0x3fb19771…4c8asent to0xc0da0293…6529·#20,500,199·view on Etherscan
# Add Proposal Guardian to Governor Bravo
## Summary
We propose to seek implementation of the community multisig to be used as a guardian for Compound Governance. The goal of this Proposal Guardian is to act as a last defense against any malicious governance votes in the future. Additionally, we propose a few future changes to the Compound Governor contract to be more robust in the future.
## Proposal Guardian
The Proposal Guardian would initially consist of the Community Multi-sig ([0xbbf3f1421D886E9b2c5D716B5192aC998af2012c](https://etherscan.io/address/0xbbf3f1421D886E9b2c5D716B5192aC998af2012c)), a 4/8 multi-sig composed of trusted Compound DAO community members ([here](https://www.comp.xyz/t/community-multisig-4-of-6-deployment/134/18)) which has been functioning as the Pause Guardian for the majority of Compound’s existence. This Proposal Guardian role should only be able to veto a proposal that has passed a majority vote and is awaiting execution. We have established this set of rules for when the Proposal Guardian is able to choose to move forward with a veto:
1. Users’ funds deposited into the protocol might be infringed or at risk by a proposal passing
2. If a vote has been controlled by a single entity or a proposal will result in a single entity taking effective control of the DAO
3. When necessary to coordinate pausing protocol functionality during urgent security emergencies to protect the protocol and user funds.
4. Serious considerations will be made when votes having received at least 400K “NO” votes still pass.
Update: Based on community feedback, the Proposal Guardian role will automatically expire to ensure that the Community Multi-sig cannot use its veto power to remain in-place indefinitely. The initial expiration period will be set to 6 months and require another governance proposal to renew. The additional changes are currently underway and will be ready to share and include in the on-chain proposal and forum post by this Friday.
## Technical Implementation
@Arr00 has completed technical work and OpenZeppelin has reviewed the changes to implement the Guardian changes in [PR16](https://github.com/compound-finance/compound-governance/pull/16). It introduces a new `proposalGuardian` role that can call the `cancel` function on any proposal and a `_setProposalGuardian` function to set the role. The PR also includes simulation tests to ensure the changes work as expected on-chain.
Please note that the [compound-governance repo](https://github.com/compound-finance/compound-governance) being used as the base for this upgrade was previously [audited by OpenZeppelin](https://github.com/compound-finance/compound-governance/blob/main/audit/OZ-Sept-23.pdf) as a new source for Compound governance with dedicated testing and coverage. It also introduces the ability to vote with reason and propose by signature.
## Timeline
Given the nature and sensitivity of this proposal, we will be moving forward in an accelerated timeline. The proposal will be discussed on the Community Call this week on Aug 7th and shared privately with all major identified delegates to collect final feedback. The proposal will then be published on the forums and submitted on-chain Friday, Aug 9th so that voting can begin early next week.
## Future
A full “Constitution” regarding when to get involved in veto votes will be drafted in the near future. Coupled with a concurrent new delegate race to get more Compound delegated and active in governance to trusted members of the DAO, this should set a new foundation for a more secure and active Compound governance!
Additionally, we propose exploring additional changes to Compound Governance to improve security and coordination in the future:
* Upgrade Compound Governor Bravo to use OpenZeppelin Governor that has more gas efficiency, security features and optional extensions. There is already a [CGP grant by ScopeLift](https://questbook.app/dashboard/?grantId=0xeb047900b28a9f90f3c0e65768b23e7542a65163\&chainId=10\&proposalId=664b6f438d3dfee9013f4a38\&isRenderingProposalBody=true) working on delivering this.
* Late Quorum Voting Period: If last minute votes change the outcome of a vote, additional time will be added on to the voting period to allow for more delegates to review and finalize decisions. A [Late Qurum Prevention extension](https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/governance/extensions/GovernorPreventLateQuorum.sol) is already available in OpenZeppelin Governor.
* Adaptable Voting Quorum: Quorum can increase based on the amount of delegated COMP once a proposal shifts from "review --> voting". If not technically feasible to automate on-chain, this could also be achieved by regularly adjusting the quorum threshold based on the current number of delegated COMP.
