Mahi Sall, Advisor, Fintech-Bank Partnerships, Payments and Financial Inclusivity
January 25th, 2023
Mahi Sall is the CEO & Founder of FinXpair, a Berlin-based strategic advisory boutique firm focu[...]
Are DAO governance attacks avoidable?
a16z Crypto | Pranav Garimidi, Scott Duke Kominers and Tim Roughgarden | Jul 28, 2022
Many web3 projects embrace permissionless voting using a fungible and tradable native token. Permissionless voting can offer many benefits, from lowering barriers to entry to increasing competition. Token holders can use their tokens to vote on a range of issues—from simple parameter adjustments to the overhaul of the governance process itself.
But permissionless voting is vulnerable to governance attacks, in which an attacker acquires voting power through legitimate means (e.g., buying tokens on the open market) but uses that voting power to manipulate the protocol for the attacker’s own benefit.
Governance attacks in practice
- In one prominent example, Steemit, a startup building a decentralized social network on their blockchain, Steem, had an on-chain governance system controlled by 20 witnesses. While Steemit and Steem were gaining traction, Justin Sun had developed plans to merge Steem into Tron, a blockchain protocol he had founded in 2018. To acquire the voting power to do so, Sun bought tokens equivalent to 30 percent of the total supplyand eventually victorious and effectively had free reign over the network.
See: Arca Report: DAOs – Institutional Guide to Decentralized Governance
- In another instance, Beanstalk, a stablecoin protocol, found itself susceptible to governance attack via flashloan. An attacker took out a loan to acquire enough of Beanstalk’s governance token to instantly pass a malicious proposal that allowed them to seize $182 million of Beanstalk’s reserves within the span of a single block, which meant it was over before anyone had time to react.
- Governance attacks can also be conducted surreptitiously over a long period of time. An attacker might create numerous anonymous accounts and slowly accumulate governance tokens, while behaving just like any other holder to avoid suspicion.
Assessing and addressing vulnerability
For a protocol to be considered secure against governance attacks, an attacker’s profit should be negative. To reduce the incentives to exploit the protocol, the equation implies three clear choices: decrease the value of attacks, increase the cost of acquiring voting power, and increase the cost of executing attacks.
- Designers can limit the value of attacks by limiting the scope of what governance can do.
- Early in its life, a project might have more expansive governance as it finds its footing. As the project matures and decentralizes control, it may make sense to introduce some degree of friction in governance – at minimum, requiring large quorums for the most significant decisions.
- A project can also take steps to make it harder to acquire the voting power needed for an attack. The more liquid the token, the easier it is to require that voting power – so almost paradoxically, projects might want to reduce liquidity for the sake of protecting governance.
See: Research: Ownership of Top 10 Web3 DAOs is Surprisingly Concentrated
- Some projects have time locks so that a coin can’t be used to vote for some period of time after it has been exchanged.
- Some projects use veto powers that allow a vote to be delayed for some period of time to alert inactive voters about a potentially dangerous proposal.
Projects must strike a balance to allow a certain level of openness to community changes (which may be unpopular at times), while not allowing malicious proposals slip through the cracks.
Continue to the full article --> here
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
 |  |  |
Support NCFA by Following us on Twitter!Follow @NCFACanada  |
Related Posts
FCA Publishes TechSprint Report- Is FinTech getting it wrong? Focus on needs and wants
- 5 Deal-Breaking Mistakes to Avoid When Pitching for Money
- Crowd-funding reaps windfall for honest homeless man
- Will Elon’s Twitter Innovation Bolster Universal Crypto Adoption
- Wisdom of the crowd: How crowdfunding platforms are kickstarting the Startup Generation
Leave a Reply