Partnered With:

Vitalik Buterin: Governance beyond token voting

Read this article in 46 Minutes

One of the key trends in the blockchain space over the past year has been the transition from focusing on DeFi to also thinking about decentralized governance (DeGov)

原文标题：《 Moving beyond coin voting governance 》

The original author: & NBSP; Vitalik Buterin

& NBSP; DAOctor @DAOrayaki

Special thanks to Karl Floersch: Dan Robinson and Tina Zhen for their feedback and review. See "Notes on Blockchain Governance," "Governance, Part 2: Chaebol Are Still Bad," and "On Collusion and Coordination, Good and Bad," for early thoughts on similar topics.

An important trend in the blockchain space over the past year has been the transition from focusing on decentralized finance (DeFi) to thinking simultaneously about decentralized governance (DeGov). While 2020 is often widely and justly hailed as the Year of DeFi, the increasing complexity and capacity of the DeFi projects that make up the trend in the year since has led to a growing interest in decentralized governance to deal with this complexity. There are some examples inside Ethereum. YFI, Compound, Synthetix, UNI, Gitcoin and others have all started and even started using some kind of DAO. The same is true outside of Ethereum, with discussions about infrastructure funding proposals in Bitcoin Cash, infrastructure funding votes in Zcash, etc.

The rise in the popularity of some form of formal decentralised governance is undeniable, and there are important reasons for interest. But it is also important to bear in mind the risks of such a plan, as the recent hostile takeover of Steem and subsequent mass exodus to Hive have made clear. I further believe that these trends are inevitable. In some cases, decentralized governance is both necessary and dangerous, for reasons I'll explain in this article. How can we reap the benefits of decentralized governance while minimizing the risks? I'll argue a key part of the answer: we need to go beyond token voting in its current form.

DeGov is necessary

Since the 1996 Declaration of Independence in Cyberspace, there has been a key unresolved contradiction in what might be called cyberpunk ideology. On the one hand, cyberpunk values were all about using cryptography to reduce coercion and maximize the efficiency and scope of the major non-coercive-coordinating mechanisms of the time: private property and the market. On the other hand, the economic logic of private property and markets is designed for those who can be treated by" Decomposition & have spent" Optimized for repetitive one-to-one interactions, the infosphere, in which art, documentation, science, and code are generated and consumed through irreducible one-to-many interactions, is the exact opposite.

In such an environment, there are two key problems inherent in it that need to be addressed.

Funding public goods: How to fund projects that are of value to a broad, unselected population in the community, but that often have no business model (e.g., Layer 1 and Layer 2 protocol research, client development, documentation......) ?

Maintenance and upgrade of the protocol: how the protocol is upgraded and periodic maintenance and adjustment operations are performed on the chronically unstable parts of the protocol (e.g., security asset list, price predictor source, multi-party computing key holder). How is it agreed?

Early blockchain projects largely ignored both challenges, pretending that the only important public benefit was cybersecurity, which could be achieved by permanently fixed single algorithms and paid for with fixed proof of work rewards. This financial situation was initially possible because of the fact that * NBSP; The price of Bitcoin rose sharply in 2010-13, then. The ICO boom of 2014-2017, as well as & NBSP; A second crypto bubble occurred simultaneously in 2014-2017, all of which made the ecosystem rich enough to temporarily mask huge market inefficiencies. The long-term governance of public resources is also ignored: Bitcoin goes to extreme minimization, focusing on providing a fixed supply of money and ensuring support for networks like Lightning. Tier 2 payment system, that's all. Due to the strong legitimacy of its pre-existing roadmap (basically: "proof of interest and sharding"), Ethereum continues to evolve harmoniously (with one major exception), while projects requiring more complex application layers do not yet exist.

But now that luck is running out, coordinating the challenges of maintaining and upgrading protocols and funding documentation, research, and development while avoiding the risks of centralization has become a priority.

