MakerDAO Community, 3 Nov 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: MakerDAO Community Call Nov 03rd, 2020: Flash Loan Incident and Governance Upgrades with Kurt Barry

Description

Special Guests:
Kurt Barry joins us to give a brief overview of the flash loan incident and what the community is moving to implement as an interim solution.

On the agenda we have:

Conversation about the Flash Loan Incident and the [current vote](https://vote.makerdao.com/executive/mitigating-flash-loan-risk?network=mainnet#proposal-detail) happening to mitigate this.

Maker is a Decentralized Autonomous Organization(DAO) that manages the Maker Protocol on the Ethereum blockchain.

This video is a weekly community call that covers all Technical Milestones, Online Events, Partnerships, New Hires, Highlights from the Community, Real-Life Events, and more. Every now and then we even have a guest.

Maker Relay Ep 19
https://forum.makerdao.com/t/maker-relay-ep-19

If you're curious to learn more about MakerDAO explore some of the resources below:

Awesome-MakerDAO Resource Repository: https://awesome.makerdao.com/
Technical Documentation: https://docs.makerdao.com/
Community Portal: https://community-development.makerdao.com/
Governance Forum: https://forum.makerdao.com/
Website: https://makerdao.com
Twitter: https://twitter.com/makerdao
Reddit: https://www.reddit.com/r/MakerDAO/
Chat: https://chat.makerdao.com/home

A

All right: hey everybody! Welcome to november 3rd's maker dial community call. My name is david utrobin.

A

I work doing community development at the maker foundation and have been a long time uh community, member at maker dao, and it's a pleasure to have you here on the call so to give you guys a and gals a quick update on what this call is all about. Typically, we use this call to uh kind of relay information to the community.

A

uh You know different people like different mediums of of gathering information, whether it's you know a weekly publication that you receive in your email or a call with the actual person in the face that you can listen to and interact with uh that's kind of like what our vision was for this call uh and so yeah we host this call.

A

Every tuesday uh we like to focus on what's been happening, uh current events, uh basically the week at maker, dao and uh and we like the surface governance issues, we surface um interesting, integrations and things that people are doing around maker dao uh and we also really like having guests so uh so yeah and today is gonna, be a little bit light.

A

So uh last week we had the protocol on uh and what's interesting is that uh the protocol actually is behind part of the reason why uh why we have our guest for today, so uh kurt berry is gonna, come onto the screen shortly uh and and me and him are gonna kind of cover. What happened with uh with the october 23rd executive vote. uh What was peculiar about it, as many of you might have seen in the forums uh there.

A

Let me actually link it. uh There is actually a uh yeah, a flash loan that pushed that executive vote over the line, uh which is really interesting, because a lot of people in our community didn't actually think that that could be done until it was done so so uh so yeah.

A

So we're gonna talk a little bit about that and I'm gonna invite kurt on the screen kind of right now uh and yeah and then uh more currently uh hey curt uh and then more currently, there is actually an executive vote that passed right before this call started, maybe about half an hour ago to an hour ago, uh with actually formally passing the three measures that were uh decided on by the governance facilitator and also the various stakeholders in governance, uh kurt being one of them being on the smart contracts, team uh and so yeah.

A

I'm gonna give it over to kurt uh and uh I'm gonna. Let him take it from there and kurt feel free to share your screen, basically do whatever you like, uh and likewise anybody who's here on. The call feel free to ask questions, feel free to kind of yeah just feel free to interact. There's no, there's no wrong question that you can ask or anything like that. So yeah.

B

All right awesome, thank you david, so yeah hi, everyone, as david said, I'm curt. I lead the smart contracts team at the maker foundation, I'm not formally on the smart contracts domain team, but I work super closely with them, and I've been working super closely with them on on this flashlight thing and yeah david. Do you think a good place to start is just kind of recap like what the what the heck happened and what are we doing here.

A

Yeah totally totally.

B

Yeah, so on the october 23rd executive, you know it hadn't, yet overtaken the the previous executive. There was the monthly executive coming up that was going to be voted for one and in particular, one of the actions in that executive was white, listing b protocol, which I hear they were covered previously so I'll kind of skip who they are, but they they were getting white listed on some oracles because they needed that for their protocol to work, and so they were getting a little antsy, because this might affect their launch schedule.

B

If this vote doesn't go in um pretty understandable, and so they did something. That's never been done before in maker governance, which is they use the flash loan to take to pass the executive and right. The way that works is you know all within one ethereum transaction. They flash borrowed some mkr, they moved it into the governance contract.

B

They voted on the executive. They, you know, did the action that then puts it into the governance security module um to be executed after the delay, uh and you know, then that was that right uh and, of course, the rest of the transaction unwinds that that loan- and this is something that's always been possible. um It's you know that this is not actually an unknown um thing.

B

That could happen in the system, um but there was the first time it actually been used and then sort of separately from that you know that that was alarming enough uh to get people um waking up and going oh heck, what's what's happening here then, like shortly after that happened for the very first time the total mkr available for flash loans across like d5, became greater than the mkr that was on the active executive.

B

So that meant that you know, uh aside from just pushing an executive over the line, even worse, someone could have done a flash loan and just totally overtaken uh the executive and and put whatever they voted, whatever they want, and um but with just in just one transaction. So.

A

Quick question for you kurt, uh so I know previously uh like I personally was looking at mkr liquidity available on like ave uh and then also I was mainly looking at ave. I didn't realize actually that you could flash loan from uniswap and from balancer. uh When did that kind of happen? Was that the case like the the entire time, or did that happen with like uniswap v2 and like did they did those like uh amms kind of make that available recently, because I I completely managed to miss it.

