As voted on in the ADPC proposal here, one of the key tasks of the ADPC was to conceptualize and structure a subsidy fund for the Arbitrum DAO. This proposal intends to set up this subsidy fund, seeking $10 million worth of ARB to be administered and selected by the Arbitrum DAO Procurement Committee (hereinafter referred to as the ‘ADPC’) to facilitate the selection of projects that will benefit from the whitelisted security audit service providers selected via the ADPC’s procurement framework. The ultimate decision will be made by the ADPC based on the Means Test and the Application Process Terms.
We propose the creation of a procurement subsidy fund allocating up to $10 million worth of ARB to provide financial assistance to both new and existing projects within the Arbitrum ecosystem.
These subsidies will be exclusive to a pre-approved whitelisted set of security audit service providers, selected by the ADPC, who will publicly display their fees. This approach eliminates the need for the ADPC to assess the reasonableness of funds requests.
The aim of the subsidy fund is to incentivise participation and growth among smaller projects helping them to overcome barriers to entry, such as challenges to acquire funding to pay for the cost of robust security audits.
The figure of up to $10 million worth of ARB has been determined via a benchmarking exercise conducted with various security audit service providers. This form was shared with these service providers and based on the responses of 10 service providers (including the likes of Spearbit, Halborn, Nethermind, Three Sigma, Guardian, Zellic, etc.) on their scope of services and fees associated, we have estimated that each project will require a 2-month security audit at an average cost of $200K. This will enable the ADPC to potentially fund up to 50 projects; however, it should be noted that the average of $200K is an estimate and fees are usually specific to each project, each project requires a scoping exercise, and audit costs will vary based on the size of the codebase, complexity, etc.
Any feedback on this proposal is encouraged via a public discussion on the community forum.
Core Principles Underlying the ADPC Subsidy Fund
Before considering a subsidy application, applicants should carefully evaluate the need for support. The purpose of these guidelines is to clarify the subsidy program and make the process as straightforward as possible.
All applicants should keep in mind the following key principles:
Means Test: Criteria for Evaluation
The reason for this approach over a purely quantitative approach is that most projects, especially the smaller ones being targeted within this subsidy program do not possess obvious immediately measurable metrics.
The development of this Means Test aims to provide a structured approach for the ADPC to evaluate applications for financial assistance. This tool is designed to identify applicants who would benefit most from support, ensuring equitable access to subsidies within the Arbitrum Ecosystem, particularly for smaller entities with valuable contributions.
The intent is to allocate subsidies to those most in need, avoiding exploitation by larger players looking for a ‘free lunch/handout’. Such an event could give recipients an unfair advantage over their competitors or be an inefficient use of the DAO’s funds if they do not bring about a net positive change.
The means test will include a scoring system ranging from 1 to 5, reflecting the merit of each application.
Each of the sub-criteria in the means test have varying levels of importance, and they will each have a weighting attached. A weighting of 1 indicates low importance, 2 indicates neutral importance, and 3 indicates high importance.
Each application will be scored by ADPC members, followed by a collective decision on the most deserving grant recipients, taking into account the rating against the eligibility criteria, a value-for-money evaluation and the funds available. The ADPC may make other decisions in relation to the operation of the fund and selection of applicants as further detailed in the Application Process Terms.
After the applications have been reviewed and decisions taken as to the grant beneficiaries, the average score assigned to each project will be shared publicly, ensuring that transparency is maintained throughout the process. In the event that an applicant receives a high score but is not chosen as a grant recipient, explanatory feedback will be provided either on an individual or collective basis to the cohort.