* Delegation Rights for COMP Staking Product: Ensure that the [Compound Staking Product](https://www.comp.xyz/t/alphagrowth-stake-compound-product/5478?u=cylon) proposed by the Compound Growth Program preserves delegation rights and helps to further align COMP token holder incentives with responsible governance participation. This is already referenced as a requirement in the recent [Staked COMP Design forum post](https://www.comp.xyz/t/potential-design-of-staked-comp/5526).
## Compound Governance Proposal Guardian Audit
OpenZeppelin, in its role as Security Partner to the Compound DAO, audited the changes to include a Proposal Guardian into the Governance contracts proposed by @PGov and developed by @arr00.
### Summary:
Aug 7th - Aug 9, 2024
Total Issues: 2 (1 resolved)
Notes & Additional Information: 1 (1 resolved)
### Scope
We audited the [compound-governance](https://github.com/compound-finance/compound-governance) repository at [commit e3b36ad](https://github.com/compound-finance/compound-governance/tree/e3b36ad5b4e23022921fa077d657182f9340b203) with a focus on the [differences](https://github.com/compound-finance/compound-governance/compare/c96570375f6696baa576f760642d55ab28aa7340...e3b36ad5b4e23022921fa077d657182f9340b203) since our [last audit](https://github.com/compound-finance/compound-governance/blob/e3b36ad5b4e23022921fa077d657182f9340b203/audit/OZ-Sept-23.pdf).
After the initial report, we were asked to also audit the updates to the repository at commit [84dff8d](https://github.com/compound-finance/compound-governance/tree/84dff8dca36052a4981793e86f000627c148bd12), introducing expiration for the `proposalGuardian`.
In scope were the following files:
```
contracts
├── GovernorBravoDelegate.sol
└── GovernorBravoInterfaces.sol
```
### System Overview
Compound Governance is the main protocol used by holders and delegates of COMP to govern Compound II and III. It gives them the power to propose, vote, and implement changes to both active Compound protocols. The governance system has control over several systems across the protocol such as each proxy, the `Configurator`, Comet factory, and `Comet`.
When a proposal to update any system parameters succeeds, the `Timelock` will call all of the relevant methods on the `Configurator` contract. For Compound III this process is followed by invoking the `deployAndUpgradeTo` method on the `CometProxyAdmin` contract, which then points to the new implementation upon execution.
In this audit, we focused on the new role of the `proposalGuardian` and the modifications made to the logic of the `cancel` function. The holder of this role will be allowed to cancel any proposal as if they were the proposer themselves. Apart from this update, no other no other significant alterations were made to the `cancel` function that would impact its execution.
In the second part of the audit, our focus remained on the `proposalGuardian` role, specifically examining the new logic introduced in the `_setProposalGuardian` function. This modification allows the guardian’s role to have an expiration, enabling a time-limited tenure for this position.
### Security Model and Trust Assumptions
The addition of a `proposalGuardian` with the power to cancel any proposal that has not yet been executed introduces important security considerations and trust assumptions that must be addressed to maintain the integrity of Compound's governance. To prevent misuse of this veto power and ensure the robustness of the protocol, the `proposalGuardian` must be a trusted entity without centralized control.
It is assumed that the `proposalGuardian` will be a reputable and accountable entity managed by a multisig of trusted community members, to distribute veto power and reduce the risk of malicious actions, such as canceling proposals beneficial to Compound, not vetoing dangerous proposals for the protocol, or vetoing proposals to change the `proposalGuardian`. Ensuring the `proposalGuardian` is correctly configured during deployment, regularly monitored, and assigned a strict expiration is crucial for maintaining its effectiveness.
Active community engagement and oversight are essential to ensure that the `proposalGuardian` aligns with the DAO's goals and acts in the community's best interests. This engagement allows the community to flag any misuse of power, enabling the DAO to propose replacing the `proposalGuardian` if necessary. It is worth noting that proposals to transfer the role to another account, while the current role is still active, can be vetoed by the current `proposalGuardian`.