DeGov needs to fund public goods

It is worth stepping back and looking at the absurd state of affairs. The daily mining release rewards from Ethereum are approximately & NBSP; 13500 ETH, i.e. about & NBSP; $40 million. Transaction costs are equally high; Non & have spent The burned portion of IP-1559 is still about & NBSP; 1,500 ETH (about $4.5 million). As a result, billions of dollars are spent each year to fund cyber security. Now, what is the budget of the Ethereum Foundation? Each year about & have spent $300,000 to $60 million. Have not & have spent EF participants (e.g. Consensys) contribute to development, but they are not very large. In a similar case with Bitcoin, there may be even less money for less secure public goods.

Here's what happens in the chart:

In the Ethereum ecosystem, it turns out that this difference doesn't matter; Tens of millions of dollars a year are "sufficient" to do the research and development needed, and adding more money will not necessarily improve the situation. Therefore, the risks of establishing the credible neutrality of developer funds to the platform within the agreement outweigh the benefits. But the same debate is brewing in many smaller ecosystems, including those within Ethereum and fully independent blockchains like BCH and Zcash, and at these smaller scales, imbalances make a big difference.

进入 DAO。一个从第一天起就作为 "纯 "DAO 启动的项目，可以实现以前不可能结合的两个属性的组合。(i) 开发者资金的充足性，和 (ii) 资金的可信中立性（人们梦寐以求的「公平启动」）。开发者的资金不是来自一个硬编码的接收地址列表，而是可以由 DAO 本身做出决定。

Of course, it's hard to make a launch completely fair, and the unfairness caused by information asymmetry is often worse than the unfairness caused by explicit preconditions. (Is Bitcoin really a fair start, considering that few people had a chance to hear about it when a quarter of the supply had been distributed in late 2010? But even so, in-agreement compensation for unsafe public goods from day one seems to be a potentially important step toward securing adequate and more credible funding for neutral developers.

DeGov requires protocol maintenance and upgrade

In addition to public goods funding, another equally important issue that needs to be addressed is protocol maintenance and upgrading. While I advocate keeping all non-automated parameter adjustments to a minimum (see the "Limited Governance" section below) and I am a & NBSP; Fans of RAI's "non-governance" strategy, but sometimes governance is unavoidable. The input has to come from somewhere, and sometimes somewhere needs to change. Improvements must be co-ordinated in some way before the agreement "rigidifies" into final form. Sometimes, communities in agreements may think they are ready for rigidity, but then the world throws a curve ball that requires a complete and controversial restructuring. If the dollar collapses, RAI will have to scramble to create and maintain its own decentralisation. What happens to the CPI index to keep its stablecoin stable and relevant? Here, too, DeGov is necessary, so avoiding it altogether is not a viable solution.

An important difference is whether off-chain governance is feasible. I've long been a fan of off-chain governance as much as possible. In fact, for the underlying blockchain, off-chain governance is definitely possible. But for application-layer projects, especially for &NBsp; For defI, the problem we encountered was that application-level smart contract systems often directly control external assets, and that control cannot fork. If & have spent Tezos's on-chain governance is captured by attackers, and communities can hard fork without incurring any loss (admittedly high) coordination costs. If & have spent With MakerDAO's on-chain governance captured by attackers, the community can definitely start a new & NBSP; MakerDAO, but they will lose all remaining in existing. In the MakerDAO CDP & NBSP; ETH and other assets. Thus, while off-chain governance is a good solution for the base layer and some application layer projects, many application layer projects, especially & NBSP; DeFi, inevitably, requires some form of formal on-chain governance.

It is dangerous to DeGov

However, all current examples of decentralized governance come with significant risks. For followers of my post, this discussion is nothing new; The risks are much the same as those I discuss here, here, and here. My concerns with token voting fall into two main categories. (I) misaligned inequality and incentives even in the absence of an attacker, and (ii) outright attacks through various forms of (often obscure) ticket buying. For the former, there are already many proposed mitigation measures (e.g., mandates) and more to come. But the latter is the more dangerous elephant in the room, and I don't see a solution in the current token voting paradigm.

