Synthetix Foundation Decommissioned

We are excited to announce that as of the end of financial year in Australia (June 30th, 2020) the process of winding down the Synthetix Foundation has commenced. Over the last six months we have progressively reduced the role of the Foundation, and in the last few weeks the final remaining aspects of the transition have been resolved. This is a major milestone for the project in a path that started back in 2018, which we outlined in more detail last year in this post. In it we stated the reliance on a non-profit foundation to steward a project was likely a net negative and that we believed this governance framework would ultimately be replaced by a DAO model for many projects. We have worked hard to implement this transition and with the help of a number of projects in the space and our community we are pleased to be taking this next step towards token holder governance.

As of the date of publishing this article, July 2020, the protocol is now under the control of three distinct DAO’s:

• The protocolDAO, which controls protocol upgrades and variable configuration
• The grantsDAO which funds public goods in the Synthetix ecosystem
• The synthetixDAO which manages and deploys funds to contributors and other project needs

This post will provide a status update on each of these DAO’s and the future plans for Synthetix governance.

protocolDAO

The protocolDAO is the owner of all Synthetix contracts and uses a 4/8 multisig to modify and upgrade the protocol. This means the protocolDAO is responsible for the implementation of SIPS and SCCPs approved by the community through our rough consensus process. It is also responsible for the operational security of the protocol, which means all of the monitoring and oversight of the Mainnet contracts plus Oracles. This github issue provides a detailed overview of the upcoming changes to the protocolDAO and operational security of the contracts. The main changes will be the introduction of timelocks to contract upgrades, token holder veto power, system pause functionality and decentralised circuit breakers.

The Synthetix protocol is heavily reliant on external oracles to feed information about real-world prices, but it is also a complex smart contract suite that in spite of numerous rounds of audits may still contain software defects. This necessitates the ability to automatically or manually pause the protocol if an anomaly is detected, in order to protect the funds in the Synthetix protocol and connected protocols like Uniswap and Aave. The problem with contract pause functionality is that this introduces a dangerous attack vector for censoring the protocol. The system we have implemented is designed to reduce this risk of protocol capture or censorship, while maintaining maximum security of funds and reducing the likelihood of user disruption.

Contracts can be both automatically paused and manually paused at both a systemwide level and at an individual synth level.

Implementing this functionality significantly improves the safety of funds due to the causes listed above, however, it drastically reduces censorship resistance. The solution to this is to introduce token holder control of these states. Let’s look at a few examples of how this might be used.

Any protocolDAO member can unilaterally pause an individual Synth or the entire system to ensure a rapid response in the event of an outage or incident. However, this unilateral pausing is limited to n hours (to be defined with community input through the SIP process). There is the possibility this pausing power could be abused to disrupt the system. In that case the remaining protocolDAO members can vote to unpause the contracts and restore the system and if warranted remove the malicious member from the DAO. If the protocolDAO does nothing the system will be reenabled automatically after two hours.

Now we look at a case where it is not a single protocolDAO member, but instead, all members colluding to disrupt the system. The protocolDAO has the ability to pause the contracts indefinitely by continually submitting pause transactions.  If the protocolDAO members all vote to pause the system indefinitely, and this action is malicious, token holders can vote to reenable the system, overriding the protocolDAO. This ensures power ultimately rests with the token holders and not the protocolDAO. In future iterations we will enable token holders to remove individual members of the protocolDAO to ensure the will of token holders is being upheld. There is an additional component to this mechanism, the threshold for token holder veto. Initially we want it to be low, but if a contentious change is repeatedly rejected by a minority of token holders in spite of it being supported by community consensus, an escalation process could be initiated to resolve the dispute. In the worst case a fundamental schism in the community could result in a protocol fork. While this is unlikely in the short term, over the longer term we must ensure that a fair, equitable and legitimate form of governance is delivered to ensure that the community does not fracture.

The decentralised circuit breaker functionality ensures that if the contracts detect an anomaly in the oracles the system automatically shuts itself down. Again, the same token holder control will be present where even if the protocolDAO members are unable or unwilling to reenable the system, token holders may vote to reenable it directly, ensuring they maintain ultimate control over the system.