B

um You know I don't actually know clearly the timeline of when that started, to become a thing um I I think it might have been in uniswap v2 that flash loans were first introduced because I think unispot v1 was before people were really doing flash loans that much, um although you can always with like an amm like that, you know you just like buy at the start of your transaction and sell back in at the end, and you know you'll lose a little bit on trading fees, um so you can like sort of always do a flash loan uh that way with them right.

A

That makes sense you.

B

Know obviously, balancer launched more recently and has also you know. I'd say the big thing is not about when it was introduced, but probably the whole like d5 summer, liquidity, mining, craze really sucked a lot of liquidity into uniswap and balancer. You know they really. They both did liquidity mining and it worked very well to grow their liquidity. um But then you know it sort of increased by an order of magnitude.

B

This mkr that was available for flash lending, which changes the security calculus around the maker protocol, which, um by the way, I'm super quickly going to plug this website, mkr dot fyi, which uh has, among other things, uh a part where you can look at the current mkr liquidity across different platforms. So that's maintained by uh andy trulian who's. Also on the foundation, smart contracts, team.

A

Yeah and it looks like it's primarily looking at like the most of the numbers on the mcat liquidity- there is from the ave mkr max flash loan wow uniswap mkr liquidity is like. Is it really that low 160.

B

Wow, I think this might not be. This might not be complete, so I think that's v1, I think that's v1 unit swap we. I should probably tell andy to update his website yeah at all, and I think balancer is actually the biggest one.

A

Yeah right right because they have their uh various mkr pools and they even have like an mkr bow pool. That's like earning a ton uh in battle rewards yeah, yeah yeah. It would be good to get this updated. I know somebody in in the smart contracts team had a script that they were running. I think it was chris mooney and he was able like there. There is some monitoring happening generally speaking.

B

Yeah, you know the the foundation and the smart contracts team. You know, keep a close eye on these things and they're like automated they're they're, automated robots off like checking this stuff- and you know that's how we knew right- that the the mkr liquidity available flashlights was greater than the hat, because people's pagers rang- and it said- um oh hey, you know this thing that you were worried about it's happening um so, but that you know that stuff isn't public at the moment.

B

So I was just able to find a public resource for people to look at, but.

A

Right, what's interesting is that at the same time that this flash loan incident happened, the governance portal redesign recently also happened, and I know that even as a result of the flash loans, there was a new feature that was recently put in the new governance portal. Where, at the bottom of your vote for the executive, you can actually choose to keep your mkr guarding both the previous winning executive and put it on the new one.

A

So previously, this was also kind of like a hole in the in the governance security, where, if you moved your mkr from the governing proposal to a proposal you're voting on it basically lowers like the bar for how much mkr you actually need to just spin up a brand new uh executive like not even have it listed on the governance portal and just vote it through with the flash loan right. uh So yeah just wanted to shout out that kind of uh that functionality on the governing portal. So just a heads up there.

A

That's also that's like a mitigating feature that didn't have to go through governance, that the team added, which uh I found really really great.

B

Yeah, like that capability was always in the underlying smart contract, but we just you know before that point. We didn't have a good ui to expose that to users. You know, and in fact you know that that uh ui change was like planned and in the works long before this. You know latest thing happened because you know we we saw this was coming and we said: hey, that's an easy. You know. Low-Hanging fruit is just like enable the ui to better use the existing functionality.

B

I'm sorry, I would encourage people when you're voting is, you know, protect the current hat at the same time as you vote on new stuff. It's now like no harder than just voting on the new thing. Just click that box in the ui or whatnot.

A

Nice, nice, so uh so I guess that was like a a brief description of uh what happened and kind of the update right. um Do you want to mention the recent executive vote that just passed today and the three outlined measures that.

B

A

Is deciding to take.

B

Yeah, let's talk about response and mitigation here, because the you know the shortest term priority is: how do we make the the system safe, and so the very shortest term thing that was done was just raising the alarm. You know get your mkr on the hat, um make the make the executive secure so that that call went out. You know shortly after things came to light and the governance community responded brilliantly. You know we've got over a hundred thousand mkr or we got over a hundred thousand mkr on the old hat.

B

I think that much has been put on the new executive which just passed, which is a nice segue to talking about what is in that new executive. um Because, given the urgency of the situation, we decided to make that basically, you know an emergency exec and you know so sort of putting aside the normal things in the protocol and doing some things to secure the system. So what were those uh number one? The governance delay has been bumped up to three days instead of 12 hours.

B

That's essentially to give us more time to respond in the event that someone does get a malicious spell queued up um via a flash loan. You know because it just you know you you can remove that and you, the removal, doesn't to be clear. The removal doesn't have to go through the governance delay. um Obviously, there'd be no way to stop it, but you know we felt, like maybe 12 hours is a little bit too short to to coordinate mkr holders and and get that dropped.

B

So, let's put that out to three days and then the other thing that was done is that instant access modules that allow skipping uh the delay have been disabled, and so what are those? And what does that mean? So there there were two instant access modules that weren't subject to the governance delay. One was the oracle freeze module um which exists to defend against an oracle attack. uh You know, like oracle's, have a one hour delay, so that's essentially how long you have to respond on average to somebody attacking the oracles.

B

um So that's why there was an oracle freeze, module that could freeze oracles.

B

You know faster than the the total governance delay, but in a world in which there are potentially malicious flesh, lone attackers, you worry that somebody might freeze the oracles inappropriately like they see the prices crashing and they freeze oracles to save their position or vice versa, the price crashes and then it like quickly recovers, but they freeze the oracles at like the very low price to make sure lots of liquidations happen or or they could use it in conjunction with actually doing an oracle attack as well.

