Security Discussion

Transcript

for the final piece of the session I think we'll move into the panel um Kristoff unfortunately is not able to call back in for that um but uh Daniel are you still here cool um and Tina you're still on great um Kurt can I can I drag your new into into joining this panel awesome so on that topic of governance but my my first question is for is for Curtis how does maker think about um governance security and the risk of attacks on um uh mkr holders uh yeah that's something we worry quite a lot about I mean we've had to evolve the governance a little bit over time

um for example we originally had this thing where you could just lock mkr and vote immediately and then we had somebody use a flash loan to pass the governance proposal so you know we upgraded the governance contract on that um you know we take the security of large mkr holders very seriously um so we put a lot of trust in them uh you know which is maybe not great but it's sort of what you have to do when you have token weighted governance at the moment maker has recently installed like a delegation system where MPR holders can delegate the sort of like full-time politicians we think that actually increases security a lot because those full-time delegates are really paying attention it's much faster to reach them uh in some sort of emergency scenario and so you're more likely to get them to

be able to take action if necessary you know we we are continuously monitoring things like outstanding borrows of mkr on Ave or just like the mkr liquidity across D5 so to have some idea of like what someone could Marshal um in short order you know there is a time lock of course that maker for about two days right now and so you know if necessary if somebody got something malicious into the queue you could hopefully rally enough you know non-malicious mkr to combat that of course maker also has this like fallback um so-called emergency shutdown module mechanism where in a minority of mkr can be used to trigger a shutdown process

that would gracefully unwind as well gracefully in quotes I think it would be quite chaotic in practice but you know in that process dye goes through what's called global settlement where it actually becomes redeemable for collateral um and it's you know can at least give some sort of unwinding um and so there is always that sort of minority backstop mechanism but there's like a careful balance on that threshold as well because you don't want it to be like too low and somebody can just you know borrow you know 0.1 percent of the supply and just troll the heck out of the system and cause mass chaos but you don't want it so high that it would never practically be triggered um Tina I think a lot of the examples that you gave were sort of what I would think of as like surprise governance

um where maybe a not a majority of honest uh holders if they've been paying attention and actively voting might have been able to stop it but what do you think about the risk of um of bribery uh in governance it specifically just incentivizing maybe honest but lazy or rational um uh governance token holders to vote for a for a proposal that's harmful to the minority or harmful to the system um so I wouldn't I would include so bribery is something that we can't really prevent so I would think of it as a flash flow except well alone except it's from multiple honest

actors and again the execution delay of a proposal and a garden that counts is a way to counter this um but if the proposal itself isn't malicious to the point where it's going to ruin the project uh unfortunately I don't think there is a way to prevent this um Daniel you've seen a lot of um a lot of interesting hacks so Tina

brought up a couple examples of governance attacks with the um was it being stuck in the build one are there are there any others that you've seen that or types of attacks you've seen that are interesting I read so many attacks that they all blur together and unless I'm seeing details I can't even remember them um but you know on the system of governance we're actually building our own governance system out right now to hand over the community and so it's something we've been thinking a lot and uh he was talking about delegates that's our delegates that's something we've seen has worked very well uh that protocols that have that have a uh a lot better governance than ones that don't um I think in looking at around the Dow world you can see a lot of things that

have not worked well and have failed and it's still not clear to me exactly the right way to handle distributed governance we're avoiding as many failure modes as we can um but at the same time we're you know I don't think that there's a clear answer yet as to the best way that's guaranteed you know with uh with code you can get close to a guarantee you know put this much money in the end you can get this much money out at the end of the day but governance is um sort of like liquidations and compound or Ave is something that uh depends on the end of the day on the actions of people and people are not always rational at all uh not too many times evil and so it's a a

much fuzzier problem uh you know incentives in general work but incentives do also do not always work any thoughts I'd agree with that but you know there there's no Silver Bullet for governance security like there's no Silver Bullet for the you know protocol or mechanism security um you know I think they're probably still interesting experiments um to be tried like having a little bit more of like a hierarchical type structure into governance like maybe you have a dow that's governed by like nft holders and different nfts you know confer different you know like levels of of role or privilege or something

um like maybe it's not all just like flat uh you know liquid plutocracy um you know maybe there are better structures or maybe better structures will be figured out under the liquid plutocracies that exist today I was actually thinking about building that last night um one formative experience in my life was my brother bought a show dog and joined a dog club and I have never in my life remotely seen politics like that uh it was Cutthroat it was unbelievable people were so mad at each other there was an actual fist fight up at the podium um you know with so many people retired in their entire existence into this dog thing um so one of the things that I did

see through that though is how a good governance structure can actually keep the entire organization functioning in the middle of all this craziness because uh while we were there one person came in who was uh just really wanted the status of being president and he got a whole bunch of people mad and God voted in to be president um and then you know at the time the president was like the person who cleaned up the bathrooms after the dog show was over um and he didn't want to do any of that and so there was lots of problems but the thing was even though he got enough votes to be president through initial campaign of getting everybody mad at the current president the kind of like board of directors of the