<div style="page-break-after: always" />
### Low Severity
#### `_setProposalGuardian` Should Limit the Expiry
Currently [`_setProposalGuardian`](https://github.com/compound-finance/compound-governance/blob/84dff8dca36052a4981793e86f000627c148bd12/contracts/GovernorBravoDelegate.sol#L768-L784) has no restrictions on how long a `proposalGuardian` can hold their role. If `proposalGuardian` were to ever be compromised and can hold the role for the next 2 years, they would be able to veto all proposals until those 2 years are up. Although `_setProposalGuardian` is set by governance and to a trusted multisig, we believe it would be more secure validating the expiry to be within reasonable limits, including that the `expiration` is in the future.
Consider adding a restriction to `_setProposalGuardian` that would check that `newProposalGuardian.expiration` is in the future and within reasonable limits, for example less than or equal to 6 months.
***Update:** Acknowledged, not resolved. @cylon stated:*
> This is a reasonable change but given the time sensitivity of getting this upgrade completed, I think its better to proceed without addressing it. The proposal performing this upgrade will be setting the initial timestamp expiry and can be scrutinized by governance to ensure it is no longer than 6 months and is set in the future. This issue can then be addressed in the code itself by the upgrade to OpenZeppelin Governor by the ScopeLift team.
### Notes & Additional Information
#### Incomplete Function Documentation and Comments
The function [`cancel`](https://github.com/compound-finance/compound-governance/blob/e3b36ad5b4e23022921fa077d657182f9340b203/contracts/GovernorBravoDelegate.sol#L370-L410) has been updated to allow cancellation of yet-to-be-executed proposals under the following conditions:
* the sender is the `proposal.proposer`
* the sender is the `proposalGuardian`
* the `proposal.proposer` is not whitelisted and the proposer votes are below the `proposalThreshold`
* the `proposal.proposer` is whitelisted, the proposer votes are below the `proposalThreshold` and the sender is the `whitelistGuardian`
However, the function's `notice` docstring, as well as the inline comments, are not updated to reflect the introduction of a `proposalGuardian`.
We recommend the following updates:
1. `notice` docstring: Updated the `notice` docstring to include that the function cancels a proposal if the sender is the proposer or the `proposalGuardian`.
2. [Line 382](https://github.com/compound-finance/compound-governance//blob/e3b36ad5b4e23022921fa077d657182f9340b203/contracts/GovernorBravoDelegate.sol#L382-L382) Comment: Updated the comment on [line 382](https://github.com/compound-finance/compound-governance//blob/e3b36ad5b4e23022921fa077d657182f9340b203/contracts/GovernorBravoDelegate.sol#L382-L382) to highlight that the `proposalGuardian` can cancel any proposal,
3. [Line 389](https://github.com/compound-finance/compound-governance//blob/e3b36ad5b4e23022921fa077d657182f9340b203/contracts/GovernorBravoDelegate.sol#L389-L389) Comment: Updated the comment on [line 389](https://github.com/compound-finance/compound-governance//blob/e3b36ad5b4e23022921fa077d657182f9340b203/contracts/GovernorBravoDelegate.sol#L389-L389) to explicitly state that only the `whitelistGuardian` can cancel a proposal by a whitelisted proposer if it falls below the proposal threshold.
***Update:** Resolved in* [commit 8340937](https://github.com/compound-finance/compound-governance/blob/83409378e25d78dfb2cdbc98f8c97bdec166b173/contracts/GovernorBravoDelegate.sol#L374-L396)*.*
### Conclusion
The new addition of the proposal guardian to the Compound Governance contracts is minimally invasive and has been effectively implemented. However, this role carries substantial privileges, notably the ability to cancel proposals, including those that involve transferring the role itself to another account. Caution should be exercised in assigning this role and determining its duration. To bolster the long-term robustness and resilience of the protocol and to safeguard its decentralization, it is crucial to continue exploring more long-term solutions.
### [Forum Post](https://www.comp.xyz/t/compound-governance-proposal-guardian/5544)