Cancellers’ Governance Attack: TrueFi's Safeguard or Shackles?

[han]

@Cicada.Partners

For the unacquainted, the power of cancellation has already been granted to the multisig via TFIP-6, but since this is the first time the DAO has experienced such a scenario, it makes sense to request feedback before canceling the proposal.

They mean Teragon’s proposal, of which I am a co-founder of. The all-caps titled thread opened by cancellers has a discussion on our case, refuting the baseless accusations made against us.

There is a need for a meta discussion about the role and responsibilities of the cancellers. Therefore, I am opening this thread to address meta topics related to potential cancellation discussions.

Background discussions from 2023 about granting canceller rights to the current cancellers:

• [TFIP-6] Assign CANCELLER role for TrueFi DAO Governance
• [TFIP-6] Assign CANCELLER role for TrueFi Governance - modified

Quotes from them:

@kaimi

After last week’s Tornado Cash governance attack it seems increasingly important to protect the DAO from a similar scenario.

@kaimi

Following security measures have been undertaken:

• All signers are using hardware wallets
• Members are geographically dispersed
• There is a stringent procedure in place for reviewing all transactions, which includes performing reviews and simulations before execution.

Multisig Settings

Multisig threshold is 3/6.

Signers

• 2 persons coming from Archblock ecosystem
• 2 persons connected to Wallfacer
• 2 long-time community members.

@kaimi

What CANCELLER can do:

• In case there is a proposal that is faulty or adversarial - canceller can execute a transaction that would render the proposal ineffective.

What CANCELLER can’t do:

• Canceller can NOT make any decisions or execute any transactions on behalf of the DAO. Its only power is to CANCEL proposals.

@kaimi

Risks:

It is worth noting that there are certain scenarios where CANCELLER could actually collude with a black hat hacker to extract value from protocols by delaying “rescue proposals”. As a result, CANCELLER should be treated as a temporary measure until there is more value in the protocol and/or a better solution is found.

Facts:

• Cancelling mechanisms are vital for securing on-chain governances.
• TrueFi’s canceller multisig was designed to protect against clear and malicious attacks on the DAO.
• TrueFi’s cancellers have not been chosen transparently or democratically.
• TrueFi’s cancellers are affiliated with TrueFi’s (currently not active) service providers.
• On TFIP-6, only a single non-affiliated individual asked a question, which went unanswered.
• The Tornado governance hack was a sophisticated attack that involved hiding obfuscated malicious code within an on-chain governance proposal executable.
  • Quote from the linked CoinDesk article: “This was done by putting forth a proposal that imitated an earlier version – except with some malicious code that allowed for the update of logic that gave the attacker access to all governance votes.”
  • Respected blockchain security firm Halborn’s founder Rob Behnke’s analysis: Explained: The Tornado Cash Hack (May 2023)
• TrueFi’s cancellers failed in their duty to inspect executable proposal code for malicious intent.
  • Emphasized from TFIP-6: There is a stringent procedure in place for reviewing all transactions, which includes performing reviews and simulations before execution.
  • We carefully crafted the on-chain proposal, conducting thorough in-house reviews, comparing it against expected transaction signatures, and simulating the transactions to ensure its safety.
  • No one has approached us regarding the security of the executable code. Specifically, we have not been approached by the cancellers about the security of the executable code.
  • As far as our community, the board of directors, or Teragon know, the cancellers failed to review the code.
  • If we had malicious intentions, the DAO and TRU tokens would have been severely compromised.
• TrueFi’s cancellers bullied a proper proposal by threatening to cancel a vote.

My Questions:

• Would canceling a legitimate proposal constitute a governance attack?
• Are TrueFi’s current cancellers acting as safeguards or shackles?