Securely Scaling Decentralized Governance

Transcript

so we're going to talk about securely scaling decentralized governance um and oh yeah and you just scroll oh perfect all right so my name is Mike Llewellyn I work at open Zeppelin uh very quickly about me uh been working with blockchain tech for about 10 years now I started with uh like mining setting up wallets uh General crypto consulting stuff uh with Bitcoin and then started building with ethereum in 2017 did a lot of fun startup and corporate Consulting projects learned how not to do it most especially joint opens up in 2021 uh did a lot of stuff on the audit team mainly as a project manager but I saw still got very Hands-On on the tech in terms of explaining things and building processes and now I do Solutions architecture

which is to say I figure out all the Legos that are security tools that opens up in and give our clients Lego kits that they can actually use in one clean package so um uh part of that has also been doing some security advisory work for compound which is a dow that we partnered with earlier this year and I also on the side like to do state public policy work in Texas which is to say I work on Legacy governance enough to know the problems there and potentially how to compare it to our problems uh and then yeah you guys know what open Zeppelin does um so the talk here is really to talk about decentralized governance um which I'm going to say is it's everyone getting a fair voice um in how we make decisions and no one ultimately getting mad or feeling like

they've been cheated out of a good governance decision um which as you all know is very difficult um it's especially difficult when we have more decisions that we need to make the more decisions we need to make the more complex they are as we move away from a yes no to maybe a uh which auditor do we select uh to be our uh next partner for the next year such as what we did with compound like these these get more complex it's harder to make these decisions at scale and I would actually kind of compare them in part to the scalability trilemma getting let's say we compared decentralization security and scale in governance um getting all three properties in governance is actually fairly difficult in the same way that it is to get it in the throughput we would have in a blockchain protocol so uh let's get a little bit more into

what it means we talked a lot about it already in several talks today but I'm going to talk more at a high level conceptually um what we might be used to for a lot of people before D5 and smart contracts was implicit governance it was this concept of we're all running a blockchain node uh we're going to reach consensus on how we're going to make changes to that blockchain node and we're going to have an improvement proposal like an ethereum EIP or a bip from Bitcoin and we're going to make these changes and have a social coordination around it and then eventually we're going to make an upgrade and upgrade the reference client and usually the protection you have on this is the fact that any contentious changes can be forked the Bitcoin block size words as an obvious example where people were able to Fork off if they had

different opinions um and there's also this threat that if you try to push through these changes uh without having broad consensus then you're going to create bifurcation to the community and it's going to go poorly so there's kind of a strong uh protection against uh you know it helps to improve decentralization and security but it doesn't really scale you you can't have a basic conversation around you know who do we want to pay for a grant and then make that an implicit governance proposal you put through an EIP you're going to be sitting around for months or even years so this is where explicit governance comes in this is how we can encode on-chain processes to make decisions and then execute them most especially with ethereum smart contracts and doubts and these are things that we have all seen make decisions in the last several years

protocol treasuries obviously is a big one uh Millions if not billions of dollars are managed now through daos we have upgrades for improvements and Bug fixes which is something we can talk about a little bit more later and then parameter changes to manage financial markets configs Integrations with other protocols listings Etc so now we have this decision on chain great uh surely it can scale better well maybe uh let's a little bit about who makes these decisions you're all probably familiar with this admin account one owner that basically can make decisions um and then you can go further and have a multi-sig so uh four out of seven of these key holders must agree to make a decision to make a change uh signal voting which is the concept of we can cryptographically verify if someone if

the community whether that be token holders or some other credentialed participants that can somehow be recognized on chain we do an off chain vote which is fairly scalable fairly flexible um it's usually non-binding so it's kind of implicit on its own but we can at least get like verifiable signaling of the community likes this or doesn't like this and then we'll see who executes on that decision whether it's a multi-sig or the next thing which is a governor which is a smart contract that actually does allow proposal execution after an on-chain vote gives approval which you could say is kind of the closest thing to a true Dao there is truly governance on chain it's truly making decisions and it's binding and then it gets executed so the obvious example for this is the compound Governor um a lot of people have built their system off of this uh we even have

supported a version of it and opens up in the library and I go through a simple system we put it on chain we have two days to review it and then three days to vote it has to hit a simple Quorum in the case of compound and then if the Quorum is hit and the majority is yes then we will time lock it for two days so people have time to see if they like it or not in terms of being able to exit the protocol and then we execute it seems simple seems fun right um well there are pain points that come with this and these are not really as much technical pain points but really um really almost political governance pain points that end up affecting the Tactical execution of things uh so one obvious one that's already been talked about today are the security