B

So the the cons, the concern there basically became. You know we were more worried about someone freezing them maliciously than we are someone. uh Then we are an actual oracle attack, especially because the oracles have sort of been proven out as infrastructure. At this point, we have things like the news limit on amount of debt that gets liquidated at a given time, which you know helps.

B

At least you know control the damage that would be done in that sort of scenario, and so we said you know in the short term, while we until we solve this flash loan thing. Let's disable the oracle freeze and the other thing that was instant access was the liquidation circuit breaker. That would just turn off liquidations um and the similar calculus went there. You know we're we're less vulnerable because of the liquidations. 1.2 changes we put in place uh and we're worried about someone turning off liquidations maliciously.

B

So in the short term, both of those instant access modules have been disabled, they can still be triggered, but through the governance delay, but like I just discussed that probably isn't isn't as useful um because they're they needed to be instant to be useful. So the priority after this spell has you know, taken effect, which you know it's been voted in now um in. I guess something less than 12 hours, it'll actually execute, then the priority after that, the next step comes.

B

How do we safely re-enable those emergency access modules and that's where the smart contracts domain team is still working very hard on? You know getting an optimal recommendation put out to you, know they're in discussions with the rest of the technical teams at the foundation, sort of converge on what's the best solution and what are like the alternatives in case the the community doesn't like the the best recommended one and then ultimately, there will be some governance vote of how do we? You know deal with that and re-able re-enable those modules safely.

A

Yeah, that makes a ton of sense. uh How does the redesign of the governance smart contract uh now being called dss gov play into all of this.

B

That's a great question, so dss gov already includes, for example, um a feature that prevents flash loans from being utilized.

B

You know so you know the original thought was we'll we'll ride out the current system until dss gov is ready and then we'll be safe from flash loans when that comes, and it comes with a ton of other great features too. The thing with dss gov is it's still in development.

B

You know we're we're still iterating on the design there we're still looking at open design questions, it hasn't been audited, yet it's a new kind of totally different mechanism for how the government's voting it goes from this continuous approval voting to a threshold-based system, and so so it's like a huge sea change and we think it's a better change, but it's not ready for prime time so to speak. So you know we're not going to accelerate that we're going to have to do something more intermediate.

B

uh You know in the short term, you know, I guess I guess one option could say well, we feel like we're just going to keep enough mkr on the hat and live with not being able to trigger these instant access modules. But that's the current thinking is that's more risk than is worth taking. So we'll do some sort of intermediate technical measure uh before the new chief module actually or the new governance module actually arrives. It's not a chief anymore. It's dss.

A

Right right uh so there's, uh I know that there's been like two or three different approaches to that intermediate measure that you mentioned. Is there one that uh you personally think kind of? Is the the best option or even better yet like? Let's keep it impersonal? If you want the? What do you believe is uh where the where the mind share is kind of leaning towards most right now.

B

Well, I you know, I don't want to commit to anything that other stakeholders haven't necessarily agreed to yet, but I think it's totally great to discuss what are the options and what are the pros and cons just to start talking about them? Yeah.

A

B

You know in our discussions really the two strongest options that have emerged uh number one would be a migration to a new chief. That would be very very like small changes from the current one, but it would they would be important changes. um The the main change being flash loans can no longer be used to vote on proposals. You do that by enforcing a delay between locking and freeing mkr so like.

B

If you took a flash loan, you wouldn't be able to and use it to vote, you couldn't get it back out in the same block and and that would short term uh greatly reduce the risk. There's still like the longer term risk of mkr- that's just borrowed normally say on on compound or ave, but you know right now.

B

The immediate issue is is the flash loans, and that would take care of that and the other feature that would go into that chief is: there would be an activation threshold that you'd have to get a certain amount of mkr into it before it activated, which would just really be a defense for the migration.

B

um So when you're, when you're migrating from one chief to the other chief, uh you know you worry that in the uh in like uh when there's a small amount of mkr in the new chief, you know somebody might be able to pass a proposal using only you know, a small amount of voting weight, so you just put in some activation threshold, say 100k mkr has to come in and vote on a no and safe hat, like just the zero address before before.

B

You activate it so that those would be all the changes you know, extremely small. You don't really need audits is.

A

An activation threshold synonymous to like a quorum almost.

B

Yeah it's, but it's like a one-time thing. It's just to activate it and then once it's activated, it works like the the chief already does. So it's it's an extremely small change, very low risk. um You know the the only downside is you kind of have to do this? Migration and people have to move their mkr, but, as I was just describing, the activation threshold allows that to be done uh very safely, so that so that's one option that we're discussing and that option is nice because it just completely eliminates all the flash loan risk.

B

You can re-enable the instant access modules and people can't pass. You know any malicious spells with a flash loan at all, because they just can't use flash loans um and it's sort of like a it would be we'd, be very confident in that solution. Tidiness over until dss gov comes so, but that's one. We we like right now.

B

Another one that is getting discussion is uh we'll deploy a separate module that just controls those instant access uh contracts um will pro it will probably be like a chief um but simplified and instead of using mkr to vote you'll use. What's called the iou token to vote so just for those who aren't familiar when you lock mkr in the current voting contract, it gives you back a different erc20 called the iou, which is really just a plain erc20 that you can do whatever you want with, and one use case for it is exactly.

B

This is like daisy chaining, these voting contracts, and so in the new contract. You know that we would deploy, it would be simplified chief, it would have flash loan protection, so you couldn't flash loan. You know to attack that anymore and then it would just control the instant access modules now, and so this is an option that would enable you know it gives us back the oracle, freeze and circuit breaker.

