like it's like building a one lane road on the side of the cliff and like dude, it's reinforced. It'll never fall.

There could be crazy earthquakes, the road will still be there. But it's a one lane road and two cars coming there's no guardrail. You know, it's like uh Yes, it's a great road. It will get us there. Uh it's not safe. And I think we can fix that. And and really to do everything I want to do to build something better than governments, we have to fix it cuz we need normal people using this stuff. So Um yeah and what what what I want to say is that what you did with open source, a lot of people don't think of open source as public goods. It's like the words public goods are like this weird magical the incantation that makes people look away.

>> [laughter] >> Yeah. Or project whatever they're feeling on on the word. But everyone loves open source. Everyone loves Ethereum security. We're not going to mention public goods anywhere. I I think that you know, when you're talking about something that's abstract like public goods, people can project their own traumas and beliefs upon it. Whereas security is very object level, it's very easy to nail down oh security keeps my bags out of the hands of hackers. And and you know, I just think that there's a trade-off spectrum there. Yeah and and we talked about this before coalitional funding. Like staying focused on a on a niche is just like a gray strategy.

Well, I'll have some news. Maybe you can invite me on your podcast and I'll have some news about Gitcoin's next steps at some point. But for now, let's focus on the the the Giveth QF round. It sounds like it's the largest QF round that's ever been run on Giveth and it's Give me all the all the specs. Give me all the dates. Give me the call to action. How can I apply if I'm working on E security? Yeah. So it starts on Thursday, which if this podcast comes out on Wednesday, it's tomorrow. And and you can still apply even though the round has started. If you know of anyone with a security project that is providing some kind of public benefit and has provided public benefit in the past, then it can apply for the round. So public benefit could

be open source code that's been around for more than a month. A lot of people have just been kind of spinning up and open sourcing things that they've been doing. Which is really cool and I love it, but it didn't qualify for the round. So I feel really bad for those guys. Also needs to be security focused. A lot of great privacy projects have applied. We couldn't let them in the round. I think you know this better than most that if you have really strong eligibility criteria, it just makes the whole round better. And we've been really sticklers about enforcing the eligibility. There's a lot of gray area there and we're doing our best. So I you know, it's impossible to be perfect, but I think we're doing a pretty good job.

And yeah. And so then we the round starts on Thursday. It's a three-week-long round instead of two weeks as normal. So you will have extra time and I believe applications are going to close on the 20 on the 30th on the 30th. So you have to get your application in within a week of the round starting. And yeah. And then also we have this really cool mechanism with we're doing experiments to improve quadratic funding. So there's one of the things with the DAO security fund that I I really want to push is that you can't just come in and distribute funds

for us without somehow like up-leveling the DAO space. So what we're doing with this round is we have expertise is getting extra weight. So the DAO is actually going to airdrop to every badge holder these 200 security experts. They're going to get a special voting NFT. About $100 worth of money to donate and an anonymous an anonymous ETH so that they can distribute the funds without anyone having the politics of public donations. Like I think that was one challenge that we often saw is you know, you want to donate to your friends

even though maybe you don't believe that they're the best project to support. So for the experts, we're trying to avoid as much politics as possible. We're also not making them use their own money. We're giving them all $100. And if they add extra money into that wallet, every dollar that they donate is kind of tuned up. Every dollar that they donate is worth $4 in distributing the matching pool. So they these 200 experts have more influence than a normal person, but not so much more influence that like normal donations don't matter. It's kind of this nice balance. Like I think they'll probably be able to distribute maybe 20 to 25% of the pool based off their voting.

Which you know, by up-leveling it, like that's that's a good thing. And maybe we'll also be able to generate more funds like by saying hey, you could send money tell ask your trusted friend where you know, what their address is and like have them and send money to them and they can donate and have extra influence in the round. And that might even get random people who are don't really know what they're doing. Like they might be able to delegate effectively to the security experts. It's a it's a big experiment. There isn't like a formalization of a strategy for every expert to do. I'm just I'm really going to watch to see how it plays out, but I think it's really cool to have this kind of like

this group of experts in the round with extra influence and free money to actually participate. So it's it's it's going to be a a cool QF experiment. Was this um uh there in the token engineering commons, I remember towards the end of Gitcoin's QF era that there was like an expert weighted QF that was being worked on. It sounds a lot similar to that. I'm Is it the same group of people? Same group of ideas? I was I was definitely involved in the token engineering. We called it tunable QF. >> Tunable, yeah, that's right. Yeah. Yeah and and the way we did it with token engineering commons was that it was like the TEC tokens and people who had NFTs from the token engineering academy.