Even without an attacker, there are problems with token voting

Even without a clear attacker, the issue of token voting is increasingly understood (see, for example, DappRadar and & have spent Monday Capital's recent post) and falls into several categories:

A small group of wealthy participants (" whales ") is better at executing decisions successfully than a large group of minority shareholders. This is because of the tragedy of the Commons among minority shareholders: each has only a negligible influence on the outcome, so they have no incentive to actually vote and not be lazy. Even if there is a reward for voting, there is little incentive to research and think carefully about what they are voting for.

Token voting governance empowers the benefits of token holders and token holders at the expense of the rest of the community: the protocol community is made up of different constituents with many different values, visions, and goals. However, token voting gives power to only one constituency (token holders, especially wealthy ones) and leads to undue emphasis on the goal of making token prices rise, even if this involves harmful rent withdrawals.

Conflict of interest issues: Giving voting rights to a constituency (coin holders), especially by over-empowering the wealthy in that constituency, risks over-exposure to conflicts of interest of that particular elite class (e.g., investment funds or holders of tokens of other DeFi platforms that also interact with the platform).

To solve the first problem (and thus alleviate the third), one major strategy is being tried: delegation. Minority shareholders do not have to judge every decision themselves; Instead, they can delegate to a community member they trust. It was a glorious and worthwhile experiment; We will see how well empowerment can alleviate the problem.

I am in & have spent Voting delegate page in Gitcoin DAO

On the other hand, the problem of mine-centrism is obviously more challenging: Mine-centrism is inherent in a system, and mine-holder voting is the only input. The misconception that monetarist centrism is an intended goal, not a mistake, has caused confusion and harm; A (very good) article on blockchain public goods complains:

Can encryption protocols be considered a public good if ownership is concentrated in the hands of a few whales? In layman's terms, these market primities are sometimes described as "public infrastructure," but if blockchain serves the "public" today, it is primarily a form of decentralized finance. Fundamentally, these token holders have only one common concern: price.

This complaint is wrong; Blockchain serves to improve the quality of life. A richer and wider public of DeFi token holders. But our token voter-driven governance system is completely unable to capture this, and it seems difficult to build one that captures this richness without a more fundamental paradigm change.

Token voting has a deep intrinsic vulnerability to attackers: buying tickets

The problem gets worse once the attacker who is trying to subvert the system is identified and entered the picture. The basic flaws of token voting are easy to understand. A token in an agreement with a token vote is a bundle of two rights combined into a single asset :(I) certain economic interests in the revenue of the agreement and & NBSP; (ii) The right to participate in governance. This combination is intentional: the goal is to align authority and responsibility. But in practice, the two rights are easily separated from each other. Imagine a simple packaging contract that has these rules: If you are going to 1 XYZ is deposited into the contract, you will get & NBSP; 1 WXYZ. WXYZ can be converted back to & NBSP; XYZ, and it can also accumulate dividends. Where does the dividend come from? Well, though. The XYZ tokens are in the wrapper contract, but the wrapper contract can use them freely in governance (making proposals, voting on proposals, etc.). The encapsulated contract simply auctions the rights each day and distributes the profits to the original depositor.

As & have spent Holder of XYZ, is it in your interest to deposit your token into the contract? If you're a very large holder, it probably isn't; You like dividends, but you fear what a misaligned actor might do with the governance power you sell. But if you're a smaller holder, then it fits perfectly. If the governance rights of the encapsulated contract auction are bought by an attacker, you personally will only suffer a small portion of the cost of the bad governance decisions caused by your token, but you personally will receive the dividend of all the benefits of the governance rights auction. This situation is a classic tragedy of the Commons.

Suppose an attacker makes a decision that disrupts & NBSP; DAO, thus benefiting the attacker. How does success hurt each participant? What is the probability of a single vote tilting the outcome? Suppose the attacker was bribed. ? The game diagram looks like this:

Decisions are good for you and good for others

Take a bribe from an attacker

Reject the bribe and vote your conscience

If & have spent , you are inclined to accept bribes, but as long as & NBSP; Taking bribes is bad for the group. Therefore, if (usually much lower than & NBSP; , attackers have the opportunity to bribe users to take net negative decisions, compensating each user far less than the harm they have suffered.