Evaluation Criteria
| Criteria | Sub-Criteria | Description | Weight |
|---|---|---|---|
| Arbitrum Ecosystem Contribution How aligned is the project with the Arbitrum ecosystem and how easy will it be to track the applicant’s use of the subsidy funds? | Ecosystem Contribution | How does the applicant’s project contribute towards the growth of the Arbitrum ecosystem? | 3 |
| Transparency Practices | To what extent does the applicant demonstrate transparency in its operations? | 2 | |
| Community Engagement | How does the applicant engage with the DAO community and solicit feedback/input on its project, incorporating this into its decision-making? | 1 | |
| Accountability Measures | What mechanisms does the project have in place to ensure accountability and responsible stewardship of subsidy funds, including governance structures in place? | 3 | |
| Business Model & Need for the Subsidy How effectively does the applicant's business model align with their need for the subsidy? | Clarity of Business Model | How well-defined and understandable is the applicant’s business model? | 2 |
| Team Experience | What is the track record of the team on their ability to execute their plan? | 2 | |
| Funding Gap Rationale | Is there a clear explanation of the funding gap the applicant is facing, along with the rationale for why additional subsidy funding is necessary to achieve its objectives? | 3 | |
| Reasonableness of Subsidy Amount Requested | Does the requested subsidy amount make sense within the context of the project’s needs and potential impact? | 3 | |
| Scalability Potential | What is the scalability potential of the applicant’s business model following the support of the subsidy? | 1 | |
| Financial Analysis How realistic and stress tested is the applicant’s financial status and projections and is their plan for the use of the subsidy funds clearly outlined? | Accuracy of Projections | How realistic and well-supported are the financial projections provided by the applicant, inclusive of revenue forecasts and cost analysis? | 1 |
| Sensitivity to Scenarios | To what extent does the applicant’s financial analysis consider different scenarios, such as base, target and stress scenarios to assess the projects’ resilience and adaptability to changing market conditions? | 1 | |
| KPIs | Are there clearly defined KPIs that will be used to track the project’s performance and measure progress towards achieving its goals? | 3 | |
| Preferred Funding Distribution | Does the applicant have a preferred distribution plan for the subsidy funds, and is there a rationale provided for this distribution approach, such as front-loading funds for critical start-up costs or phased funding based on project milestones? | 2 | |
| Risk Analysis Is the applicant aware of risks with their project and what is their plan for mitigating these risks? | Risk Identification | How effectively does the applicant identify and assess potential risks and vulnerabilities that the project may have? | 2 |
| Security Requirements | Does the applicant have a clear understanding of its security requirements and the measures needed to protect against security breaches, such as through the conducting of a security audit? | 3 | |
| Mitigation Strategies | What strategies does the applicant have in place or intend to implement to safeguard against the aforementioned risks? | 2 |
Regarding the ‘Ecosystem Contribution’ metric above, we have conducted an initial assessment of the types of projects that are currently building in the Arbitrum ecosystem and identified a few verticals that the ecosystem would benefit from funding. These are set out below, along with the rationales for choosing them. We will provide more weight to these areas and welcome input from the community on our selection.
RWAs & Tokenization
Gaming
Collab Tech
You can find more detailed information on the rubrics informing the Means Test here.
Application & Review Windows
The Subsidy Fund will run in cohorts of 8 weeks each, to be decided by DAO governance. Each cohort will consist of an initial submission period of 2 weeks, followed by a 6-week review period. Moreover, a maximum cap of 25% of the total Subsidy Fund amount can be disbursed per cohort to ensure that the fund is structured to allow the door to be opened to new entrants over time. Each cohort will operate on a first-come-first-served basis for application reviews, and if the maximum capital has been allocated for the cohort, the remaining applicants will be rolled over to the next cohort.
Initial Screening
To efficiently handle the anticipated surge in applications and to ensure that the highest quality and most relevant applicants are selected, the below 5 sub-criteria (with the highest weights as mentioned above in the Means Test) will first be applied to all applicants, with the top-scoring applicants moving forward in the evaluation process and being assessed in greater depth:
The ADPC reserves the right to introduce Mandatory Requirements over time that operate as threshold tests and will publish those requirements if introduced.
In-Depth Review & Feedback
Projects that pass the initial screening will undergo a review due diligence (DD) by the ADPC, including interviews and constructive feedback (either individually or on a collective basis).
Award & Monitoring
Once approved, projects receive subsidies, with periodic check-ins and a concluding evaluation to measure impact and success.
Transparency and continuous dialogue form the backbone of our selection and reporting process, ensuring that each funded project remains aligned with program expectations.
Bi-Monthly Reports
We will provide bi-monthly updates on our selections and updates on funded projects (i.e., in line with each Cohort). These updates will include general project trajectory and progress toward milestones. To create the reports we will set regular monthly check-in dates where projects fill a template/slide in order to give the key info about the project’s status, such as:
Output Metrics
With the initial priorities in mind, some effective measures for meaningful output will look as follows:
Outcome Metrics
Depending on the final portfolio of funded projects, we will gauge the success rate of awarded projects through specific outcome metrics. While these metrics can be influenced by a wide range of external factors, such as market conditions and individual decisions on a project level, we are committed to supporting and funding the most promising projects to the best of our ability. Metrics include:
Our approach to subsidy fund allocation focuses on achieving high impact while ensuring that a de minimus number of projects obtain funding.
To ensure that the subsidy is spread across a large number of projects rather than concentrated in several larger projects, the maximum subsidy to be granted will comprise 5% of the subsidy fund available. Therefore, given that the subsidy fund comprises up to $10 million, the maximum subsidy that a project can receive will comprise no more than $500K worth of ARB.
