pDAO Guardian migration

[Pieter]

@knoshua

The pdao only controls the threshold for price updates. The threshold for proposals like contract upgrades is controlled by the odao itself.
This means that basically anything a compromised guardian does is only temporary and can be undone by the odao through contract upgrades

Okay, if the contract upgrade quorum isn’t controlled by the pDAO then the risks aren’t as great as I feared. This is very relevant to the discussion! That’s different from what @Valdorff stated here: https://dao2.rocketpool.net/t/pdao-guardian-multisig-charter/1025/22?u=pieter

@Valdorff

I’m only aware of two things the pDAO guardian can do over the oDAO: prevent oDAO consensus by setting a requirement greater than 100% (this is essentially protocol-destroying), and set the maximum penalty the oDAO can put on a node operator (this power is not oDAO removable).

The pDAO could still steal the reserve fund, which would hurt but also be overcomeable. Aren’t there still other attack vectors with long term damage, like changing RPL inflation to a huge value just before a new period?

@knoshua

The point is to show that the community is capable of making smart choices. It’s to show that it is not necessary for the team to patronize the community. It’s to show the community that it has a role to play in the protocol. Of course if you think that possibility is a foregone conclusion, then you won’t see the point.

These are worthy goals, and I definitely don’t think any specific outcome is a foregone conclusion. Still, the context here is an intermediate, temporary step to improve security of the pDAO guardian so I wonder if this is the right place to showcase such community ability. Being not as existential a risk as I had thought, I’m more inclined to agree though.

Maybe the team could weigh in with the specific risks vectors they see with an open vote pDAO guardian, @langers ?