A natural criticism of voter bribery fears is: Can voters really be so immoral as to accept such obvious bribes? Ordinary & have spent DAO token holders are a zealot, and it's hard for them to be satisfied with such a selfish and blatant sale of the project. But this ignores the fact that there are more obfuscating ways to distinguish between profit-sharing rights and governance rights that do not require anything as clear as a encapsulated contract.

The simplest example is from Defi lending platforms (e.g. Compound) loan. Already held & NBSP; People at ETH can bring their & NBSP; ETH is locked into one of these platforms. In the CDP (" collateralised debt position "), the CDP contract allows them to borrow once they do so. A certain amount of XYZ, for example. They put in. Half the value of ETH. And then they can use this. XYZ do whatever they want. To reclaim their & NBSP; ETH, they eventually have to pay back what they borrowed. XYZ plus interest.

Please note that throughout this process, the borrower has been on the right side of & NBSP; XYZ has no financial risk. That is, if they use their & NBSP; XYZ voted for sabotage. XYZ value of governance decisions, they will not lose a penny. Their holdings of & NBSP; XYZ is & have spent XYZ, they have to pay back in the end anyway. CDP, so they don't care if its value goes up or down. So we have a split: the borrower has governance without economic interest, and the lender has economic interest without governance. Some & have spent The DAO protocol is using techniques like time locks to limit people's ability to participate in such attacks, but ultimately time locks can be circumvented; As far as security is concerned, time locks are more like paywalls on newspaper websites than locks and keys.

There are centralised mechanisms that separate the right to share profits from the right to govern. Most notably, when users deposit their tokens on a (centralized) exchange, the exchange holds full custody of those tokens, and the exchange has all the ability to vote with those tokens. This is not purely theoretical; There is evidence that exchanges use their users' tokens in several DPoS systems. The most obvious recent example was the hostile takeover attempt on Steem, where exchanges used their customers' tokens to vote in favor of proposals that would help cement the takeover of the Steem network, and the majority of the community strongly opposed it. The situation was only resolved by a complete mass exodus, with most of the community moving to another chain called Hive.

Currently, many blockchains and & NBSP; The DAO has managed to avoid the most serious forms of these attacks. There are occasional signs of attempted bribery.

But despite all these important issues, simple economic reasoning suggests far fewer instances of direct voter bribery, including in obscure forms such as the use of financial markets. The question to ask is: Why haven't there been more direct attacks?

And I said, "Why not? "Depends on three contingent factors that are true today but may become less and less true over time.

Community spirit comes from having a close-knit community where everyone feels a sense of camaraderie in a common tribe and mission.

The wealth of token holders is highly concentrated and coordinated; Big holders have a higher ability to influence outcomes and invest in long-term relationships with each other (both the old boys' club of VENTURE capital and many other equally powerful but underrepresented groups of wealthy token holders), and this makes them harder to bribe.

Immature financial markets for governing tokens: off-the-shelf instruments for creating encapsulated tokens exist as proof-of-concept but are not widely used, there are bribery contracts but are equally immature, and lending markets are illiquid.

When a small number of coordinated users hold more than 50% of the tokens, and they and other users are invested in a tight-knit community, and few of the tokens are lent out at reasonable rates, all of the above bribery attacks may still be theoretical. But over time, no matter what we do, (1) and (3) will inevitably become less real, and (2) must become less real if we want DAO to be fairer. Will the DAO remain secure when these changes occur? If token voting does not consistently defend against attacks, what does?

The solution 1: Limited governance

One possible mitigation to the above problem, and one that has been tried to varying degrees, is to place limits on what token-driven governance can do. There are several ways to do this.

Use on-chain governance only for applications, not the base layer: Ethereum already does this because the protocol itself is governed through off-chain governance, and on top of that, the Daos and other applications are sometimes, but not always, governed through on-chain governance -- chain governance.

Limit governance to fixed parameter choices: Uniswap does this because it only allows governance to affect & NBSP; (I) Token allocation and & NBSP; (ii) Uniswap Exchange's & NBSP; A 0.05% fee. Another good example is RAI's "non-governance" roadmap. Over time, governance has control over fewer and fewer functions.