The administration and selection process of these subsidies will be managed by the ADPC. Even though the ultimate decision will lie with the judgment of the ADPC, their assessment will be strongly guided by a means test that evaluates key metrics to determine deserving projects.
The activation of the ADPC to manage the Subsidy Fund will hinge on extending the current 6-month mandate once the Subsidy Fund becomes operational. Should the DAO or the ADPC opt against a continuation of the ADPC, a Subsidy Fund Management Committee will need to be elected. The ADPC will allocate ample time for this process to ensure the Subsidy Fund operation is not reliant on the ADPC's mandate extension.
The Subsidy Fund governance aims for transparency, efficiency, and broad community involvement. It outlines mechanisms to ensure fair and balanced decision-making for all stakeholders.
Multi-Sig
All providers must undergo and successfully complete the standard Know-Your-Business (hereinafter referred to as the ‘KYB’) verification processes with the Arbitrum Foundation prior to receiving the service-subsidy.
Subsequently, the designated Multi-sig members, established at the inception of the ADPC and voted in favour of by the ArbitrumDAO, will take charge of disbursing funds to the selected beneficiaries, whereby the transactions will be streamed using Hedgey.
In recognition of the additional responsibilities undertaken, each of the five multi-sig wallets is proposed to receive a supplementary compensation ranging from 500 ARB - 1,000 ARB monthly.
It is also important to note, as per the ratified proposal which led to the formation of the ADPC, that the multi-sig committee grants the ArbitrumDAO the authority to claw back funds from the ADPC’s multi-sig wallet using the Zodiac Governor Module, if necessary.
Checks & Balances
Kindly note that the subsidy fund will be subject to the same checks and balances found within the procurement committee proposal, regulated by an agreement entered into by all elected ADPC Members, with the Arbitrum Foundation serving as a counterparty to the agreement. These checks and balances include:
Conflict of Interest Provision: ADPC Members will be bound to act in absolute good faith, utmost honesty, refraining from deriving unauthorized profits from their position & disclose conflicts of interest. ADPC members should always disclose any potential or actual conflicts of interests to other ADPC members who will then proceed to mitigate the respective ADPC Members’ involvement in the task in relation to which such ADPC Member is conflicted.
To sum up, all ADPC Members must declare the nature and extent of any interest, direct or indirect, which the ADPC Member is aware that she, he or it has in a proposed task at hand.
Record-keeping and Reporting: Comprehensive and precise record-keeping is imperative. ADPC Members will be required to maintain detailed accounts and documentation of the ADPC’s internal operational workflow together with meeting minutes. Furthermore, periodic reporting is essential so as to keep the ArbitrumDAO updated re. Task-specific progress & internal ADPC Administration.
Duty of Impartiality: ADPC Members will have an obligation to act in an impartial manner in relation to their tasks & workflow, ensuring that the ADPC is not compromised by personal interests or external influences.
Obligation of Recusal: ADPC Members with a conflict of interest involving a project and/or service provider being reviewed by the ADPC should recuse themselves from participating in the evaluation, facilitation & administration of the applicable procurement process.
Prohibition of Self-Dealing: Participants should refrain from voting on sending funds to themselves or organizations where any portion of those funds is expected to flow to them, their other projects, or anyone they have a close personal or economic relationship with.
Ethical Trading: Members are required to follow ethical trading standards concerning ARB and any other relevant digital assets.
Grant Application Terms and Conditions can be found here.
CCing: @Immutablelawyer; @Pablo, @sid_areta, @cliffton.eth, @raam
As voted on in the ADPC proposal here, one of the key tasks of the ADPC was to conceptualize and structure a subsidy fund for the Arbitrum DAO. This proposal intends to set up this subsidy fund, seeking $10 million worth of ARB to be administered and selected by the Arbitrum DAO Procurement Committee (hereinafter referred to as the ‘ADPC’) to facilitate the selection of projects that will benefit from the whitelisted security audit service providers selected via the ADPC’s procurement framework. The ultimate decision will be made by the ADPC based on the Means Test and the Application Process Terms.
We propose the creation of a procurement subsidy fund allocating up to $10 million worth of ARB to provide financial assistance to both new and existing projects within the Arbitrum ecosystem.
These subsidies will be exclusive to a pre-approved whitelisted set of security audit service providers, selected by the ADPC, who will publicly display their fees. This approach eliminates the need for the ADPC to assess the reasonableness of funds requests.
The aim of the subsidy fund is to incentivise participation and growth among smaller projects helping them to overcome barriers to entry, such as challenges to acquire funding to pay for the cost of robust security audits.