of upgrades and I'm sure we're going to talk more about this in a panel later um but we all understand intuitively that really what upgrades allow someone to do is take what is by default an immutable smart contract in ethereum and build in the capability to change it um this is very useful if you want to make feature updates or fix bugs that could still potentially uh get in after deployment but you also have given governance the powerful ability to Break immutability um I will say it it opens up when we have upgradability in our library and I think that has created a misconception that we are upgrade maximalists I would say we're upgrade pragmatists which is to say there are cases for upgradability in some parts of your protocol but I would not necessarily throw it in there just because why not because you do have now

this governance power that you have to very carefully manage and maintain and even minor upgrades from third-party contributors we've heard some examples today could introduce issues that create uh bugs that could have a massive impact and then of course they also can create issues for posability now you have a system such as compound where you are lending you are listing tokens and those tokens themselves could be upgradable such as the Ave token which is listed on compound is upgradable so what happens if that upgrade then breaks an assumption that your protocol makes there was an example of this actually with true USD which was listed on compound about a year ago there was actually an issue that changed security originally found and then we had to figure out how to resolve and uh first of all a lot of people that came

together in the community to make this happen so the true SD team was very uh accommodating it was in short a double entry point that broke an assumption around how markets could be essentially a withdrawal could be made and it could have had a critical impact luckily we were able to fix it with upgradability they were able to upgrade and remove the double entry point um but you have to also ask the question of well if they can upgrade and remove a vulnerability can they upgrade and add a vulnerability accidentally and this is the case for any protocol so governance around how upgrades are made is a critical point for everyone to know about um and so we've we've replaced a technical problem which is how can we fix bugs with a governance problem which is how do we decide how to fix bugs um the other thing we have is uh well

something that affects all organizations at scale but especially smart contracts which is how do we handle operational overhead and accountability we're doing all these things we're managing treasuries technical development the protocol vision and the roadmap and if you have been on any of the Dow forums you know that keeping track of just one Dow much less several is a full-time job so many people many token holders can't scalably vote on everything so they end up delegating to usually delegates that are more active well now these delegates have an outsized influence on the protocol and the question of accountability comes in are they uh are the interests aligned with the token holders or maybe not even just the token holders but also the Dow in general you know it doesn't just token holders that are parts of these dials but also many of the developers uh many of the people

using it the average user that we are hopefully trying to reach like the average person that just wants a thing they can use to borrow money from how do we give other people a say um so the question of how token holding token voting works as well as the whether the people that are delegated the most power are truly the ones best capable of making those decisions is kind of murky right now it's left up to communities to Define that themselves so we have to be very careful about that and ensure that we're not allowing that to kind of run away and then finally we have governance attacks which is great governance uh you have governance uh now you've increased your attack surface because now there is a way for someone to make a decision that potentially will now introduce uh not just a bug but actually take money

in a malicious manner from the protocol or do something else uh dos it or something like that so Beanstalk is a classic example of this from the sphere uh suffered a loss of 77 million dollars when an attacker used a flash loan to borrow enough tokens to hit a super majority limit and so what they had is they had a one day review for proposals and what the attacker did is they submitted a proposal over the weekend so no one's really reading it no one's on call to look at every government's proposal um and so once that was passed through once it reached the one day Mark um the attacker was able to uh utilize a system bug where normally goes through a seven day vote but they said well you know what if we hit two-thirds of token holders saying this is a good idea then

why would we bother continuing to wait for seven days clearly we have consensus unless of course all of the two-thirds tokens were borrowed in the flash Loan in which case it's not exactly the consensus you would like and they were able to then immediately execute um The Proposal no time lock and receive the funds so as the number of and value of funds on their Dow control continues to grow we're going to have to be able to uh you know essentially provide protections that scale with that particular Honeypot so this is really what we're facing right now in terms of like Dows and governance is great but there are definitely a lot of responsibility and just general security practices that have to come with it okay so that's all that's all terrible and scary we probably all had War

stories that we can all share around how Dow's um are you know struggling to scale but how do we truly get this total point where a Dao or a decentralized entity um isn't dependent on um just getting lucky or just being uh you know having having watched the proposal and managed to cancel in time how do we design protocols to uh inherently protect against governance attacks um so the first thing and several of these ideas have already been shared and discussed broadly in the community um and there's many links to these examples here uh which is you know first of all enforcing long voting periods so you have a lot of time to discuss and decide and then having time locks even after you've supposedly reached consensus on chain uh provide the ability to time lock it at least long

enough for people to look and then if there is some problem that is uh surfaced you have the ability to cancel that proposal and who has that execution ability well in some cases anyone can execute but in other cases they might actually still delegate that to a specific multisig for example Beanstalk uh remove the ability for anyone to execute and they gave it to a multi-sig as a response to their attack to ensure that that couldn't happen again the other thing is minimizing governance control which is a great concept and uh basically is the idea is if you don't need governance control over certain things don't do it this is something that rye is kind of classically known for proposing but I can give you a more specific example um which is the controversial one right now which is tornado cash the um everyone's heard they've been sanctioned