Increase time delay: Governance decisions made at time T are only effective at, say, T+90 days. This allows users and applications that find the decision unacceptable to move to another application (possibly a fork). Compound has a time-delay mechanism in its governance, but in principle, the delay could (and ultimately should) be longer.

More fork friendly: Makes it easier for users to quickly coordinate and perform forks. This makes capturing governance less rewarding.

The Uniswap case is particularly interesting: & NBSP; This is expected behavior, and on-chain governance provides funding for teams that may develop future versions of the Uniswap protocol, but upgrade to those versions at the user's option. It's a hybrid of on-chain and off-chain governance, leaving only a limited role for one side on the chain.

But limited governance by itself is not an acceptable solution. The areas most in need of governance, such as the allocation of funds for public goods, are themselves the most vulnerable. Public-goods funds are vulnerable because attackers have a very direct way to profit from bad decisions: they can send money to themselves by trying to push a bad decision. So we also need technology to improve governance itself......

Solution 2: Non-token-driven governance

The second approach is to use a non-token voting driven form of governance. But if tokens don't determine an account's weight in governance, what does? There are two kinds of natural selection:

Personality proof system: A system that verifies that accounts correspond to unique individuals so that governance can assign one vote to each person. Check out comments on some of the technologies under development here, as well as the following: Proof Of Humanity and & have spent BrightID's two attempts to do just that.

Proof of participation: System that proves that certain accounts correspond to the fact that people participate in certain activities, through certain educational training, or perform some useful work in the ecosystem. Please see & have spent POAP to see how to do this.

There is also the possibility of mixing: one example is quadratic voting, which makes the power of individual voters proportional to the square root of the economic resources they are committed to. Preventing people from gaming the system by allocating their resources to multiple identities requires verification of people's identities, while the remaining financial component allows players to credibly indicate how much they care about an issue and how much they care about the ecosystem. Gitcoin quadratic fundraising is a form of quadratic voting and is in the process of building quadratic voting. The DAO.

Proof of participation is less well known. The key challenge is that determining the level of participation itself requires very strong governance structures. The simplest solution is likely to be through carefully selected. 10-100 early contributors to boot up the system, and then with the first & NBSP; N round of selected participants to determine the first & NBSP; The participation criteria for the N+1 round are gradually decentralized over time. The possibility of a fork helps provide a way to recover from a governance derailment and provides an incentive.

Both personality and participation certificates require some form of countercollusion (see article explaining the issue here and & NBSP; MACI document) to ensure that the non-monetary resources used to measure voting rights remain non-financial. And will not itself end up selling governance rights to the highest bidder in a smart contract.

Solution 3: The asymmetric trap

A third way is to break the tragedy of the Commons by changing the rules of the vote itself. Because of the failure of the scrip vote though voters have a collective responsibility for their decision (if everyone to vote for a bad decision, so every token is zero), but each voters don't accept personal responsibility (if a bad decision, the one who is, won't support it more painful than against it). Can we make a voting system that changes this dynamic so that voters are individually, not just collectively, accountable for their decisions?

If the fork is in accordance with & NBSP; The Hive from & have spent The way Steem forks is done, fork friendliness can be said to be a game strategy. If the destructive governance decision is successful and there is no longer any internal opposition to the protocol, the user can decide to fork. Also, in that fork, the tokens that voted for the wrong decision can be destroyed.

This sounds harsh, and may even feel like a violation of an implicit norm that "ledger invariance" should remain sacrosanct when forking tokens. But from one perspective, the idea seems more plausible.

We maintain the idea of a strong firewall in which personal token balances are not expected to be violated, but apply this protection only to tokens that do not participate in governance. If you participate in governance, even indirectly by putting your tokens into the encapsulation mechanism, then you may be liable for the costs of your actions.

This creates personal responsibility: If an attack occurs and your token votes in favor of the attack, your token will be destroyed. If your token did not vote for the attack, your token is safe. Responsibility spreads upward: If you put the token into the wrapper contract, and the wrapper contract votes for the attack, the wrapper contract balance is wiped out, so you lose the token. If an attacker from & NBSP; Defi lending platform borrowing XYZ, when the platform forks, any lending & NBSP; XYZ will fail (note that this makes lending governance tokens very dangerous in general; This is the expected result).