The figure of up to $10 million worth of ARB has been determined via a benchmarking exercise conducted with various security audit service providers. This form was shared with these service providers and based on the responses of 10 service providers (including the likes of Spearbit, Halborn, Nethermind, Three Sigma, Guardian, Zellic, etc.) on their scope of services and fees associated, we have estimated that each project will require a 2-month security audit at an average cost of $200K. This will enable the ADPC to potentially fund up to 50 projects; however, it should be noted that the average of $200K is an estimate and fees are usually specific to each project, each project requires a scoping exercise, and audit costs will vary based on the size of the codebase, complexity, etc.
Any feedback on this proposal is encouraged via a public discussion on the community forum.
Core Principles Underlying the ADPC Subsidy Fund
Before considering a subsidy application, applicants should carefully evaluate the need for support. The purpose of these guidelines is to clarify the subsidy program and make the process as straightforward as possible.
All applicants should keep in mind the following key principles:
Means Test: Criteria for Evaluation
The reason for this approach over a purely quantitative approach is that most projects, especially the smaller ones being targeted within this subsidy program do not possess obvious immediately measurable metrics.
The development of this Means Test aims to provide a structured approach for the ADPC to evaluate applications for financial assistance. This tool is designed to identify applicants who would benefit most from support, ensuring equitable access to subsidies within the Arbitrum Ecosystem, particularly for smaller entities with valuable contributions.
The intent is to allocate subsidies to those most in need, avoiding exploitation by larger players looking for a ‘free lunch/handout’. Such an event could give recipients an unfair advantage over their competitors or be an inefficient use of the DAO’s funds if they do not bring about a net positive change.
The means test will include a scoring system ranging from 1 to 5, reflecting the merit of each application.
Each of the sub-criteria in the means test have varying levels of importance, and they will each have a weighting attached. A weighting of 1 indicates low importance, 2 indicates neutral importance, and 3 indicates high importance.
Each application will be scored by ADPC members, followed by a collective decision on the most deserving grant recipients, taking into account the rating against the eligibility criteria, a value-for-money evaluation and the funds available. The ADPC may make other decisions in relation to the operation of the fund and selection of applicants as further detailed in the Application Process Terms.
After the applications have been reviewed and decisions taken as to the grant beneficiaries, the average score assigned to each project will be shared publicly, ensuring that transparency is maintained throughout the process. In the event that an applicant receives a high score but is not chosen as a grant recipient, explanatory feedback will be provided either on an individual or collective basis to the cohort.
Evaluation Criteria
| Criteria | Sub-Criteria | Description | Weight |
|---|---|---|---|
| Arbitrum Ecosystem Contribution How aligned is the project with the Arbitrum ecosystem and how easy will it be to track the applicant’s use of the subsidy funds? | Ecosystem Contribution | How does the applicant’s project contribute towards the growth of the Arbitrum ecosystem? | 3 |
| Transparency Practices | To what extent does the applicant demonstrate transparency in its operations? | 2 | |
| Community Engagement | How does the applicant engage with the DAO community and solicit feedback/input on its project, incorporating this into its decision-making? | 1 | |
| Accountability Measures | What mechanisms does the project have in place to ensure accountability and responsible stewardship of subsidy funds, including governance structures in place? | 3 | |
| Business Model & Need for the Subsidy How effectively does the applicant's business model align with their need for the subsidy? | Clarity of Business Model | How well-defined and understandable is the applicant’s business model? | 2 |
| Team Experience | What is the track record of the team on their ability to execute their plan? | 2 | |
| Funding Gap Rationale | Is there a clear explanation of the funding gap the applicant is facing, along with the rationale for why additional subsidy funding is necessary to achieve its objectives? | 3 | |
| Reasonableness of Subsidy Amount Requested | Does the requested subsidy amount make sense within the context of the project’s needs and potential impact? | 3 | |
| Scalability Potential | What is the scalability potential of the applicant’s business model following the support of the subsidy? | 1 | |
| Financial Analysis How realistic and stress tested is the applicant’s financial status and projections and is their plan for the use of the subsidy funds clearly outlined? | Accuracy of Projections | How realistic and well-supported are the financial projections provided by the applicant, inclusive of revenue forecasts and cost analysis? | 1 |
| Sensitivity to Scenarios | To what extent does the applicant’s financial analysis consider different scenarios, such as base, target and stress scenarios to assess the projects’ resilience and adaptability to changing market conditions? | 1 | |
| KPIs | Are there clearly defined KPIs that will be used to track the project’s performance and measure progress towards achieving its goals? | 3 | |
| Preferred Funding Distribution | Does the applicant have a preferred distribution plan for the subsidy funds, and is there a rationale provided for this distribution approach, such as front-loading funds for critical start-up costs or phased funding based on project milestones? | 2 | |
| Risk Analysis Is the applicant aware of risks with their project and what is their plan for mitigating these risks? | Risk Identification | How effectively does the applicant identify and assess potential risks and vulnerabilities that the project may have? | 2 |
| Security Requirements | Does the applicant have a clear understanding of its security requirements and the measures needed to protect against security breaches, such as through the conducting of a security audit? | 3 | |
| Mitigation Strategies | What strategies does the applicant have in place or intend to implement to safeguard against the aforementioned risks? | 2 |
Regarding the ‘Ecosystem Contribution’ metric above, we have conducted an initial assessment of the types of projects that are currently building in the Arbitrum ecosystem and identified a few verticals that the ecosystem would benefit from funding. These are set out below, along with the rationales for choosing them. We will provide more weight to these areas and welcome input from the community on our selection.