B

The downside is, you can still do flash loans against the big chief and vote in malicious proposals, and so you know like you, you would probably still want to keep the longer governance delay. uh It also makes the eventual migration to dss gov a little more complicated, because now you've got to unwind the iou tokens, as well as the mkr tokens. It also becomes a more complicated user experience for users of governance is that they they now have to usually vote on the main chief.

B

But if there's like some emergency, where you need to trigger the osm freeze or the liquidation circuit breaker, then you have to go to a different thing uh and understand how that works. But you know ultimately, you know the advantage of that is you don't have to like?

B

Do the migration uh in the short term, uh you just you just add one and mkr holders, don't really have to take additional actions, um so it's pros and cons and it's still sort of under discussion uh to make sure we've got all the corner cases figured out and what would actually be the recommendation.

A

Yeah, what pops into my mind, with uh with like doing that, migration short term versus not and having like two governance modules instead? Is that, like a migration? Isn't as as hard or as like? I don't know like it doesn't lose his momentum.

A

It doesn't lose as much momentum as you would think, because the active mkr vote- and this is like I might be wrong- so correct me if I'm wrong, but uh the act of mkr voting is already doing on-chain transactions for all of these votes, so migration to a new chief can be very simple and, like you, I don't like my sense is that I don't think we would lose too much actual mkr weight on the new proposals if we were to do that and also yeah for all those advantages, like I'm leaning towards option one personally, just like listening to these explanations but yeah yeah.

A

So thanks for summarizing the both those options, uh that's fascinating, yeah.

B

Yeah and I'm happy to get into the weeds uh at all. If anybody wants to on on the details there but yeah, I think I think we have similar reasoning around the migration is that it's actually a lot less risky than it sounds. You know for mkr holders like they're doing weekly transactions anyway, um so it's just a different transaction. You know, there's certainly work for the domain teams and the foundation to make sure like that. There's this good ui and the process goes smoothly.

B

But you know with with having that threshold I mentioned for activation of the new chief. It really like removes all that risk. You'd worry about of having you know like low weight and malicious proposals sneaking through you know.

B

The one caveat is that you know you kind of want to hold the hat on the old chief until the spell actually executes to disable it, um because you just don't want to open up any any window there for risk, although in principle you can just pass, you could pass non-malicious spells while you're in that delay period and would be fine, but you know just just for simplicity's sake.

B

You say: okay, we vote this in we hold the hat, then once it executes um and the then the old chief is instantly useless and the new chief is useless until enough mkr, migrates and votes for something safe. uh So then you just have to you. Have that waiting period and really probably only takes a couple days. um You know, because I guess one of the advantages of having whales is.

B

You only need a few whales to move to get a bunch of mkr on the on the new chief sure, and so you know we we actually are are thinking that the risk. There is not really that great, it's just scarier than it sounds, and we're going to have to do a migration anyway, when dss gov comes out, so it might not be a bad thing to practice that.

A

Exactly yeah almost like a uh like a fire alarm, except it's real, like a drill.

B

A

B

Yeah, like probably some of the ui, could be reused when the right direction to be at the scope comes anyway.

A

Yeah and and in general, like uh in the lifetime of the maker protocol, there's gonna be periodic migrations. Like you know, I can imagine. I don't know this might be like designed against or like designed with this in mind to like avoid people migrating and just have like an upgradeable dss gov.

A

Is that a thing actually since you're here I might as well ask you.

B

um Yeah, so dss gov right now is not planned to have any upgradeability mechanism built into it. Upgradeability mechanisms are, are a really deep rabbit hole and I love to talk about them. But so let me just try to say a few words very briefly, and we can we can deep dive if we want. uh You know it's. It's almost obviously contentious in smart contracts, because upgradability can be a security vulnerability um because, but you know, if the upgrade ability is behind the governance delay, is it really any worse than anything else?

B

And so this is actually becoming an active topic of conversation. I think for the smart contracts, the main team and also within the foundation of you know. How should we think about upgradeability?

B

um You know if it's, if it's behind the governance delay like maybe it's okay and it makes things a little nicer for people integrating with the system. um You know because, like we've had cases with liquidations 2.0 where we're like, oh yeah, we have to upgrade like the end and all this stuff and some protocols were like hey, you know, you're, you might break us, and so, if, if the addresses stay the same, it might be easier to do upgrades.

B

On the other hand, some people, like the certainty of like this contract, is always going to do what I think it does, and so, when I deploy something that depends on it, I don't have to make assumptions about what it might be upgraded to in the future. I just know that um so it's pros and cons- and I think we'll just have to be taking it on a case-by-case basis for different contracts in the system.

B

I think you raise an excellent point that the governance contract might be a good case for that uh to at least can at least consider some level of upgrade ability, because it is kind of disruptive to do these migrations, so yeah we'll look into that.

A

Yeah, that's super super fascinating yeah. I'm excited for hearing more thought on that, like as it develops in the future and matures. uh I know also like. According to mkr gov there's like 290 000 mkr uh sitting in the uh in the current governance uh module ds chief. uh Is it dsg for dss, cheap.

B

The current one is is a ds chief, yes yeah, you can call it the chief long story behind the naming, not important.

A

It doesn't stand for die, stable coin system or.

B

A

Original dss right, I don't know what ds stands for well,.

B

Ds comes from okay, now we're going to have to get into the name, because you asked.

A

As well, we might as well everybody.

