Lido - Hold the gate a little: reliable dynamic timelock with Dual Governance | Kadmil | ETHDam 2024

[Music] all right I'd like to uh welcome cill from Lio thank you very much man hello does it work oh okay okay okay okay um good afternoon I think everyone like is a bit uh could happen to be a bit tired so I'm trying to uh speak louder at the very least uh uh so my name is cill uh my talk is about holding gate a little bit uh and it's about Mak like how to make protocols uh defi is working on and uh cryptocurrency space in general is working on more secure uh in like one particular uh and very special case so uh without further Ado let's move forward that's me uh I work for like I I I'm like the da contributor um helping uh with Dow op's team uh so that's a particular team uh doing stuff uh in regards to Preparing votes maintaining uh General governance Cadence and a lot of stuff around Dow governance and like protocols governance uh in general so uh that's me uh one thing I have to note uh the theme of his talk is dual governance I'll touch like I I'll discuss what it is in a second but I'm more of a messenger uh We've like the team has been through significant uh research for quite some time if you want to catch up uh check out Sam's talk about dual governance from last October uh bunch of links would be shared afterwards either the way but uh significant thing to note uh like we have uh people actually building the design and doing the research uh I'm working more as like presenter uh like project manager so uh like credit where credits do and uh things I'm I would be touching upon uh like significant teams work so uh let's move to our theme uh one of the things which is very unique to cryptocurrency uh to and to defy in particular is the ability to make sure uh users have ultimate exit rights uh some protocols implement and poison pills so basically are willing to sacrifice protocols uh liveness uh in order for the to Holders to like be made whole uh so that's very high ideal uh and there are multiple ways to implement it and uh in every case one has to think how how to do it properly uh and light the be uh liquid St protocol on top of aerium uh like on aium being liquid sing protocol uh like it has uh to like if we want to have uh to to give stfe holders ultimate exit rates we have to like think for a couple qus and the system we are designing and are looking to implement is called dual governance why duel uh like usually when you say there is there are two tokens there is ldo token which is lighted Dow governance token which has uh voting rights uh and ultimately every every time the op team says okay this decision is up for the Dow to make uh it means that uh only way to pass through only way for something to be enacted and implemented is for the Dow token holders to come together like on specified quum criteria and whatnot uh and actually actively support the motion uh that said uh ldo govern L our governance has ultimate rights upon upgradeable contracts which like the on etherium liquid sta protocal constitutes uh and there is inherent potential conflict between Len holders who can ultimately and like uh hear me being very technical uh as long as contracts upgradable uh ldo can have a motion to upgrade contracts in a way which basically says okay now all all user Seer is ldo Seer which doesn't sound well doesn't sound good uh and while aify find the protocol in general like is the direction contributors are looking towards given the um flexibility and like given the livess of etherum and the fact that the network itself changes uh ACI ification is not a way forward uh as of now and like quite likely not foreseeable future uh so upgradability and changeability of a protocol is here to stay so basically the question becomes how do we make a Steve vote count and in what sense does it me like that doesn't work uh so dual governance is a mechanics allowing to stf to like pre prevent uh ldo governance from changing social contract between uh St holders and da without their consent uh what like what is this uh I'll try to explain basic I'll explain mechanics in a second but basically the governance is fre things and the single um implement ation uh first of all it's Dynamic dynamically induced time log I'll touch upon it in a second but like this is the time for users to say oh hold on we need to talk this is a negotiations Wile between Steve and Delon uh so basically that's a way foreve to publicly to effectively voice okay I don't like what what you're trying to do and uh ultimately that's R quid mechanics which would allow St folders to safely exit the protocol in case of significant contention uh what like in essence uh what do governance is about as a mechanics uh we are looking to introduce a specific vault which uh can like which St holders can deposit very St to uh it has two main thresholds first threshold uh is uh like wait a minute kind of thing uh basically once there is enough Steve to cross the first threshold um execution of governance motions is posted up to some Maximum time Block it's Dynamic uh but uh in essence that's uh like the first seal uh the first threshold which allows aeve to come into negotiation space uh and ultimately if uh enough like way way higher volume of Steve is locked in do governance fault uh Rage Quit mechanics start s basically it PES um governance motions from being executed up to a moment where all the from Rage from doal governance fault is safely withdrawn uh scenario wise what does it allow for uh if for instance uh ldo like there is a malicious actor with enough ldo to get to the quum uh and they motion to upgrade the protocol so that they can withdraw all the user Seer or like all these drawals of user Seer would go to their address technically like IM imagine this situation uh holders once once some of them notice the motion uh can deposit uh to puse the