Dog Club was staggered so that only a certain number of them were elected every year and he could only get two out of the six board of directors the first time he was there and then months down the road as he was uh you know couldn't run a dog show um you know it got back to normal again and the the governance structure and Robert rules of orders kept the meeting running in spite of something that would have just split any other community to Pieces so anyway I do think there's a lot more to structured roles and uh not purely token boating the structured roles could be determined by token voting initially so like the token holders could come in and be like

let's reallocate you know who has what executive role or something but they mostly can you know sort of just keep things in cold storage and not worry too much about it uh do you have questions from the audience for anyone on the panel yeah should I just ask a question he's got a mic um yeah just quick question we spoke a lot about governance on like specific protocols and projects um what do we think about like governance of eth post merge and what's about to happen with different clients and is that a higher order problem that people should be discussing and debating

uh do you think we have a formal governance structure for stuff like that well this is a little outside my wheelhouse but I you know I love to pontificate on on anything and everything so I'll just take a stab at it and maybe somebody in the audience can give a better perspective when I when I botched this you know the decentralized governance of like a blockchain is you know obviously a thing that always exists by the choice of you know what like node software people are running um the the transfer of power from miners to validators who are now like like very directly etholders and long eth in a way that a minor is not um creates an an interesting new incentive structure um you know we'll see those validators

you know acquire a lot more power and influence um because of the the transition you know like and I'll just say like anytime you don't have an explicit governance you have an implicit governance when there's a social consensus so you know it is an important thing to be thinking about I know there are a lot of discussions flying around about like social norms that should apply to validator behavior or block proposal Behavior Uh in the post-merge world if I do you have interesting new entities and how should they behave and even though like if we can show that you know like some parties say censoring transactions can we figure out a way to slash them even if it's not in the protocol but like observing extra

protocol information that and that's all very important because the social layer really is kind of the base layer of blockchains that allows the code AS law abstraction to exist on top of it yeah I actually worked in nethermine too and I said not all the core Dev calls so another one's one of the Builders of the execution clients um and that's very much in the community right now is like the the court development Community is very set on um there is the possibility of like a user activated hard a soft fork or some sort of a software Fork um but like the current kind of what everyone's thinking right now is that's like the most drastic possible measure and the only instance that should be done in is um if a validator pool a large value pool is basically like actively not attesting towards um like

sanctioned blocks and like constantly creating like Forks in the chain um but it's something that it's an action they don't take lightly so and for anyone that's interested in that definitely listen into the um all core devs calls the ethereum foundation YouTube channel streams on uh my question is for like maker government governance um like what are your kind of thoughts on like worst case scenario that this is very unlikely but um if there was some sort of like radical action against basically the stable coins that have blacklists implemented like I don't think Circle would add a blacklist to the maker contract um without like warning but is there any sort of a means of governance where they could start migrating away from usdc because I remember it's like 3.2 billion usdc or

something in the maker contract so is that something you guys have considered and like how would governance go about that oh yeah this is a super interesting question and you know it's the thing we think about a lot I mean I've been thinking about this for a long time um I'll just say opinions are mixed within like the maker decentralized governance Workforce on you know how much we should be prioritizing like um a hard Peg versus scale versus uh decentralization and censorship resistance um you know if if the Whispers did come you know down from one high that okay something might happen with that Blacklist but it hasn't happened yet and you've got some time to react um you know there are there are a few like low-hanging fruits that could be

done like you can take it and like dump it into some other protocol like Ave or compound and now they've got to like kill that whole protocol um as well right you know because you almost think like a blacklist action against maker which is not special compared to any other D5 protocol necessarily um that that's permissionless you know it might maybe all of D5 is being targeted and at that point you know you've got get that replaced with some sort of trustless collateral so you know there are ways to do that very quickly with varying levels of risk you know like maybe like the ultimate emergency waste like sell for eth um that's you know now you obviously have died back by a very volatile collateral so that's not as attractive