They had extra influence. And what's cool is we're getting rid of the tokens, the the economic side and it's one NFT one vote. Like everyone has the same voting power. So there's 200 experts with all the same voting power. And we're taking the lessons from that, right? Making these guilt tripping these people into putting their own money in because they have extra influence is not the best. That's why we're airdropping the money. So it really is kind of a step-wise improvement on what we did in the past.

Beautiful. I think that the main I have a question for you though off of what you said. So cuz I I know that Gitcoin has had larger rounds like more than a million dollar round. But have has there ever been a Gitcoin matching pool with a million dollars in it? Um I think all the matching pools I saw were like 300k stuff like around there. Yeah, so we've definitely had I mean so like first off like I'm supportive of Giveth and I think that I don't want to have like a QF matching pool contest with everyone.

They're definitely in the same range. Maybe offline I can send you some data and we can we can compare matching pool sizes. But I think that in spirit I'm supportive. You guys won on the round. You know, it's one of those things where like the Round to the sub round, yeah. I want to be able to market it to be like this is the largest matching pool ever, you know, and then like get people excited. Yeah, it's the definitely largest matching pool for the security fund. If you want to market it that way, I think you should. And we'll compare data off off off off screen. I got a couple lightning round questions for you if you don't mind. Yeah.

Well actually before I do that, let's let's just drop a quick call to action. So if you want to apply to the QF round, you go to the dao.fund. Is that right? Actually there will be a link for it coming up, but the best place to do it is go to the DAO fund on Twitter and you can find the links to the matching pool. To apply. It's basically qf.gitcoin.io/qf/apply. But >> [laughter] >> Rolls off the tongue. Exactly. So easy, right? >> Well, if you can't if you can't market the largest matching pool, you can you can market the longest domain.

Uh It's only like five six words. Come on. All right, lightning round. Is QF still So but the the the lightning round I'm going for is like 45 second to 60 second answers. So is QF still relevant in 2026? Absolutely. I I really believe quadratic funding has some challenges to overcome, but it's one of the few tooling pieces of tools or it's one of the few mechanisms that came out of the DAO space that actually surpasses Dunbar number and allows for hundreds of and thousands of people to actually aggregate their signals and come to an agreement in outcome that is fair. I think in crypto, we're actually doing it in a lot harder way. I remember when you

had the simple QF with credit cards. If I could find a government or someone who wanted to distribute money with credit cards and do a matching pool, civil would be solved. There'd be so many things that would be easier. And you know, when I look at governments and how they distribute funds, I think QF is a huge level up. Great. If you're maximally successful with the dao.fund, what does the world look like in 10 years? Ethereum becomes the safest place to get a mortgage on your house. Ethereum becomes the backbone of civil society.

That's for DAO for the DAO security fund to succeed, that's what I want to see. And we have the technology for that to be the case. The only difference between PayPal and a PayPal version on Ethereum is that there's no PayPal to steal your money. We can build everything they have. We can do it. We have all the tools and we can do it in a non-custodial way. So we can make it safer than any TradFi solution because we don't have the same custodial custodial problems.

We just aren't. And uh I think that I think that hopefully with the Dow Security Fund having a voice and coordinating everyone together, we can solve a lot of these safety issues uh and and actually make Ethereum the best place to you to to do everything in the world basically. >> It feels like Vitalik said that low-risk DeFi is Ethereum's biggest use case. And if you could have provably low-risk DeFi, then that would be the the the promise delivered there. So, basically unruggable low-risk DeFi could change the structure of how the financial system and loans happen.

100%. And and the biggest problem is that yes, smart contracts are secure. But and we spend so much money on smart contract security, but we're not spending money on the rest of the stack. Like this this RS ETH issue is really a risk analysis issue. They they went into economic risk and and if you look at Aave, there's all these like staked ETH derivatives that make it to Aave where there's a lot of tokens don't because oh well, it's ether, large market caps, it's not going to move much. There's less economic risk. But then Aave wasn't doing the risk analysis on what is their security setup? You know, they're not doing the technical audits themselves to validate that these tokens

were secure. And if they would have, they wouldn't have given RS ETH such a hard high collateral um opportunity. So, uh I think there's we're still, you know, very young. Uh Ethereum DeFi is what? Like 6 years old basically, maybe eight if you if you want to go way back. Uh it's it's it's really a young science and we're just learning lessons the hard way as as we have to. Great segue into my next question. There's been a lot of hacks this year in DeFi. What the heck is going on and are these going to keep happening at scale?

