dao-experiments

Wanted to share some thoughts on this hack from today and how we see it from @aragon side 🧵:

Modular tech stack for DAOs. Govern your protocol and assets onchain: aragon.org

Wanted to share some thoughts on this hack from today and how we see it from @aragon side 🧵:
 https://x.com/rdntcapital/status/1847121278974480779?s=46&t=ny2pIcPKteWxKzzYMT538A

CTO @aragon || Cooking paellas, satellite @nouns ⌐🥘-🥘

Device Security:
We need to assume the hacker is already inside our system. Thinking like that makes us prepare better. It’s like locking the doors but also keeping an eye on who’s already inside the house. With that in mind, a 3/5 multisig setup isn’t secure if the signers’ devices get hacked. If three devices are compromised, it’s game over.

Onchain Transaction Visibility:
When you sign with Ledger on Safe, you only see a hash—not the actual content you’re executing. Safe’s UI doesn’t show you that hash to double-check, so you can’t really verify what’s going on. It’s like signing a blank piece of paper. On the other hand, onchain transactions let you see what’s really happening. OSx's Multithreshold Multisig shows you exactly what you’re approving, so you can confirm it’s legit beforehand. You get the full details, not just a random hash. Makes it way easier to spot if something’s off.

Community Transparency:
Transparency is super important. The more people are looking at transactions, the better the chances of spotting issues. Lean on your community; they can help catch stuff you might miss. It’s like having extra eyes to watch your back. Open processes make everyone safer.

Veto and Exit:
Even better, give your community the opportunity to veto and exit if they spot something is wrong. Aragon’s Optimistic Governance brings this altogether: onchain transactions, transparency, community eyes, and and an opportunity to veto and/or exit in the case of an attack or vulnerability. It’s efficient and keeps security at its core, so you can operate smoothly without sacrificing safety. Feels good to have extra layers of protection.

Just wanted to share some thoughts on keeping protocols and assets safer out there, and share some of the solutions we’ve been working on.
Stay safe, everyone. 🙏

Securing Multisig Governance:

Hackers are getting smarter, and we need to step up the security beyond the basics. Security isn’t just about one thing. New vulnerabilities pop up, and we can’t rely solely on history and lindy to protect us. Gotta stay sharp.