um and you know putting the legal and ethical discussions of tornado cash off to the side and if you think about it just from the engineering goal of we want to build a system for privacy that can't be turned off they accomplish that goal because despite the weight and power of the US government it continues to run on ethereum today um and that's because they did not building governance controls they had they have a dow there is a tornado cash Dao but they did not give that Dow any ability to access user funds or turn off any of the protocol so in that sense they have succeeded there's a broader discussion around whether they should succeed or not that is for another day you can increase the cost of malicious governing attacks you can make it difficult to get tokens you can try to limit its ability to be borrowed and

this can even come down down to how you distribute your token or even maybe use something different like an erc721 token or don't even use tokens specifically you do things like what optimism is doing which is to not just have token holders but also developers with some other sort of on-chain credential that have a share of uh Power and decision making um and then in general also wait actually yep so another thing is this is something that we've become started to think more about with compound is how we kind of build security processes for Dao specifically so a lot of talks already about how you can do quality assurance with testing Suites and code reviews and formal verification and tons of other things just to make sure that code is

secure but from my perspective I'm wondering okay then how do we insert this in a method that we can provide for every proposal going through and I think of this from the perspective of a kind of like who who's seeing the Schoolhouse Rock like I'm just a bill like basically so that but for proposals um and that also codified for proposals so that people understand exactly what it goes through to get your proposal up especially depending on the type of proposal is it a financial proposal is it an upgrade um is it a grant what where does it need to actually fit and what sort of process should it go through these are all things that need to be carefully considered one thing we built documentation for for compound is after the whole the double entry point issue with your USD we documented much more

heavily what are the security risks of tokens that you're listing uh look for things like infinite men to look for uh issues around someone maybe having the ability to upgrade without time locks things that you just want to be aware of when you're listing a token not just the financial risks but also the technical risks even if it's been audited has it and been audited to work with your protocol specifically um and then final monitoring is a big thing that we've been focusing on uh you know monitoring for things like governance attacks with compound we monitor for has anyone borrowed enough compound tokens to either influence proposal or even pass Quorum on their own that's important to know about out but also just as simple as like what proposals are coming up when are they going to be time locked that sort of thing and then there's actually going to be a

workshop later today about what the tool we're using forta and how that could potentially be used in other ways and then finally one thing that is near and dear to my heart which is the idea of actually defining off-chain rules outside of your code so despite the fact that we all like on-chen code to enforce things there are some things that you simply cannot uh enforce like upgradability is a blank check in some cases um outside of for the actual contracts that are upgradable you can't protect it against that in the code without compromising on your ability to upgrade but you can write off chain rules that are incredibly explicit such as the ens Constitution that says we will never specifically sign by 40 000 accounts ever take away someone's ens domain for so and so reason um yes there is technically no way for

the Dow to be stopped from doing that but the mass amount of the community can still be very aware that that is none No-No and that if anyone is proposing that then they should be left out of the room and not taken seriously and if they're really attempting it then we need to think about that as almost an attack so at least there's a community consensus um and then so overall the concept of devsecops of having uh your your security built heavily into the devops process for how you are deploying proposals in any code um is really where we need to pair that with also the governance processes of how these decisions are made for Dows and I think there's actually a lot of opportunity to do some really interesting novel ideas of um let's just say code governance that I don't think has really been possible in

any other industry um but it's also going to be very very challenging and we'll just have to continue to work on it carefully um and then finally delegation of operational decisions um simply put like not everything has to go up for a vote you can delegate some of these uh decisions uh maker Dow is very famous for the core unit model and basically creating operational units that are given a budget and focus on a specific domain such as development Finance treasury et cetera um and then you also have things such as oh hey we we see an attack happening in the middle of the night we're not gonna be able to get all the token holders to show up to a vote even if we didn't have like a seven day governance process we have to go through anyway so we need to have backups we need to have the ability

for an emergency multi-sig such as the compound pause Guardian but possibly other mechanisms to quickly respond and it should probably be as other talks have mentioned something that is not overly uh powerful it shouldn't have the ability to do like powerful upgrades or that could be a problem on its own but maybe just pause or do limited things that can at least uh you know protect the protocol in the short term while in the long term there is a governance decision made on how to address that particular attack and then finally there interesting ideas are in optimistic governance the ability for anyone to maybe make a decision unilaterally but you you build in a challenge window for people to be able to uh say hey I disagree with this and maybe we should actually put it to a vote depending on what it is and there's a there's a lot