AI risk is serious. I I think that they will keep happening at scale. I think there's also been a lot of hacks that have been avoided that we didn't recognize that we haven't and we don't appreciate how many upgrades have happened because of uh good people using AI to protect uh the the system. However, I think we're still outmatched. The incentives for white hats don't really match against the incentives for black hats. And if we and and I think that's why we're seeing such an imbalance. If we could actually have a better incentive for white hats to uh you know, attack these systems and improve their security, then I think we would avoid a lot of this this challenge. But you know, it's a classic

quote, right? Show me the incentives and I'll show you the outcome. Right now, black hats, if they hack a protocol, they they they get $300 million. If a white hat does it, they get 50k or nothing sometimes, often. I mean, I just saw Blockful is like, you know, helping all these DAOs avoid governance attacks, which isn't sexy, but and it's hard for the DAOs to appreciate. But even Gitcoin is is is looking into that and being like, oh, we have to change our setup because there's governance risk.

And then people aren't paying them, you know? So, uh we we have to build a better culture around white hats. We need insurance solutions. We need things like this. And I think that will avoid this outcome. But otherwise, I think we are kind of stuck with it cuz the incentives are misaligned. What do you think the future of public goods funding is in the Ethereum space? So, 2026 and beyond, what's the future of public goods, regen, uh that that kind of space? I I I'm really stuck on the fact that the right now, crypto is an echo chamber because you have to have a certain it's not safe enough for normal users.

Normal people who have normal problems are not going to use MetaMask. They're not going to write down a 12-year word phrase. They're not going to like have non-custodial solutions as they are today. So, we have to adapt. We have to in my opinion, the regen space was ahead of its time. But it is the right idea and it is the right solution. So I'm short-term, medium-term, very bearish on us being able to address the needs of the people who want to solve regen problems cuz the crypto space doesn't want to solve regen problems. They don't care.

Uh but I'm long-term very bullish because in the end, the value the main thing that crypto can provide is the ability to create an economy around any value you're creating. And that is where the market failures of public goods can be solved. It's the only space I know that has any potential of actually addressing these market failures because nonprofits, public goods, they are valuable. They create value. And with this kind of tooling, with crypto-economic tooling, we can build economies around that value. So, long-term, very bullish.

Is there anything I didn't ask that you want to say? I mean, we could talk Arbitrum Security Council. Like there's a lot of precedents being set. There's a lot of weird things going on, you know? And like um it's a very spicy topic. So, you know, and we're in the thick of it. Yeah. So, what do you think it all How do you think it all plays out? Well, I I think that it's going to be an agreement between Arbitrum DAO, Kelt DAO, and Aave. And because the 70 million is still held by Arbitrum DAO, I think that it'll actually make the best solution for the users because it's going to have to be a very public

discussion. Not a backroom deal with Kelt CEO and Aave and Stani from Aave or whatever like kind of making these decisions. Uh it's going to have to be like something the DAO votes on, right? Uh that's the only way to move these funds. And that was very much by design. Uh so, it's it's very exciting to see this happen in my opinion because number one, you have the, you know, North Korea black eye, which just feels good. It just feels so good. I can't tell you. Like uh I was talking with Taylor and she was like, I'm literally crying right now. We've never done this to North Korea. She was Taylor Monahan. Like I mean, this has

been like blow after blow, North Korea for the last couple years has just been destroying us. And like, you know, they've stolen billions and billions of dollars. And to get a big left hook, you know, I guess it'd be like this. A big left hook on them and like a $70 million strike back, like uh it just I can't If anyone wants to clip this episode and make a meme of Griff right hooking Kim Jong-un, you're welcome to.

