This past week we got two examples of when self-executing proposals go wrong for DAOs.
One proposal on Aave resulted in roughly $110 million in assets freezing after the proposal passed, and another on Tornado Cash saw a crafty proposer make off with roughly 372 ETH, worth over $670,000.
The Aave proposal has been fixed, and a new proposal executed the fix. As for Tornado Cash, the proposer has made a new proposal to return the funds. But because he is still the majority holder of TORN, the DAO’s governance token, it’s still up to him whether the vote actually passes.
But what are self-executing proposals exactly?
“Self-executing DAO governance models allow for an additional level of decentralization,” Open Zeppelin’s head of solutions architecture Michael Lewellen told Decrypt. “They remove the need for an intermediary or centralized influence to ‘hit go’ on an action decided upon by the DAO, a reliance on which effectively centralizes the entire model.“
This means that as soon as a DAO votes on a proposal, the code that enacts said proposal is engaged immediately.
These third parties that act on behalf of a DAO can also diminish the meaning of “A” in the acronym: Autonomous.
“Third parties inject risk and points of failure into a system, and this is a pain point we see again and again in DAO governance,” Aaron D, a research analyst at Delphi Digital, told Decrypt, adding that it begs the question, “Who controls a DAO—the stakeholders, or those who execute the proposal?”
It’s a valid question, but clearly it’s a balancing act.
On the one hand you want an active community to push the project forward, but, as seen above, this desire comes with some hefty baggage.
“First and foremost, any DAO proposal that includes a proxy upgrade of smart contracts should be reviewed by a security audit firm to catch bugs and potential backdoors such as this,” said Lewellen. “Otherwise, an upgrade could introduce a backdoor and exploit the system, as it did for the Tornado Cash DAO.”
It’s early days of course, as evidenced by some of the mistakes already made, but it’s an open problem with some different solutions at work.
“The best protocols utilize timelocks to insert a time delay between the proposal and when the newly upgraded code goes into effect,” Origin Protocol co-founder Josh Fraser told Decrypt. “That way users have time to get their money out if any nefarious proposal is passed. This also allows security engineers to spend more attention on proposals once they have passed governance, versus wasting their time evaluating every spam proposal that has little chance of being accepted.”
The balancing act also sheds more light on the growing cottage industry of business consultants in crypto, otherwise known as delegates.
DAO delegates are essentially given the voting power of token holders who may not be as technically versed or able to monitor the project at all times. On their behalf, delegates vote in ways that they think—based on their expert opinions—which proposals would be net beneficial for a specific project.
“Pro delegates are paid to make sure everything is fine and DAOs are not going to lose all their money; that includes monitoring governance, and seeing if the new code being added isn’t going to break everything,” Nathan van der Heyden of Snapshot Labs told Decrypt. He’s also a delegate for Arbitrum, a layer-2 scaling solution for Ethereum.
Ultimately, whether a DAO should self-execute or not is the wrong question.
According to some, implementing this kind of feature is inevitable.
“As the industry gains more regulatory clarity, there will be less acceptance for DAOs and governance that rely on third parties to execute proposals,” said Delphi’s Aaron D. “If they live up to their ideals, they are a novel coordinating method that allows us to manage public goods in the digital age more fairly and equitably.”
Join the web3 gaming revolution at the 3XP Web3 Gaming Expo powered by Game7! Featuring esports tournaments, immersive gameplay, and networking opportunities for industry pioneers. Showcase the best web3 games and connect with potential partners and investors. June 8-9 at the Pasadena Convention Center.
Get your tickets today!
Discount Code for your community: Decrypt@3XP20 (20% Discount)
In partnership with 3XP, we are giving away 5 free tickets to our readers. Fill out this form for a chance to win one of the 5 free tickets.
Introducing Decrypt’s new Learn Course: Getting Started with Artificial Intelligence (AI)
The moment that science fiction has been heralding for years has arrived: Artificial Intelligence is an everyday reality, accessible by everyone. Decrypt U’s latest free course, sponsored by ChainGPT, allows you to earn an on-chain certificate of your AI knowledge while making you conversant on the origins of AI, what terms like “machine learning” and “natural language processing” actually mean, and the implications of the literally world-changing innovation that is ChatGPT. Sign up here!