of work being done by optimism specifically using zodiac and genosis safe to to try to figure that out and then finally again this was already said by Nico but having the ability to permission things is very useful but all of this also comes with a greater amount of complexity and bureaucracy that you really have to balance and consider ahead of time so you know yeah you've built all this this this kind of bureaucracy and structure that should scale better but do people actually understand what's going on enough to still make decisions uh on the Dow level um so these are all things you just have to very carefully think about and there's not a one solution but uh just an awareness of the problem is a good starting point um so to take everything I've thrown at you into a nice diagram because I've mostly been putting text on the screen

um this is how I think about onshine govern scaling I think about it as we are building on this implicit L1 protocol uh specifically ethereum in a lot of these cases um and then we can also build a mutable smart contract smart contracts that are not upgradable that have that are either mature enough or clear enough that we have no need to change them now or in the future or maybe contracts that we're at one point upgradable but we've decided to burn the upgrade role and effectively keep it as is going forward and then there are other things that we will have to govern through a dow or some other structure so if you're using a governor smart contract then maybe that's how you govern your markets and other things and then finally you can create multi-cigs for doing more rapid discussions or maybe more expert

decisions or whatever you feel is appropriate and then eventually you get to the the operational layer of you know what we're just going to delegate specific responsibilities to a specific org or a specific person and they are going to be allowed to make unilateral decisions but their Authority is filtered down so at any point a multi-sig could revoke permission for an operational unit that is behaving badly or reverse one of their decisions if needed and then same the Dow can decide to reverse or revoke permissions for a multi-sig and then an immutable smart contract and L1 protocol governance gives you a baseline to build this on that you don't have to worry about changing so an example of this could be used with compound which is kind of how I conceptually think about it is we're built on ethereum there is an immutable comp token which is used for governance

so having that be immutable is good because you don't have to worry about the share of government's power changing but then we still have compound governor and then we also have compound V2 and V3 that is governed by that governor and then we have multi councils the pause Guardian respondency to alerts there's also a grant committee that has existed in the past and is now being discussed as being resurrected and then finally we have some entities compound Labs still does protocol development Gauntlet does Financial Risk Management and opens up and offers Security Services um so going forward Dows are still going to require a lot of iteration um so when you're building a dow don't just think of it as oh you know everything will be hunky dory once we give the community the ability to govern this because surely they know what they're doing

um you actually have to think of it more adversarially because it's permissionless anyone can come in which means anyone can attack it so you have to think think of that as a permissionless system that needs to be built with an adversarial mindset and then you need to actively monitor it and ensure that it isn't being attacked and you have a community that is able to respond or if not a community then specific actors that have been delegated that responsibility uh and overall I see this all tying into how we scale ethereum not just in terms of comparing it to the scalability trilemma but looking directly at Roll-Ups as the obvious solution everyone talks about uh even after the merge that's where all the the fun scaling activity is going to happen and look at their upgradability and ah look at that all basically the mass majority

of tvl on ethereum is upgradable today so governance is still a massive potential pain point and the reason they're upgradable is for a good reason it's this is all uh both optimistic and ZK ropes are very new technology there could be a bug there could be an issue do we really want to risk one billion dollars of tvl on not having the ability to address a bug um sure but it also means that we have to be very careful about that power we have to be aware that it exists and we also need to have plans to eventually scale um as it scales and matures we have that power to centralize and reduce over time you can even see ZK sync does have like a time lock ability um on their upgrades although they do have a no delay function if they have a large number of multi-sig that signs for

an emergency so you can in lockstaff eventually get to a point where maybe either upgrade ability is greatly decentralized or even potentially removed entirely but for now we're gonna have to live with it and many of the l2s that we're going to build on for our clients are going to be building on it anyway so we might as well figure out how to deal with it so with in terms of anyone who's building with governance today and wants to eventually move in that direction I would say start small carefully consider how you're going to distribute governance power because it's really hard to go back make decisions about how you it's like you know write the Constitution and then try to pass a constitutional amendment it's kind of tough um so definitely when you start out try to do it uh do as much as you can to

um protect the protocol then and then allow it to scale out over time and slowly delegate out the governance power scale decision making but ensure that even as you delegate that there's still some accountability to the Dow as a whole and you can revoke it or otherwise ensure that you're not going to be put at the mercy of a small click or any of the other groups that people think run ethereum behind the scenes in reality we know that that's very much more complicated than that but we can prove it by having very clear transparent governance processes that show how decisions are made and ensure that attackers are not going to be able to get away with any potential malfeasance so that is pretty much it if you were curious about the compound stuff specifically there's a bunch of posts that I made on the Forum and then also

security monitoring with open with borda and yeah I guess I should say we're hiring it opens up one because everyone else is saying that so that's on the website as well um I think we're good thank you [Applause]