I mean, you're welcome. I'll take it. I'll take it. Uh man, I wish. Yeah, but then it's uh as far as how it all plays out, I I think that we're going to get a good solution where the RS ETH holders get at least some of their money back that they would have lost otherwise. But still, it's not going to be a happy outcome. And because it's not like all the money back, everyone's going to be pissed at the end of it. Still. Yeah, anything else you want to say before we wrap? Uh I guess I want to talk about the A lot of people on Twitter have been talking about the precedents that this sets with L2s and Arbitrum not being decentralized. And I really think it's overblown. And I'm especially, you know, when I look if

if you go and click people's names and you see how many followers they have, I mean, it is just like they have zero followers, most of them, you know? Of course, there are some with thousands and stuff. Some of the bots that have been around for a while. But I'll tell you, in the DAO days, you know, you just can't trust social media. In the DAO days, after the hack, three days, the Slack was fine. There was no issues. We were all coordinating and talking about how we're going to recover the funds and what we're going to do. And it was a really fast play-by-play and everything was good. And then all of a sudden, a switch was flipped and hundreds of bots and and and people came into the Slack and were just saying

all these horrible things. And I later found out that there's this thing called the Dragon's Den that a lot of prominent Bitcoiners use uh that were funding. They were putting money in to basically a socially attack altcoins on Reddit and in their Slacks and all this stuff. And so, they put in a bunch of money to get the DAO to make chaos in the DAO, right? Don't listen to the fudders. Look at people's accounts. Who follows these guys, right? There's all these comments that are saying this is a bad idea. But if you look, it's like one in 20 actual humans that you would have seen in the Twitter space say this wasn't the right thing to do. You know? And I think

that's I think that's just important for us to remember that like social media Did you see the new Superman? I just watched it on Netflix. I did. Yeah, it was uh Superman's one of my favorite childhood heroes. And to see him milled into a social media morass in the our more complicated 21st century, it was it was very strange. It was it was a it was a weird it was a weird movie. I'm not going to say it was good or bad. I I did enjoy it. But one part was like where Lex Luthor has all these monkeys, spoiler alert. Lex Luthor has all these monkeys that are like looking at the at the computers just like screaming and saying like Superman's idiot or whatever. I can't remember what they had like super super something that he

didn't like, but it was like you know, I feel like that is actual reality. You know, and so you have to you have to in this in the 21st century with like social media, we have to recognize that things are being manipulated and that the reality is with Arbitrum there is a security council and with most stage one L2s, there's a security council that has emergency actions. But we only acted in emergency and it's actually a really good thing. You know, and if you look at the security councils in the past and actions that they've made I can't point to a single one that I wouldn't totally agree with. It's

really there is a lot that I would say there's a lot of inaction that I wouldn't agree with. And uh but that's harder to point at. Uh it's really hard to get nine random people from all over the world who consider themselves security professionals with their reputation on the line to agree to doing something crazy. >> [laughter] >> Trust me, I worked really hard to help make this happen. It was not likely it to actually happen, but somehow it did. And uh and I think the world is better for it. And I think that we shouldn't undersell the decentralization of these with these security councils in place.

It's really really hard to get them to get security councils to do anything. And um I actually think Arbitrum is still very decentralized. Great. Well, uh this is Griff Green everyone. Go to thedao.fund if you want to learn about what he's up to. Go to Giveth if you want to participate in the QF round. And then any other calls to action for people as they're listening to this episode? Yeah, I think it's just the QF round. You know, if you care about Ethereum security, if you think Ethereum should be more secure get into the QF round and actually donate. And don't even and if you don't want to donate just go into the round and look at all the cool projects. There's so many great security

projects that we all can use and the real value of this round is not the money being distributed. It's the eyeballs on the security projects that everyone can use. So, uh get out there like learn about educate yourself especially if you're a developer uh like throw a couple dollars around in the round to public goods that you think you're going to use. It's going to distribute hundreds maybe thousands of dollars uh just by donating a few bucks. So, uh I think it's a huge opportunity for the space to level up not even from the money from just from the exposure. Well, I love that. I love that you and I are building this movement together of public goods on chain and I really learn a lot every time we talk Griff. So, keep up the good work and um yeah, in a couple months

when we launch Gitcoin's next moves uh you and I will do an episode and we'll we'll wrap on that. Oh, that'll be fun man. Absolutely. Please. Yeah. All right, man. Peace and love. See you then. You just heard from Griff Green. I'm just really inspired by Griff and always enjoy riffing with him. I think the DAO Security Fund is really super cool because Ethereum security is a public good and I think he's found a way to make that legible to people with thedao.fund. If you enjoyed this episode, we'd love for you to check out the links in the show notes or to learn more about the Green Pill, go to greenpill.network. If you value what we're doing, please gratify us with subscriptions, rating and reviewing the podcast, sharing the podcast with a friend. It really helps us get the message out about how we're green

pilling the world with technology. And uh enjoy the episode. See you on the next one. Peace.