DeFiSafety is considering submitting an AIP and would like to hear feedback before we formally introduce it as an AIP. The content of the AIP is essentially complete, but we’d like to hear from DAO contributors in advance of formally commencing the AIP process. As such, while this is a specific request, we’d like to hear a) feedback about the minutiae and b) how you might vote if it it went to snapshot. Thanks!
Please note references to all the claims we make are available, but this website will only allow us to include two links in our post. They will be cited upon request. Thanks.
Executive Summary
Angle’s success relies partly on its ability to deliver high quality products with a strong security posture. To date, and despite the large TVL potentially attracting a lot of malicious actors, Angle’s users haven’t suffered any losses due to smart contract bugs or vulnerabilities. Lately, it has been increasingly difficult to contract reputable smart contract analysts, as most of the prominent firms in this space are booked out for months.
The aim of this proposal is to ensure Angle continues to receive high-quality security assessment services to address all upcoming updates to its protocols, including critical upgrades such as safely implementing AIP-18. This will be done by contracting DeFiSafety to provide information on how to run their protocol in a more secure manner.
DeFiSafety has been providing security assessment services to protocols across DeFi for 2 years now (including reviews on Angle). We do critical development process review work that trends towards reduced security incidents, as proven by our analyses.
Context
DeFiSafety is a DeFi-specific security firm who specialise in development process review. We’re located in Montreal, Quebec. All employees are doxxed and can be found on LinkedIn. DeFiSafety is an incorporated firm with a physical location that we’d be happy to receive any of you if so desired. We are thus an accountable entity.
DeFiSafety has done good work reviewing DeFi protocols based on various technical risk metrics. We’ve worked with almost every big name in the industry, not only critiquing their methods but also suggesting improvements that have been implemented. We have focused on promoting transparency, as crowd-sourced security is stronger than security by obscurity.
For those unfamiliar with our 260+ free process quality reviews, feel free to browse them at Process Quality Reviews | DeFiSafety.
Some examples of critiques and improvement (or not), or general contributions to the space include:
- Solana: we critiqued them for only having one node implementation resulting in network instability, now they’ve hired Jump to fix this
- Goldfinch: we suggested they might want to explain how their protocol mitigates common DeFi vulnerabilities and they produced a clear document explaining so, and reported that increased the strength of their internal process as they did it.
- The Macalinao brothers: we correctly identified that their poor development practises were an indicator of foul play.
- Offering generalised, low barrier to access advice to all DeFi users on how to identify projects that will not disappear to news outlets.
- Repeatedly identifying poor development practises in protocols that subsequently suffer exploits
In our past interactions with Angle, the feedback we received from the contributors team has been very positive, as Sogipec, gnervo and Picodes can attest to. In doing so, we’ve learned about the operations of the protocol and this puts us in a good position to advise on how to further improve protocol security. Our working relationship with these key contributors is good.
Our respect for Angle is well substantiated: they are tying for the highest DeFiSafety protocol score in the entire industry. We achieved this rating by working carefully with the development team and helping them promote transparency as to how they developed their protocol. In some way, we have already done some work with Angle and the results so far are clear: Angle has not suffered any exploit. While this is largely down to the development team and the auditors that look at their code, we take pride in playing a teeny role in contributing to this.
Nonetheless, despite these strengths and considerable expertise, DeFiSafety is in a difficult situation. We have just a few months of runway left and our attempts to monetise through multiple products have thus far been largely unsuccessful. While we have cut staffing and salaries, our burn remains omnipresent. We are up against a wall.
As a public good, we have failed to find a sustainable way to continue our contributions to space. Nonetheless, we have acquired significant expertise as we have done this and now offer services to interested parties alongside our regularly scheduled protocol reviews. Our low fee represents the limited requirements the lean DeFiSafety operates on.
We noticed that Angle is looking to bolster its balance sheet thanks to finding clear product market fit by redirecting some of its protocol surplus to buy tokens. We think an equally valuable use of some of the remaining surplus that is designated for protocol development would be spent contracting our services.
