Smart Contract Governance

Transcript

and for our last talk in this session um we have Tina Chen from uh coinbase who will be talking to us about smart contract governance I'm Tina I'm from coinbase and I am a blockchain security engineer at coinbase and today I'm going to talk about smart contract governance so as a refresher government governance is a method for the community to make changes to a system and for defy specifically it is a way for everyone to decide on the path a deep right project will take and also it is a way to decide on what

actions to take um so normally there are two types of governments one is off chain so for our chain governance it is normally pretty unstructured we have everyone discuss offline online forums or social media and they decide on a path from there and therefore all chain governance there are different types so one of them is we have minor and Staker nodes signal their decision and we can also perform governance through smart contracts

so proposals and votes are made through smart contracts and today D5 governance is mostly done through smart contracts so how it works is that it starts with a off-chain discussion um the community uploads or downloads a proposal through a forum and once that proposal has enough traction the changes for that proposal will be submitted to a Smart contract and people can vote through that vote for that proposal vote for or against that proposal using their governance tokens

and normally one governance token equals to one vote which means the more tokens you have the more voting power you have so what can governance do uh it can do many things such as minting tokens black listing accounts taking funds away from accounts it can also perform upgrades to the protocol and so it can also perform variable changes such as increasing or decreasing your fees or so on and so forth so what can go wrong um let's I'm going to first talk about

the Beanstalk hack um so how the Beanstalk governance works is that it requires 35 of stock tokens to vote so at least a third of total stocked filters are required to participate in voting for a proposal for that proposal to go through and of course we need to have more four votes than against boats to execute this proposal and for to start voting for a proposal there is a 24 hour delay first and there's a five-day period for people

to start voting and for emergency changes such as um security bug fixes there is a function called emergency commit where the changes for that proposal can be executed immediately and for that to happen we need at least two-thirds of a super majority and if you go on either scan unfortunately I can't show that right now um we can see that the token distribution is pretty decentralized and so basically on the top token holders they only have less than one

percent of the token so we know that no single actor can you know not only pass a proposal um so this the so it looks like this protocol is pretty secure so what happened was an attacker made a flash flow and drained the liquidity pool um they were a that their proposal went unnoticed and after that 24 hour delay period they were able to call the emergency commit function and drained the liquidity pool and fortunately

um the Beanstalk project is still with us today and I'm going to talk about another hack which is the build fine attack and this project was a little more unfortunate versus the Beanstalk hack so after this attack the price of a bill token dropped to 0.3 cents and at its peak from 2021 it was a hundred dollars so we can see that this attack was super devastating um so there are two attempts by the attacker

the first proposal failed but the second proposal went unnoticed so the those finances Discord bought was unable to catch this proposal so Noel was alerted and this attack was actually pretty simple um The Honest Community they did not have enough time to counter vote this malicious proposal and then this proposal just went through and what the attacker did was that they made themselves the men's Authority and then she also made the government super user wallet to point to their own

wallet address and then they just minted themselves a bunch of Bill tokens and sold them for profit and um I can't show this ether's etherscan screenshot here but basically the against votes um we're very close to the four votes so if the community had a little bit more time this Pro this proposal might have wouldn't have passed and um if you look the previous honest proposals there actually aren't that much activity going on

um there are not many people who participated in voting for proposals and so one potential medication here is to have a guarding account to veto malicious proposals because build Finance they mostly relied on counter votes no one is able to do anything or if the voting period was long enough for everyone to react then this may have been prevented and another thing about those finances governance

is the minimum quorum of um another thing um both Finance how both clients uh sorry and for both for a proposal to pass in the Bill of scientist governance is that at least five five to the power of um 23 both are required to have to be supportive of a proposal for

it to succeed and if we look at the token distribution we can see that there are there are there are poke holders that do meet that number of tokens to pass a proposal unilaterally so to so for secure governance it is strongly recommended that we have a quorum searched out over three Afters are required to pass a proposal and to reiterate

um long voting periods are recommended and also an execution delay for Guardian accounts or the community to react to malicious proposals and of course audits are also strong and recommended to prevent any bugs and there are other thoughts to for secure governance as well one is quadratic voting power meaning subsequent tokens a user host will have less voting power however the downside to that is a single actor can create multiple

wallets to to increase their volume power versus having a one wallet and also having one address equal to one vote wouldn't work either because it is super easy for a single actor to generate millions of fake accounts or in this case addresses to vote for their malicious proposal and for if for ethereum there are gas concerns gas cost concerns but for other chains um it is not resistant to civil attacks and again

um thank you for listening sorry again um that we have technical technical difficulties so that um I wasn't able to present slides does anyone have any questions thanks Tina um yeah so maybe maybe to start with a question um I'm curious if there are projects that you think have um done governance right from a security perspective um if there's any if there's anything you want to call out yeah um so one is actually are they our initial strong governance definition was based on Ave so Ave required a 20 percent

uh voting Quorum and if you look the rich list of Ave there's no single actor that can achieve that 20 percent and it also had a voting differential of 15 percent so what that means is that there has to be 15 percent more four votes than against those so it's not split to 50 50. um for a concrete example you need if there's a 20 of tokens participated in the vote we need at least 17.5 percent of four votes and they also have a multi-sig guardian

account to veto malicious proposals and having long enough voting period and execution delay thanks uh any other questions for Tina I have a question in regards to the anonymous structure of proof of State networks so how is it that we should trust Anonymous governance votes when it's not transparent and we have to basically believe that the you know group here is not coordinating with this group over here and it's not all just a small group of whales that are basically dictating uh the outcome of a vote proposal and this ties back into the whole collapse of Terra which you know

they sold much BTC for avacs and then they were moving from one V3 pool and curve to the other V3 pool or four uh the whole curve War thing so how can we trust Anonymous governance is the question right so um that's a good question I would say it's kind of a hard problem to solve uh which is why you want the quorum to require more actors so um maybe it's easy for two actors to collude versus three and on top of that you would have the guardian account to be the proposal so

we can have whales making uh requesting ridiculous changes to a protocol but if you have like a trusted Guardian account that can build that proposal this can also mitigate it but I guess there's also the problem of a discarding account is centralized but um it is so infinitely better than having Wheels collude to make changes their way does that answer the question the the follow-up is that the centralized aspect is the is the worrisome part and why not have a transparent structure like 50 people

sorry what was that the centralized aspect of it is the worrisome part um so why not have a just a larger transparent governance system which has like 50 non-anonymous people um well the whole point of of this is to have the guitar committee to participate so um having just 50 known actors sort of exclude everyone else who also wants to participate I guess they can also verify their identities but that also sort of defeats the purpose of people wanting to

participate anonymously um it's just it's still a pretty hard problem to solve um they're still um we're still trying to figure out what is the best way to perform governance cool um thanks Tina all right