B

Blame david, they mean, is our favorite uh discussion in maker, so it's good we're getting into this most of the whole hard problem in computer science. Besides action, validation and off by one errors.

B

Nobody caught that all right, I just made it up for one error.

A

Oh really, oh, I didn't catch it.

B

Because, like probably the only hard problem, besides cash and validation, and then I added another one plus one yeah,.

A

Okay, okay, I get it, I get it nerd, humor.

B

Prefix ds, like ds chief yeah, you might have also seen like bs token, like the mkr token, is actually a ds token, underneath those come from things that daphub created, which that dab hub is another long history about it, but you're not familiar with the name, and so their stuff is all prefixed with bs. I'm not 100 sure what it sounds like it or sorry. It stands for it might be like dap systems or dap hub, but fascinating bits of history. Here, yeah and then dss originally stood for die stable coin simulation.

B

uh It was the title of the you know the core. You know dss repo, that implemented the system. So it's a you know it was originally just looked as like the maker protocol or the die credit system is like this. Abstract mathematical object, and this is a simulation of it, written in solidity to run on the evm.

B

uh And so then you can imagine you know implementing in other things, for example, our formal verification is basically an implementation of it in like k framework, you can think of it like that. But and then at some point we we felt that the word simulation was kind of confusing there and we changed the title of that repo to the die, stable coin system.

B

And so that's now what dss stands for so nice history.

A

Yeah, nice, no, that's uh I! I honestly, I personally really love that that kind of history, because it's almost like it's almost like linguistics right, like it kind of evolves and like in mirror, there's like mirroring happening, and it's uh it's like it's a an evolution of terms, which I really appreciate uh because you can like trace back the lineage of like certain certain things and it's cool.

B

Well, the dss prefix because it sounds like ds. um So that's why the new, like the dss gov, was originally dss chief, because it's like, oh it's like ds chief, but now it's dss chief, because it's like specialized for you, know the dye system. But then at some point we decided, though, that's too confusing, and I think that was the right decision. So now it's dff.gov.

A

Yeah yeah dss gov makes sense to me, but yeah, I guess for most people it's going to be like it's totally, not in the forefront at all. It's like that. This is just the governance. Smart contract, yeah.

B

I mean I'd love it if, like nobody, knew that what the contract's name was like I'd love for the abstraction to be that good that people are just like. Oh, this is the voting contract. um I I don't need to know whatever weird name the developers gave it like. You really shouldn't even know that right you just you, you interact with it and you do the voting and you care about the experience, not yeah what the developers named the contract.

A

At the same time, though, like there is, there is a case to be made for having this kind of be public knowledge, be something that's kind of in almost in the culture of the community, because we are trying to also attract uh developers who are interested in working on these smart contracts and joining like the smart contracts team, for example.

A

Even you know like in general. Don't have it too hidden, you know, but.

B

They have to be public at some level yeah, like trust and transparency reasons. Absolutely um you know, so I'm not saying it shouldn't be discoverable yeah, I'm saying that, like people shouldn't have to you know, learn all the weird names yeah clearly to participate in the future.

A

uh Much simpler die right, like minimize diane's uh increase, just kind of like the uh the colloquial like ways that you refer to things and like people that know that need to know they know, but uh for like the regular voter or the regular community member uh yeah. Being able to talk in terms in like simpler terms is, of course, like totally better yeah.

A

um So going back to the conversation about the flashlights thing, so the three things uh uh the one question I had was the delay being switched from 12 hours to 72 hours uh in combination with the the removal of the liquidation circuit. Breaker at first struck me as a little bit alarming. It was like. Oh, like elections, are you know like uh should? Should we be doing this?

A

You know like what happens if there's another like march 12th thing, but as you mentioned there's, but there were, there was a liquidations 1.2 upgrade and it introduced uh basically almost like a rate limiter to how much debt were auctioning off at a given time. uh So I mean I guess I can't kind of answer my own question, because I have to just talk through my thoughts here there, but my question was like is 72 hours like oh, should it be alarming? Should it be? Is that too much rather?

A

Do you think it's recommendable after the like short term, upgrade to uh ds chief? Should we adjust that downward again or do you think that 72 hours is kind of a reasonable governance delay in general.

B

Well that there are a few things to unpack there generally, I think it's an excellent question. You know it was what you know. People were struggling with in deciding what to put into this executive to propose as the emergency major you know, all the all the risk teams and the smart contracts, the main team and the community, um because it's made extra risky, like you point out by the fact that those instant access modules are also disabled.

B

But I'd come back to the fact that we were going to disable the instead access modules, one way or another, because you know we felt that that was the biggest risk right now um in in the short term and what people are disabled. I don't think there's actually that large of a difference between 12 hours and um 72 hours, because, like you know, black thursday, was over within 12 hours.

B

Right, like you know, 12 hours is already too long if the system really gets into a bad spot, but that longer delay does buy you more time to deal with any malicious proposals that get put into the system. So in. In my personal opinion, it was a net reduction of risk in the short term.

B

It's entirely debatable, um depending on how likely you say think another black thursday is in the short term right. You know, and it's like one of those unknowable unknowables right like you or no well, you know you don't know it, but you don't have really any way to quantitatively address it, because you need like a crystal ball.

A

Yeah, you could just kind of run the simulation in your mind and be like. ah If this happens, I think we should be good or, like you know, it's going to be bad, but at least we have like these things in place that we didn't have in place during black thursday that kind of regulate the situation even without the instant access modules right like having uh the litter box, as it's called in the code. uh The kind of rate limiter for uh liquidations is really helpful for a mass liquidation event.