The timelock functionality ensures token holders have ultimate oversight over protocol upgrades. Any token holder will be able to propose an upgrade through the delegated migrator contract which is owned by the protocolDAO. The delegated migrator is an automated system for publishing and executing protocol changes on-chain. This means modifications to the protocol cannot be performed without oversight from token holders as each proposal must wait a minimum of 48 hours before being confirmed and implemented. If a token holder or protocolDAO member submits a proposed contract change without community consensus it can be vetoed through a token holder vote before being executed. This is critical for censorship resistance, and is essentially governance by exception. So long as the protocolDAO is executing community consensus each proposed upgrade should pass, but if the protocolDAO or a community member attempts to execute a contract change that is against the interests of token holders it will be blocked forcing the community to debate the proposed change and work towards consensus.

grantsDAO

The grantsDAO is responsible for public goods funding, this includes incentivising community participation in the SIP process through rewarding SIP champions as well as funding initiatives like snx.tools and SNX Link which provide an alternative interface to displaying critical information to stakeholders. The synthetixDAO has committed to funding the grantsDAO for the next three years with 1m SNX per year to ensure there is continued funding for public goods and initiatives.

The grantsDAO is governed by community members. This is to ensure that it is an independent force within the ecosystem and is funding grants that align with community interest. Critically it also plays a role in ensuring there are alternative interfaces for interacting with the network so even if the core contributors fail to deliver dApp upgrades and other enhancements the community will still have robust interfaces to interact with the contracts.

This decentralisation of interfaces is a critical component in ensuring the network is censorship resistant. One area of focus over the next few months will be funding grants to deploy interfaces and forks of the front ends to IPFS and other permanent hosting solutions. This will also require permissionless mechanisms for accessing on-chain data for the dapps.

synthetixDAO

The synthetixDAO was created initially as a simple multisig contract during the token sale to ensure the funds raised were secure and would be deployed in a manner that best aligned with the interest of the network via community consensus. The synthetixDAO has provided the operational funding for the foundation in Australia as well as numerous other entities around the world that have contributed to the growth of the network. The synthetixDAO will continue to provide funding for network growth, but where the foundation was previously a major recipient of funding, now a large number of smaller entities will apply directly to the synthetixDAO for contributor funding. Importantly this is an open process where any entity can apply for funding from the SynthetixDAO, this typically occurs via a grantsDAO review where if the scope of the proposal is outside the grantsDAO mandate it is moved to the synthetixDAO for review. With the winding up of the foundation, the synthetixDAO must evolve to ensure all stakeholders in the network are represented and that funding is available for any entity that can contribute. The current synthetixDAO has three members representing key stakeholders in the network, both core contributors and large token holders. We expect within the next three to six months we will be able to migrate the entire treasury on-chain within the control of the synthetixDAO. Until that point, existing custodians will manage off-chain funds on behalf of the synthetixDAO.

At some point in the future membership will be opened up to token holders who will be able to register their interest to join the synthetixDAO. Provided a sufficient number of token holders support their membership proposal they will be added to the synthetixDAO. Eventually we will migrate to a mechanism where all funding proposals are publicly available and voted on by members of the synthetixDAO with the ability to veto reserved for token holders, but in the transition period the current operating procedures will continue. Based on the current treasury value in both liquid crypto, cash and SNX we have many years of runway at the current burn rate. The original token sale raised ~30k ETH. This was split into thirds after the close of the sale, ⅓ was liquidated and has been funding the operations and development of the network as well as the pre-launch costs. ⅓ was allocated to market making, the majority of which was used to stabilise the price of SNX during the 2018 bear market, the market making activities to date have resulted in a unrealised gain of ~100k ETH. The final ⅓ was kept in ETH given our long term alignment with Ethereum and our confidence in the prospects for the Ethereum network. The current treasury value is ~$150m USD or ~450,000 ETH, at the time of this post. While we could certainly have been more conservative in our hedging against the ETH price decline of 2018, we are confident our treasury management was well executed given we have managed to increase the treasury value on both a USD and ETH basis over the last two years while also funding the operations of the network. We have also raised a small amount of additional funding through treasury sales of ~6m USD which has contributed to the treasury performance. We have ensured the operating costs have been as lean as possible, and have maintained a small but focused team through the last 3 years.

The changes above mark a phase shift in Synthetix governance, while we have been governed through rough consensus for some time now, this shift puts significantly more power directly into the hands of token holders. And even more critical provides a mechanism to protect token holders from collusion and censorship. These changes will make the protocol far more robust and reduce the trust required in the core contributors. The goal of Synthetix has always been to deliver a censorship resistant protocol for exchanging synthetic assets. These changes are a major step towards delivering that goal. As always the Synthetix community will continue to iterate and test these changes to ensure they align with our long term goals.