Asymmetric risk in daily voting

But that only applies to preventing really extreme decisions. What about small-scale robberies? Unfairly favors attackers to manipulate the economics of governance, but not enough to wreak havoc? What about simple laziness, in the absence of any attackers at all, and the fact that token voting governance has no selection pressure to support a higher quality opinion?

The most popular solutions to these problems are: Futarchy by & have spent Robin Hanson in & have spent Launched in the early 2000s. Voting becomes a bet: by voting yes, you bet on a good outcome for the proposal, while by voting against it, you bet on a bad outcome. Futarchy introduced personal responsibility for an obvious reason: if you bet well, you get more tokens, and if you bet badly, you lose your tokens.

It turns out that "pure" Futarchy is hard to introduce because in practice the target function is hard to define (people want more than just token prices!). , but in various mixed forms. Futarchy can be very effective. Mixed & have spent Examples of futarchy include:

Vote as a purchase order: see &NBSP; Ethresear. Ch posts. Voting in favor of a proposal requires creating an executable purchase order to purchase additional tokens at a price slightly lower than the token's current price. This ensures that if a bad decision succeeds, those who support it may be forced to buy out their opponents, but it also ensures that in more "normal" decisions, token holders can make more decisions based on non-price criteria if they wish.

Tracing public goods funding: see team Optimism's post. Public goods are retroactively funded by some sort of voting mechanism after they have already achieved results. Users can buy project tokens to fund their project while expressing confidence in it; If the project is deemed to have achieved its intended goal, the purchaser of the project token will receive a reward.

Upgrade the game: see Augur and & have spent Kleros. Value consistency of lower level decisions is motivated by the possibility of attracting higher level processes with higher effort but more accuracy; Voters who vote yes to the final decision will be rewarded.

In the latter two cases, mixed & NBSP; Futarchy depends on some form of non. Futarchy governance to measure the target function or as the final layer of controversy. This kind of future governance, however, there are few direct use without later: (I) the advantages of activation, so it can access more information, (ii) its use frequency is low, so you can spend less energy, and (iii) every time I use it will produce greater consequences, so only rely on bifurcation to adjust the last layer of the incentives are more likely to accept.

Hybrid solution

There are also solutions that combine elements of the above technologies. Some possible examples:

Time delay plus elected expert governance: This is a possible solution to the age-old conundrum of how to create a crypto collateralized stablecoin that locks in funds that can exceed the value of the earning token without the risk of governance capture. Stablecoins use the price Oracle of the median value submitted by n (for example, n = 13) of the selected provider. The token votes to select suppliers, but it can only loop out one supplier per week. If users notice that token voting leads to untrusted price providers, they do. N/2 weeks to switch to another stablecoin before the stablecoin breaks.

Futarchy + anti-collusion; = Reputation: Users vote on "reputation," a non-transferable token. Users gain more reputation if their decisions lead to the desired results, and lose their reputation if their decisions lead to unwanted results. See here for an article promoting reputation-based programs.

Loosely coupled (consultative) token voting: Token voting does not directly implement a proposed change, but only to make its results public, establishing legitimacy for off-chain governance to implement the change.

This can provide the benefits of token voting while reducing the risks, as the legitimacy of token voting is automatically diminished if there is evidence that token voting has been bribled or otherwise manipulated.

But these are just a few possible examples. There is still much work to be done in researching and developing non-token-driven governance algorithms. The most important thing that can be done today is to get rid of the idea that token voting is the only legal form of decentralized governance. Token voting is attractive because it feels neutral: anyone can vote in a & NBSP; Get some governance token units on Uniswap. In practice, however, token voting may only seem safe today because of the flaws in its neutrality (i.e., the fact that most of the supply is in the hands of a tightly coordinated small group of insiders).

We should be wary of the idea that the current form of token voting is a "secure default." Much remains to be seen about how they will operate under greater economic pressures and conditions in mature ecosystems and financial markets, and it is time to start experimenting with alternatives simultaneously.