A

You know to kind of keep keepers from scrambling for liquidity, and uh but if we were to to adjust the box parameter uh in liquidations, that would take a governance change then plus 72 hours, right.

B

Yes, so you, you kind of, have to hope it's set well already. Basically yeah yeah, that's which, if their themes are, you know doing their job um confidently. uh Hopefully it is, but I think I think, there's another point I should address that you raise, which is that you know after we get some sort of mitigation in place, would we stay with the three-hour governance delay or not?

B

And you know this is you know everyone with a stake in the system is going to have a have an opinion on this and potentially quite a different one, so I'll just from the hip here and remind everyone. This is my personal opinion. um You know based on my risk exposure, and you know my understanding of the system and ethereum and stuff, which is that I think it depends maybe a little on which way we go.

B

You know, I think if we go the chief upgrade route where we have a flashlight resistant chief, uh it makes a lot of sense to go ahead and reduce it down to 12 hours so that we can be more nimble, because there are things that it would matter whether you can respond in 12 hours versus 72 hours, and you know, I think, if we're confident that nobody's going to flash loan a malicious proposal in um that there's.

B

A strong argument, for you know at least shorter than three days, maybe like maybe 24 hours, is a better number. You know. Maybe 12 hours is a little short. um Maybe not, and I think this is going to be an ongoing debate throughout the rest of the protocol's lifetime. You know if we go the if we go the option where we just deploy a module that only control the only flashlight resistance is on control of those instant access modules, but the main chief is still can still have flash loans used on it.

B

I don't know that makes a stronger case for keeping the longer delay. You know because in that case, you're at least safer than you are now like the statement we'll get into when the spell is cast. Is we have a three day delay and no oracle freeze or circuit breaker, uh the you know extra side module, then we would have a three-day delay and but then we would get the oracle freeze and circuit breaker back, um but the chief is still flash loanable.

B

So maybe it makes even more sense to have a three-day delay in that world than the one we're in. If we have it's not vulnerable, though I think you know, there's there's a real discussion to have there um and I think in the future, as we get more automation and more instant access modules. It'll be really interesting to see what happens here, because you can imagine if, like a lot of things, get super automated and we're really confident and how well they work. You know debt ceilings rates all kinds of stuff like that.

B

You know we live in this like nice, sci-fi universe, where everything is automatic. um Maybe governance will want an even longer delay like a one week delay, because any change that you have to push through governance is going to be big uh risky and there will be. Who knows how many billions of dollars of value in the system and or on the other hand, maybe we'll get so good at this and we'll be like. You know, we're so confident in the security of our government system and our ability to detect and stomp out malicious proposals.

B

We can be nimble and keep a 12-hour even less delay, and I I have no idea how that'll that'll play out in the long term, and it will be a really interesting thing to see.

A

I'm curious about like a vision of a governance contract where you can cat, like you, have a list categorized of all the different governance actions you could do and you can assign like custom delays to each one. That would also be even like more granular for uh for basically handling situational like um plan plant like uh what's the word, I'm looking for like situational uh response time.

B

Plans and stuff like that, you know that that's the thing that's been discussed as well and will probably eventually happen. um We kind of already live in that world, where there are some things that go well, at least until this executive passes like right. You know up until now, we've been living in a world where some things go through a 12-hour delay. Some things go through a zero hour delay um and you can imagine a range of different delays for different things.

B

um That makes things a little bit complicated right now when spells get just bundled up into one big package, but there's no fundamental technical limitation to adding different delays into the system and yeah that I I think that's a pretty likely thing you bring up there.

A

Yeah, cool cool yeah, the future looks pretty uh bright and filled with potential for in regards to upgrades to the governance contract. uh Yeah, that's exciting! That's super exciting uh cool! Well, I wanna open it up. uh I actually intended for this to be like a 20 minute conversation, but like this, it was no. No don't be sorry by any.

A

This has been super fascinating and I think that uh you brought up a ton of really really great uh points and you summarize and synthesize kind of the sides and really well, and I think that in the future, when you know the forum threads go up and when people actually do discuss the trade-offs, I'm totally gonna reference like this recording because you know it.

A

You know you raise a lot of great points and like uh yeah totally, uh so I wanted to open it up to the chat and to the people watching uh generally speaking, uh if you have any additional questions, feel free to throw them, throw them up I'll, happily relay them to kurt uh yeah, and then let me just take a second catch, my breath and kind of look over and see.

A

If I have any additional questions, I do have actually one thing to mention: if you're an mkr holder and you are supplying liquidity to balancer or uniswap or even ave, it should be understood that you're kind of giving up your vote and not just giving up your vote, but also offering it up to a person or you know anybody.

A

So just a heads up on that in case you just didn't click in your head. Yet.

A

All right cool, I don't think I see anything too. uh Oh yeah there. It is uh so frank, cruz asks. With regards to the b protocol flash loan. The poll got 51 000 mkr votes, so is it fair to say that it was going to pass regardless of the flashlight.

B

You know this. This is a really a question that is like a side angle into a really kind of detailed discussion with a lot of philosophical points. So I love it. I I actually like hard questions like this. So um was it going to pass. You know, I don't have a crystal ball. I have no idea um why people had or hadn't voted on that. um So I don't think you can say it was definitely going to pass. You know it was. I think you can say it was pretty close to passing.

B

I think the amount of the flash loan was only like what 10 or 11 000 mkr 12k cool cool. So you know it certainly wasn't like a wildly unpopular proposal and we have that we have this issue with like participation in governance anyway, where a lot of times, if people think something's going to go their way, they won't, you know, spend the gas on the voting transaction or they just don't or that like there's, just like the apathy problem as well, and so it's really hard to say whether people's views were well represented or not.