um maybe the more attractive thing is just to put some discount on that usdc and like let it have you know some sort of fire sale of people coming with dye to get usdc out and you know there's so long it doesn't have to be a huge profit margin to make it attractive uh the the sort of downside now is that maker loses the ability to balance supply and demand of dye and so you probably have to implement some sort of negative rate mechanism like the trfm that's implemented at Rye if you if you want to have a reason a pig that returns to the Target value in a reasonable amount of time or you can just let the the soft Pig float but it's not clear what the whether the market accepts that in exchange for decentralization

um you know we Baker previously had problems with the peg being soft and you know they're the market had this expectation it would be hard and that's what led to the whole usdc thing initially so and does that that answer the question any follow-ups like from a regulatory standpoint that's really attractive because if you're a high net worth individual and die and it's being like some sort of there's some sort of regulatory action like basically de-risking and withdrawing to usdc some sort of regulated asset I think that's something that a lot of the community could get behind and there'd be a lot of benefits to doing that clear like you you can exchange dive for usdc right now it's just you know

there's excess demand for dye and so the imbalance goes one way but you can you know we could turn on like a little like discount basically for redeeming it I think it's time for one more question from the audience [Music] uh in terms of uh proactive security audits for smart contracts instead of more of the reactive approach I'm curious what vendors would you recommend like the top three that are your go-to's for that kind of zero day threats which you know like a person can pay like 50 000 for a Mac OS your day nowadays so I'm curious like who would you go to to trust auditing your smart contract from a more of a proactive approach

yeah I guess we can all address this maybe but you know I think there are a lot of very good firms I'll just say which ones that you know maker has you know actively worked with either now or in the past so we currently uh chain security is our main auditor they do great work um in the past we've worked with abdk we've worked with trail of bits Peck Shield like they all did good jobs um we work with Satora for formal verification more on the capacity of using their tool and writing our own specs rather than Contracting them for audit services but if we run into something where we get stuck they're always great about helping us out you know bug bounties are an important part of security posture so right the

Mitchell the immunify founder was up here earlier so Maker's current bug Bounty is coordinated through immunify when when there was a centralized company we ran it through hacker one as well but you know I think immunify is much more like web3 native and a better choice there um yeah but there are lots of other like very good firms so that's not a complete list just ones we've we've used yeah uh you know there are lots of great firms again as he said uh our current primary auditor has been open Zeppelin areas open Zeppelin right now and we've used Satora in the past on formal verification and a bug Bounty program with immunify uh it is swiss cheese as he said that's my same way of thinking about it and so you know

every layer you can add really matters there's a lot of tremendously good open source tools you know I don't I don't think remotely of security as you know audit equal security you know audit is 10 percent of security or something um yeah but you know one of the amazing things about being in this conference and uh you know the friends in the security industry is it's not often you get to know people who have passed on the chance to steal 500 million dollars and have done that repeatedly and so there's an incredible group of white hat hackers uh who have helped a tremendous amount of people a tremendous amount I'm gonna add two more firms I can think of as well one is constant and one is

certain and then two Echo um the audits do not equal to security because there are always upgrades that happen after the audits which may cause which may um which may cause loopholes to be present as well thank you in terms of using the same offenders each time or to use a new vendor each time for your security audits like each quarter or something yeah I think there are advantages to sticking with the same auditor especially if you're adding like upgrades or extensions to an existing system because in the Auditors will have

some continuity but you know if you have the budget for it it's always you know interesting to get two or three Auditors to look at the same code and then you know look at what bugs they find and see where the overlap is there's a good talk earlier yesterday where someone was describing you know like looking at the Venn diagram and using statistical estimators try to get a sense of you know how many bugs might be left in your code so you know if you have the budget multiple Auditors like maybe one that's familiar and one that's not um that's you know it all comes down to like how much scrutiny do you need for a given contract and what are your resource constraints you know Auditors are different and I do think it's good to have a primary

auditor and it's good to try out Auditors as well yeah budget yeah you might sometimes want like Auditors that have particular Specialties um or even like slightly different techniques so you know like a company we've also worked with is called Gauntlet they do economic modeling and not everything needs economic modeling but you know you can consider calling in the Specialists if you need some particularly uh domain specific evaluation that's the end of our session thanks so much to our panelists especially the ones that we Dragged In against their will um