governance motion from being executed fast like on the minimal time lock and then enter negotiations space uh so either Mo Steve gets uh locked into the Vault uh and ultimately trigger rage quit and can safely exit before the malicious motion is like could be executed or uh as a second uh option uh enough ldo gos around and saying okay there is a lever to cancel or scheduled motions uh and can say okay we don't want that uh we are canceling all the Motions there is no risk at the moment uh UNP housing the governance so like there is deescalation Puff uh like that's that's mechanics in natural uh but in general it yields quite like it asks quite a lot of questions so we are running through bunch of properties uh we want the design to hold uh so we want like first and foremost uh the goal is to give a Steve uh way for safe exit uh we don't want it the same time for E holders which had like users of light onium protocol like product uh to be overburdened with governance so you have like as an holder you have an option to do something but uh not like too many options let's say uh the mechanics uh shall have a des escalation path uh why is it important uh like the thresholds uh shall be quite uh significant and one could expect like U not designed for but expect uh actors to like be more or less rational uh in that regard like economically rational as in like old economic books uh so having a way for the situation to deescalate without breaking the thing to to to burning the thing to the ground uh sounds like a valuable thing to have uh two others uh theal governance uh should not like follow the regular Paths of execution so day-to-day operations shall be going like smth move and don't trigger it uh why is it important uh in general like the on eum protocol have been designed so that it can hold like significant uh withdrawals uh the biggest like chunk of withdrawals uh each had Chown for was something like 400,000 if uh it being with drone in like in a matter of we we or two if I recall correctly so basically uh we don't want like we we want the protocol to be able to hold significant variance in user activity while not uh affecting governance by cones by by by contention uh and the last uh like this is this like even in short recollection sounds like a pretty complex thing and what it should be solving for is to not to open new vulnerabilities new like vectors of attack to a degree possible and like not to uh open attack vectors which are as uh like just as expensive as the current ones uh so uh this is the uh simplest uh one can [Laughter] get uh you like there would be a proper link of a proper QR to zoom in uh and quite a lot of things to explain what the hell is going on here uh GCE uh it's like been quite a while in the research I'll talk about it in a second uh this is the security conference in the end so I want to show that like we are working on something earning for okay folks make sure it's secure uh so uh one could ask uh what the hell why are you trying to make something as horrendously uh scary uh have you looked into Alternatives uh we actually have uh so there are like um initial ideas of uh of what one can uh like Venus of research we went through and uh found them unsatisfactory uh one can say okay just do a Time block uh why it's not um a proper case because uh as I've mentioned uh like Li is um lium is liquid sing protocol and ultimately uh you have to have a time look long enough for any to get safely withdrawn to eer uh it doesn't work well because uh in worst case scenario withdrawal of like all the protocols all the like lightest effort from staking could take like say year and having time lock for every governance motion for by a year like just doesn't work uh why don't you just like plug in the multiseq uh that's like practical solution many projects go for uh but in general that's not allowing folks to like um to voice their opinion that's still proxy of a proxy of a proxy uh which potentially creates another conflict of interests which lays outside of smart contracts domain but still lay like but still is there uh so that the committee of sorts uh like doesn't sound like the best possible uh Direction and The like one of ideas uh which like you can you can imagine while hear in dual governance say okay so now St has a right to vote and that's not what you want uh that's not what one could could expect the St holders to want why because they want liquid staken token to be usable in defi to be usable for their interests and not as like something to bear in mind and participate actively in governance unless something like really B is happening oh wow sorry okay uh that said like by you may have noticed I I don't expect though uh that there are multiple steps uh into flow diagram and multiple like uh gadgets and parties and what not uh in the overall design one of particular things is uh it's called T breaker committee uh so overall mechanics um like there are two gadgets uh to current light on eum protocol and dual governance one is gate uh this is the safety uh net allowing to puse withdrawals uh in order for the governance to like mitigate potential bug in the protocol and dual governance is looking to uh puse withdrawals P governance unless withdrawals work so those two are inherently in Conflict may get into conflict uh and may get deadlocked uh so in like pretty much unlikely case of both things happening at the same time or or in the case of do governance getting BL like blocking governance motions for a sign for say a year or something like that uh we're looking to introduce the breaker committee like the very big and very slow very like um reputable uh Community like participation vehicle uh being able to say okay this is the ldo motion to upgrade the thing so it's repaired and there is a a lot of uh like St folders suffering as a like as a result of Deadlock let's do that let's