B

um You know, there's also like a. I think. The tricky thing that this gets into is like you know like, was it appropriate or was it some like violation of some social contract, uh which is a a broader discussion throughout the blockchain space? I think you know on one side you have like the very code is law. um Point of view, which you know here. The wall of the code was quite quite clear. um What what could happen- and you know that was never a hidden thing.

B

um You know it had been discussed before that this that this could happen um and then there's like the the whole argument like well, but you know you're supposed to have skin in the game when you're voting with mkr, and I can see both sides of it, you know for for what it's worth. I don't think there was any like bad intention on the part of be protocol here.

B

uh You know I've interacted with them a bit uh on like the development side because since they integrate with us, you know they ask us questions, and you know I think, they're a really great, like innovation that can help with liquidations and keeping the system. You know safe and secure, like hoping with a black thursday kind of uh scenario. So you know maybe now that the protocol is live.

B

That helps us actually feel safer um about having this long governance delay and our our instant access modules turned off, um and so you know I I don't want to try to give any like opinion one way or the other on this, because you know I can see both sides and also given my position here in the ecosystem. It's probably not appropriate for me to express a view on that.

B

So I'll just say, you know, make your own decisions and hash it out on the forum, and I I look forward to seeing uh what what the outcome is vision here, cool so kurt. What's your opinion with regards to incentivized voting very quickly, I love the idea of incentivized voting. um I think you know we should think hard about, um and I use we in the sense of like the royal we of the whole, like maker community.

B

You know think very hard about how we can increase governance participation. What needs to happen there?

B

You know, because the fundamental organ of the system already is that, like mkr holders provide a backstop to the system and on the flip side, they're exposed to you know acquiring the profits of the system in some way, uh like they'll benefit. Basically, if they govern well and they they won't benefit uh if they govern poorly.

B

But we have this like pro. This free rider problem right now, where you know the people who just hold mkr can profit from the efforts of the those who are active in governance. If they just sit there and hold it, and you know, I think that going back to the whole, like um code, is law versus social intentions um or social construction.

B

You know that certainly violates like the social contract of mkr that that's even possible, um and so that comes back to us as as a community and a project to think through the mechanism and incentive design there and really say you know, how can we make make it uh appropriate for mkr holders to particip?

B

How can we get mkr holders to participate in government more readily and not have this free writer thing, and you know, since they're exposed to upside from the system anyway, having some sort of reward or incentive mechanism, there is just like basically direct mkr holders directly paying themselves for governing, uh which I think is consistent with the intent of the system.

A

Yeah that makes sense, uh which actually gives me a nice uh moment to plug this. But recently a declaration of intent was passed in the actual last executive vote before this one uh for the strategic reserves fund. So sub-ventures actually put this up uh and mkr. Voters have signaled that they are interested in uh affirming this declaration of intent and he is actually going to be coming on to the community call on november 24th.

A

I believe so in three weeks from now and we're going to talk a little bit about the strategic reserves fund, what the differences between that and the surplus buffer, the different ways that the srf can be used and- and this is kind of one way that it could be used- is to help fund uh mkr, voter incentivization, even like gas refunds and like different stuff like that, so uh so yeah. I just wanted to plug that and here's the declaration of the link to that declaration of intent.

A

If you'd like to read about the strategic reserves fund.

B

I didn't know about that: I'll have to check that out, yeah no I'll, say in the short term. By the way. With regards to incentive voting, you know we don't really have a plan for this for the dss gov contract. um You know it's an open discussion, whether we want to try to work something in there or save that for a future upgrade or bolt that, on top with with another module, um there are also discussions around like making it cheaper and easier to participate in governance.

B

um You know you can think you can imagine say using some sort of l2 solution so that gas is much cheaper. You know, like I think, we'd have higher participation, because if you didn't have to pay like a dollar or something for a transaction, although gas has been cheaper lately, which is nice, um but.

A

Yeah and the and the governance pulls you can put them all on one ballot now. So that's also a huge plus yeah yeah.

B

So so I don't think it's I don't think like pure incentivization is the only solution to look into, I think just making it a better user experience in terms of cheap, easy, but still secure and white rights preserving to vote. uh I I think those should be pursued too, um and we are looking into things along those lines as well.

B

By we I mean smart contracts, the main team and the foundation technical teams. I have to be very careful with the word. We uh sorry feel free to ask for clarification. If you don't know who I mean with my plural first person, pronouns and but I think the community should also be thinking about that too.

B

You know, even if you aren't on a domain team or in the foundation, you know, because, ultimately, the protocol is whatever mkr holders vote in. So here's a question, frank frank is knocking it out of the park with questions today. I love it. How hard difficult would it be to code incentives into the dss gov contract?

B

um Well, how long does this call go david.

A

It goes until the top of the hour, so I'm.

B

A

To continue this conversation, it's it's great. Questions are coming in yeah, I'm happy.

B

A

Relay, if you want make a relay, there's a green button right there, just click on it. Episode 19 came out yesterday, you can get all the usual updates there.

B

All right, thank you david, so I'll go ahead and answer frank's question here: how hard difficult would it be to code incentives into the css go contract? Well, so just coding them in is not that hard. The question is: are they the right incentives?

B

um Do they have the the flexibility you need um and then you have to you, get additional need for testing and additional work in the security audits that come from that, so it could so number one. They could introduce some risk of delaying the timeline. It's like it's not that hard, but it is a very tricky thing and a thing you want to get right. For example, anytime you introduce something. That's essentially call function, get money into your contracts. You have to think very carefully. Is that exploitable?

