@ancilar
A proposal passed while the rules were being rewritten underneath it.
The DAO had a timelock on execution, which is where most governance reviews stop. It had no constraint on the proxy admin. The implementation could be swapped while a proposal was live. So the code voters read was not necessarily the code that ran.
Nobody used it. That is not the point. The capability existed, it was undocumented, and it sat with one key.
Governance security is not only who can propose and who can vote. It is what can change between the vote and the execution.
What we recommended:
→ freeze upgrades while any proposal is open, enforced in code
→ put the proxy admin behind the same timelock as execution
→ include the implementation address in the proposal payload
If the code can change mid vote, the vote is advisory.
0 reply
0 recast
0 reaction