Partnered With:

A16z: How can DAO governance attacks be identified, evaluated, and avoided?

a16z crypto

Read this article in 16 Minutes

A framework for analyzing vulnerabilities faced by different projects, assessing and addressing vulnerabilities

原文标题：《 A16z：避免 DAO 治理攻击的三种方式》

Original source: A16Z

The original article was written by Pranav Garimidi, Scott Duke Kominers and Tim Roughgarden

The Way of DeFi

很多 Web3 项目使用可互换且可交易的原生 Token 来进行无许可的投票，无许可投票可以提供很多的好处，从降低准入门槛到增加竞争。 Token持有者可以使用他们的 Token，对一系列问题进行投票，从简单的参数调整到治理过程本身的彻底检修。（有关 DAO 治理的回顾，请参阅「Lightspeed Democracy」这篇文章）然而，无许可投票很容易受到治理攻击，即攻击者通过合法手段（例如在公开市场上购买 Token）获得投票权，然后使用该投票权为攻击者自身的利益来操纵协议。这些攻击纯粹是「协议内」攻击，这意味着它们无法通过密码学手段解决。相反，预防它们需要深思熟虑的机制设计。为此，我们开发了一个框架来帮助 DAO 评估威胁并应对潜在的攻击。

Governance attacks that have occurred in the real world

The problem of governance attacks is not only theoretical, but has already happened many times in the real world and will continue to happen.

举一个突出的例子，Steemit 是一家构建去中心化社交网络的初创公司，它建立在其 Steem 区块链上，该区块链拥有一个由 20 名验证者（witnesses）控制的链上治理系统。选民使用他们的 STEEM Token 来选出验证者，在 Steemit 和 Steem 获得发展的同时，孙宇晨制定了将 Steem 合并到 Tron 的计划，为了获得足够数量的投票权，孙联系了 Steem 的创始人之一，购买了相当于总供应量 30% 的 Token 。而当 Steem 的验证者发现了孙的购买行为之后，他们就冻结了孙的 Token 。此后，孙和 Steem 之间展开了公开争执，孙的目的是控制足够的 Token 来选出一个新的验证者名单，在一些交易平台的帮助下，孙最终获胜并有效地控制了 Steem 网络。

在另一个例子中，稳定币协议 Beanstalk 被发现容易遭受闪电贷治理攻击，一名攻击者获得了一笔贷款，以获取到足够数量的 Beanstalk 治理 Token ，从而立即通过了一项恶意提案，允许他们控制了 Beanstalk 的 1.82 亿美元储备资金。与 Steem 的治理攻击不同的是，Beanstalk 的攻击是发生在一个区块的时间范围内的，这意味着在任何人作出反应之前，攻击就已经结束了。

虽然这两次攻击是在公开场合和公众视线下发生的，但治理攻击也可以在很长的一段时间内秘密进行。攻击者可能会创建大量匿名账户，并缓慢累积治理 Token ，同时表现得像任何其他持有者，以避免被人怀疑。事实上，考虑到很多 DAO 的选民参与度往往很低，这些账户可能会长时间处于休眠状态而不会引起怀疑。从 DAO 的角度来看，攻击者的匿名账户可能有助于呈现健康水平的去中心化投票权。但最终攻击者可能会达到一个阈值，即这些女巫钱包有权单方面控制治理，而社区却无法做出回应。同样，恶意行为者可能会在投票率足够低时获得足够的投票权来控制治理，然后在许多其他持有者不活跃的情况下尝试通过恶意提案。

While we may think of all governance actions as the result of market forces at work, in practice governance sometimes produces inefficient results due to failed incentives or other loopholes in protocol design. Just as government decisions can be captured by interest groups or even simple inertia, DAO governance, if poorly structured, can lead to poor outcomes.

So how do we deal with such attacks through mechanism design?

Fundamental challenge: indiscriminability

Token 分配的市场机制，无法区分想要为项目做出有价值贡献的用户以及高度重视破坏或以其他方式控制项目的攻击者。在一个可以在公共市场上买卖 Token 的世界中，从市场的角度来看，这两个群体在行为上是没有区别的，两者都愿意以越来越高的价格购买大量 Token。

This indistinguishable problem means that decentralized governance is not free. Instead, protocol designers face a fundamental trade-off between publicly decentralized governance and protecting their systems from attackers who seek to exploit governance mechanisms. The more freedom community members have to govern and influence agreements, the easier it is for attackers to use the same mechanisms to make malicious changes.

这种不可区分性问题在权益证明（PoS）区块链网络的设计中很常见的，此外， Token 的高流动性市场使攻击者更容易获得足够的权益来破坏网络的安全保障。尽管如此， Token 激励和流动性设计的结合，使得 PoS 网络成为可能。而类似的策略可帮助保护 DAO 协议。

A framework for assessing and addressing vulnerability

To analyze the vulnerabilities faced by different projects, we use a framework captured by the following equation:

In order for the protocol to be secure (against governance attacks), the attacker's profit should be negative. This equation can be used as a guide to assess the impact of different design choices when designing governance rules for projects. To reduce the incentive to exploit the protocol, the equation implies three clear choices: make the attack less valuable, increase the cost of getting the right to vote, and increase the cost of executing the attack.