B

uh You know we're having a discussion like that right now, with liquidations 2.0, we want to add an incentive for keepers who trigger liquidations, but we're now we're adding a function. That's like you know, call function, get money. uh Is there any way that could be abused right? Is there any abuse vector um you know?

B

Is it going to incentivize the right behavior that we want, and so it's it's not hard from a coding perspective, it's more hard from like a game theory, an economic design perspective, and you know, honestly, I think you know it needs to be like a broader community discussion, um because it's you know it has implications for all mkr holders, and so it wouldn't be that hard technically other than maybe introducing some delays. I think the hard part is the you know, getting something: that's consistent with the social contract and doesn't introduce abuse or perverse incentives.

B

A

Yeah, I muted uh yeah, that's a really well balanced answer, and I think that, just as an encouragement, if you are interested in talking voter incentives, uh I highly suggest you engage on the forums. I also want to take this moment to plug source cred, so source cred uh also is actually um so.

A

This month's uh mips governance cycle is actually voting to fund source cred for another quarter, uh and if you don't know what source credit is, if you are a participant on the forum, you can opt in and based on your comments, your likes, your general participation, there's an algorithm that kind of reads that and actually pays you out in die for participating in the uh the communicative layer of maker governance. So uh definitely opt-in.

A

If you haven't and engage in these like really really keystone conversations, because they're gonna have long lasting effects uh and getting it right, as kurt said, is, is of paramount importance. Yeah.

A

uh So the question frank is asking: is uh getting incentive code? Getting the incentive? Incentives coded would require a mip, not necessarily I imagine that there could be like there's a technical nip and there's non-technical moves. I kind of have to go back and do my homework a little bit, but I think even before technical mip is presented, there's uh premium discussions, there's requests for comment stages uh and I think right now where the incentives for voting is as a general issue is probably in the pre-mip discussion phase.

A

So if there isn't a forum thread- and I can't think of one off the top of my head now- where that conversation is already happening, I highly suggest somebody in the community to bring it up. uh Yeah, I gotta, I'm gonna go dig into the forums after this call and kind of see what I can dig up on that front.

B

Yeah, it's it's a. I think it becomes a question for the community of. Is that big enough to be its own mip because, like we have an existing dss government that may or may not go to formal submission status and get voted on fairly soon and then there's the ability to do mip subproposals on top of something. So it's sort of like you know, would it be if there's enough alignment from the community?

B

Probably it would be the critical question in the case that there's enough alignment, you could probably do it with subproposals if it becomes a very big or controversial thing uh or or we just determined that there's a lot of lead time needed to discuss it. You know, then you know, maybe maybe a full mip is more appropriate, but I think it all depends yeah. I I was just talking about bigger than that with derek this morning. Actually, david, then we, it may be formulated with the hard hard deployment yet or not.

A

Yeah, I I heard it's kind of like on the edge because of what happened with the flashlights kind of getting pushed back a little bit and yeah.

B

I mean you know, the thing is like as far as flash loans go, they don't affect the new dss gov because it already defends against them. uh It just becomes a question of like. Is there a reason not to do it like? How much are we going to need to change it? um But if we can do it through subproposals, um you know or so long as the changes that come can be done through that there wouldn't need to be like another.

B

You know like three month, rfc phase, so I I'm not sure exactly what derek has has finally decided on he's he's the one kind of making the final call and post or not, but.

A

And for more context, also, there is a a mip going into this month's november's governance cycle for calendar exceptions, which is proposing to actually skip the december governance cycle altogether.

A

uh Now to caveat that the first two weeks of december will still be totally open to have the weekly governance cycle in case there are any like expedited or like special governance things that we want to do as a community but kind of because almost universally uh the last two weeks of of december are kind of high holidays uh yeah. That proposal is being put up to governance to skip december, so if dss gov doesn't go into november uh and we still wanted to go through a monthly governance cycle, the earliest would be probably january.

A

So the start of the new year.

B

A

B

As well and yeah we're, you know, we'll figure it out. I mean from a from a realistic perspective.

B

You know, dss gov, probably won't be ready to launch in january anyway, would be my guess, and just just looking at how much is on the smart contracts domain teams plate and how things are going and yeah holidays coming up like, like you say, well, the smart contracts, the main team might not mind a holiday themselves, just with my phone to plug to anybody who's like voting on that or discussing it.

B

Considering that you only because there you only have a limited number of people on that team and uh they they probably want a holiday at some point too. So I'm I'm not opposed.

A

The smart contracts team doesn't need holidays. We just need to um vote in.

B

A

To their desks and like no you're.

B

A

You guys uh of everybody, you guys totally uh deserve the holiday. I mean this whole year, like mcd, launched uh about a year ago now and uh and yeah. uh It can't be understated the amount of just sheer productivity that has come out of the smart contracts team. It's like actually quite astounding.

A

uh Every month, you guys are putting out like rapid fire like tons of work, so a huge shout out to the entire smart contracts team and any smart contract kind of domain contributors as well.

A

I think kurt is frozen.

A

Oh, no all right well we're at the top of the hour. I kind of wanted to let give kurt here. I'm gonna invite him back on screen for a sec, uh but I wanted to give kurt, obviously a chance to say bye, uh but anyway. I hope that uh this call was very informative to you all uh and uh I'm definitely gonna be putting this link up uh for discussions in the forum and stuff and again highly encourage anybody to join in these discussions.

A

uh They are very interesting, sometimes very elaborate uh and yeah with that. Thank you for watching uh and yeah. So.

A

Yeah kurt's computer died all right well. Thank you everybody. uh This was a great one. Take care.