execute this particular uh thing and not anything else uh there is another thing uh basically having uh protocols governance uh geared through the new uh pretty complex uh technical solution is inherently scary uh so we are looking to have um time bounded margin of safy of Safety Committee uh basically safety fuse to mitigate Zer day uh like potential zero day vulnerability uh switching uh protocols governance from uh dual governance implementation back to argon to have things patched and reinstalled I'll try to speed up speed up in a second uh like that's all interesting but what is the status what are we looking at uh the team has spent about year and a half of research uh there is a long trail of thought and trail of comes about it on light research form uh but currently uh we are gearing towards proposing the like design uh by the da as a snapshot vote as a vote of like okay folks this direction seems promising uh there are mechanism design technical architecture and cod draft published on GitHub so that's the first link uh there is a proper explainer so uh like not my Hasty thoughts and couple slides but a proper like uh plain English uh explanation of what the hell is going on uh and if you would like once you would be looking to engage uh I think that's the best starting point we have right now uh and the status uh we like the op steam would be proposing uh the snapshot vote uh by the Dow on next Thursday April 18th so uh announcement uh is published in Forum as well uh this is security conference uh so I wanted to mention uh what is in plans if like conditioned by the Dow d approval uh right now team is um team has ongoing uh spec review by two F parties ctor and time verification teams uh we would be looking to have bunch of code level audits as well as two different kinds of formal verification of code because as I said that's like that's a big big thing and really scary project to carry on uh and as on a separate note we are looking to have parameters search because like having mechanics is one thing uh knowing what exact numbers to put in is another so for all of that like that's only external things uh we're looking to do uh we have a lot of like internal processes uh and checklist to go through but that's the just of it uh so please get in touch uh like the whole point of all this talk is something very like pretty interesting is going on with FL the governance uh so uh there is uh link to like Forum post with all the links I've shared and if you want to talk directly ping me in telegram I'm moving up uh of like for speaking about uh one particular thing I wanted to note specifically for fdam uh I'm like I'm looking to have grants for explainers like basically run through what we have explain it as a Twitter threat and like if it doesn't has have technical errors and if it does a good job I'm moving up to like give up to three prizes for explainers think me uh thank you so much for attention thanks very much got [Music] time uh thank you so much I have a question that is twofold sort of so first I was thinking why don't you just have one token um and if you decide to have two tokens and you are worried about that the Ste holders um will not be able to vote in the current system uh if you have some investors that not uh that don't want to vote they can just buy the sth token and if if you have investors that want to have sth and also on governance they could just buy some Lio token uh so that was my question what is the reason not to go with sort of that model I mean that's the initial design of the protocol in theal because those are two different things and V does multip multitude of things and can manage multiple protocols so is being a product of light onium is one thing and governability of of this thing is another one so basically there is a distinction between roles and actors and what not so uh that's in inherent thing I I don't think like don't have any further comment here like we are working in a world where there is ldo governance and stf is a product of protocol governed by ldo it doesn't make sense to have them as a singular one given that then the s yeah of course of course of course of course but it could be too late and uh interests of like participating in governance actively and just being safe are very different and there is order of magnitude threshold uh to that engage level of Engagement let's say thanks for the yeah so one last like punch line here could be one doesn't need to be long ldo in order to be happy St holder so the the that's the main point s thanks for your presentation super cool ideas I what I want to ask you maybe to zoom out a second then sort of take us back in time and show us like the governance Evolution how would you boot bootstrap a similar structure from day Zero like it's kind of you have a lot of time and work and the elaborate you know governance diagram and there's many motions so we we're in you know time t plus know 27 I'm interested in like time what was the initial setup like what was the sort of GetGo if it's a committee thing multi thing or okay thanks for the answer the that's answer uh that's what we have right now uh there are like ldo can uh like participate in different voting systems uh and like why it's so cumbersome there is active voting system which is like made through Aragon votes so it's uh something requiring active active participation of LDL voters and there is easy track uh I've made the talk about it two years before in Amsterdam so can can can link but basically uh not every single decision could go through the whole Dow vote so we've designed uh something else all that uh have been designed uh like is being designed to like um mitigate potential attack vectors and governance attacks are one of the scariest of them so that's that's basically it thank you very much that was excellent thank you so much [Applause] [Music]