Unhackable DAOs: No Silver Bullet, but Active Defense

In previous story “hackable” DAOs were discussed, now it’s time for “unhackable“ ones.

Morphy law says:

“Anything that can go wrong will go wrong”.

Perfect demo: unlucky boy meets lucky girl:

https://www.youtube.com/watch?v=OuJ4BBQ0nhc

[Un]fortunately we can’t control everything; of course, we can do what’s possible. 1st thing that is very simple and easy to do - play on your own field, by your own rules.

DAO is a concept, not a tech

Web3 hacks are reported almost daily. Bugs are everywhere - in code, protocols, smart contracts logic, wallets, tools, etc. You can’t handle it all, but you can avoid it. Don’t use a buggy tech, or only use it if there is no other choice. This is one of the fundamental approaches to cybersecurity - to reduce the attack surface.

How to make something unhackable

Follow a “nothing to hack” approach. What’s hackable in DAO on the tech level - treasury or shared account, don’t use it. Each proposal should be invested separately (money out). Profit can be divided immediately (money in). No treasury - no hack.

L2 DAO

DAO is just a protocol, any protocol can be implemented on a p2p basis without intermediaries (thanks to cryptography). To integrate L2 DAO in existing blockchain networks just multisig wallet can be used. Moreover, onchain DAOs are very expensive at scale. Imagine onchain voting of 1K members, cost = tx_fee * 1K, what if 1M?

Offline

To be online (hot wallets use) is insecure, manage your private keys and sign your transactions on offline devices (bad UX, but better security).

Governance

Governance is the most difficult part, unhackable governance is a challenge. Some hackable approaches are there: governance tokens (51% attack), quadratic voting (sybil attack), etc.

Why not to delegate some resources to DAO “leaders”? If leaders do the best for DAOs and themselves - everyone wins (Nash equilibrium), if the leader does provable bad action - anyone can start a dispute (web3 dispute resolution protocol) - a leader can lose deposit and reputation.

AI governor

DAO leaders/governors can be AI models.

Conclusions

No silver bullet, but active defense: attack surface reduction, diverse/adoptable governance methods, and dispute resolution, experiments with AI and governance automation to reduce human factor/ social engineering.

Links

• Vitalik on Improving DAO Governance
• Without Robots, DAOs Will Never Progress Beyond Their Current Level
• Government by algorithm