1. Reduce the value of attacks

Limiting the value of an attack can be difficult because the more successful the project, the more valuable the successful attack. Clearly, a project should not deliberately undermine its own success just to make an attack less valuable.

However, the designer can limit the value of the attack by limiting the scope of the governance function. If governance only includes the power to change certain parameters in the project (such as the interest rate of the loan agreement), then the scope of potential attacks is much narrower than if governance allows full control over the governance smart contract.

Governance scope can be a function of the project phase. There may be broader governance early in the project as the project finds its footing, but in practice, governance is likely to be tightly controlled by the founding team and community. As projects mature and decentralize control, it may make sense to introduce a degree of friction in governance -- at the very least, the most important decisions require the participation of a large number of community members.

2. Increase the cost of getting the right to vote

项目方还可以采取措施使获得攻击所需的投票权变得更加困难。 Token 的流动性越强，攻击者就越容易获得投票权，这几乎是自相矛盾的，项目方可能希望为了保护治理而减少流动性。人们可以尝试直接降低 Token 的短期可交易性，但这在技术上可能不可行。

为了间接减少流动性，项目方可以提供激励措施，使个人 Token 持有人不太愿意出售。这可以通过激励性质押来实现，或者通过赋予 Token 超越纯粹治理的独立价值来实现。 Token 持有人获得的价值越高，他们就越能与项目的成功保持一致。

独立 Token 的好处可能包括亲身参与活动或社交体验。至关重要的是，这样的好处对与项目方合作的个人来说是很有价值的，但这对攻击者来说是无用的。提供这些好处会提高攻击者在获取 Token 时面临的有效价格：由于独立的好处，当前持有人将不太愿意出售，这会提高市场价格，然而，虽然攻击者必须付出更高的代价，但独立功能的存在并没有提高攻击者获取 Token 的价值。

3. Increase the cost of executing attacks

除了提高投票权的成本外，我们还可以引入摩擦，使攻击者即使在获得 Token 后也更难行使投票权。例如，设计人员可能需要某种用户身份验证才能参与投票，例如 KYC 检查或声誉分数阈值。人们甚至可以首先限制未经认证的参与者获取投票 Token 的能力，可能需要一些现有的验证者来证明新参与方的合法性。

从某种意义上说，这正是许多项目分配其初始 Token 的方式，确保受信任方控制很大一部分的投票权。（很多权益证明解决方案使用类似的技术来保护其安全性，即严格控制谁有权获得早期权益，然后逐步去中心化）

或者，项目方可以这样做，即使攻击者控制了大量投票权，他们在通过恶意提案时仍然面临着困难。例如，一些项目有时间锁的设定，因此在交换后的一段时间内无法使用 Token 进行投票。因此，试图购买或借入大量 Token 的攻击者将面临额外成本，因为他们需要等待才能真正投票，并且投票成员可能会注意到并阻止他们的潜在攻击的风险。委托在这里也很有帮助，通过赋予积极但非恶意的参与者代表他们投票的权利，不想在治理中发挥特别积极作用的个人，仍然可以为保护系统贡献他们的投票权。

Some programs also use veto mechanisms that allow voting to be delayed for a certain period of time to alert inactive voters to potentially dangerous proposals. Under such a scheme, even if an attacker makes a malicious proposal, voters have the ability to respond and shut it down. The idea behind these designs is to deter attackers from sneaking through malicious proposals and provide time for the project community to formulate a response. Ideally, proposals that are clearly in the interest of the agreement do not have to face these obstacles.

For example, in a Secret DAO, veto power is held by a Secret foundation until the DAO itself is ready to implement alternatives. As they write on their website:

"A Secret about the Foundation will veto proposals that pose significant legal or existential risk to a Secret DAO or a Secret about the Foundation."

Project parties must strike a balance that allows for a degree of openness to community changes that may sometimes be unpopular, while not allowing hostile proposals to slip through the cracks. Generally, it only takes one hostile proposal to invalidate an agreement, so it is critical to clearly understand the risk tradeoffs of accepting and rejecting a proposal. Of course, there is a high level of tradeoff between ensuring governance security and enabling governance, because any mechanism that introduces friction to deter potential attackers will of course also make the governance process more challenging.

The solution we outline here falls somewhere between fully decentralized governance and sacrificing some of that decentralization for the overall health of the protocol. Our framework highlights the different paths that project parties can take when seeking to ensure that governance attacks are not profitable. We hope that the community will use this framework to further develop these mechanisms through their own experiments, making DAOs more secure in the future.