Proposal
This section outlines the terms of a master services agreement between DeFiSafety Inc. and Angle for security assessment/consulting services:
- Duration of the Agreement: 12 months
- Commitment: 35 person-days + 5 optional person-days (at $300/hr)
- Duration: October 1st, 2022 - 2023 with a 3 week initial engagement and 2 subsequent 2 week engagements in February and June.
- Minimum Consultancy Fee: US$ 84,000 to be paid in USDC and/or USDT
- Maximum Consultancy Fee: US$ 96,000 to be paid in USDC and/or USDT
- Payment terms:
- 50% of the Maximum Consultancy Fee at signing
- Remaining Consultancy Fee (either 50% of the Maximum Consultancy Fee, or Minimum Consultancy Fee - 50% of Maximum Consultancy Fee) 12 months after.
- Scope of Services:
NOTE: this is not prescriptive but essentially DeFiSafety will assist the DAO in implementing new internal and external safeguards in order to promote the five following philosophies:
-
Identifying potential weaknesses
-
Protecting against them in advance
-
Detecting anomalous activity
-
Responding to any potential incidents in a proportional manner
-
Recovering post-incident and incorporating any lessons learned…
-
Example of targets:
- An internal incident plan, tiered in relation to the severity of the incident
- A plan relating to the management of common and vital assets
- Implementation of network monitoring tools such as forta / tenderly
- Review of Angle DNS settings to prevent hijacking
Relevant Metrics
This will be the first implementation of this DeFiSafety consulting agreement. We believe that $300 per hour is a fair rate for this level of Angle-specialised technical analysis based on what competitors offer. For example, Sigma Prime, an auditor, charges approximately double what DeFiSafety is proposing per hour (to a total of $1.3M).
Due to the reduced complexity of our work compared to that of auditing firms, we price ourselves lower. Nonetheless, our offering is highly specialised to DeFi protocols and no other firm appears to have the same DeFi-specific knowledge. We concede that many have general blockchain knowledge, but a) they charge more and b) they do not live and breathe DeFi in the way we do.
Angle has a surplus of $8.5M. We believe that roughly $80K or 1% of this surplus would be well spent ensuring that it is more protected than it already is. This amount has been carefully chosen to ensure DeFiSafety will remain afloat and able to pay salaries with this contract (and a few others).
Risk and implications
We see few risks in the implementation of this proposal. DeFiSafety could potentially become insolvent, as we are indeed a struggling business. In addition, the reports we deliver could be of limited value due to the already incredible security features Angle protocol contributors hold themselves to. Nonetheless, we have a few ideas for improvements and years of expertise under our belts so we are confident that we will have high signal low noise output.
Added value
DeFiSafety will add value to the DAO in ensuring that their funds will be better protected. While nothing is impenetrable, DeFiSafety has the best name in the industry in quantifying protocol risk. It has learned what are the best ways for developers to conduct themselves when handling other people’s money and will put this wealth of knowledge to use in assisting Angle.
Implementation requirements
Some degree of continuation of the working relationship between Angle contributors and DeFiSafety will be necessary, but this will be largely informational. Almost the entirety of the work will be conducted by DeFiSafety using public information and findings will be delivered to core contributors in the form of reports with clear actionables leading to increased protocol security.
An example of this could be an overview of regular Angle transactions and any potential historical anomalies. We’d analyse these potential anomalies then create forta alerts looking at the smart contracts moving forward. This would be delivered to key contributors.
Next Steps
We’re very excited about this proposal and look forward to hearing from the community! We’re very grateful to Sogipec who has given us context to work with and provided feedback as we crafted this proposal. Here are the following steps we anticipate:
- Step 1: Governance Forum Discussions (5 days)
- Step 2: Creation of Snapshot Proposal (6 days)
- Step 3: Project kick off if outcome of Step 2 is positive