RWAs & Tokenization
Gaming
Collab Tech
You can find more detailed information on the rubrics informing the Means Test here.
Application & Review Windows
The Subsidy Fund will run in cohorts of 8 weeks each, to be decided by DAO governance. Each cohort will consist of an initial submission period of 2 weeks, followed by a 6-week review period. Moreover, a maximum cap of 25% of the total Subsidy Fund amount can be disbursed per cohort to ensure that the fund is structured to allow the door to be opened to new entrants over time. Each cohort will operate on a first-come-first-served basis for application reviews, and if the maximum capital has been allocated for the cohort, the remaining applicants will be rolled over to the next cohort.
Initial Screening
To efficiently handle the anticipated surge in applications and to ensure that the highest quality and most relevant applicants are selected, the below 5 sub-criteria (with the highest weights as mentioned above in the Means Test) will first be applied to all applicants, with the top-scoring applicants moving forward in the evaluation process and being assessed in greater depth:
The ADPC reserves the right to introduce Mandatory Requirements over time that operate as threshold tests and will publish those requirements if introduced.
In-Depth Review & Feedback
Projects that pass the initial screening will undergo a review due diligence (DD) by the ADPC, including interviews and constructive feedback (either individually or on a collective basis).
Award & Monitoring
Once approved, projects receive subsidies, with periodic check-ins and a concluding evaluation to measure impact and success.
Transparency and continuous dialogue form the backbone of our selection and reporting process, ensuring that each funded project remains aligned with program expectations.
Bi-Monthly Reports
We will provide bi-monthly updates on our selections and updates on funded projects (i.e., in line with each Cohort). These updates will include general project trajectory and progress toward milestones. To create the reports we will set regular monthly check-in dates where projects fill a template/slide in order to give the key info about the project’s status, such as:
Output Metrics
With the initial priorities in mind, some effective measures for meaningful output will look as follows:
Outcome Metrics
Depending on the final portfolio of funded projects, we will gauge the success rate of awarded projects through specific outcome metrics. While these metrics can be influenced by a wide range of external factors, such as market conditions and individual decisions on a project level, we are committed to supporting and funding the most promising projects to the best of our ability. Metrics include:
Our approach to subsidy fund allocation focuses on achieving high impact while ensuring that a de minimus number of projects obtain funding.
To ensure that the subsidy is spread across a large number of projects rather than concentrated in several larger projects, the maximum subsidy to be granted will comprise 5% of the subsidy fund available. Therefore, given that the subsidy fund comprises up to $10 million, the maximum subsidy that a project can receive will comprise no more than $500K worth of ARB.
The administration and selection process of these subsidies will be managed by the ADPC. Even though the ultimate decision will lie with the judgment of the ADPC, their assessment will be strongly guided by a means test that evaluates key metrics to determine deserving projects.
The activation of the ADPC to manage the Subsidy Fund will hinge on extending the current 6-month mandate once the Subsidy Fund becomes operational. Should the DAO or the ADPC opt against a continuation of the ADPC, a Subsidy Fund Management Committee will need to be elected. The ADPC will allocate ample time for this process to ensure the Subsidy Fund operation is not reliant on the ADPC's mandate extension.
The Subsidy Fund governance aims for transparency, efficiency, and broad community involvement. It outlines mechanisms to ensure fair and balanced decision-making for all stakeholders.
Multi-Sig
All providers must undergo and successfully complete the standard Know-Your-Business (hereinafter referred to as the ‘KYB’) verification processes with the Arbitrum Foundation prior to receiving the service-subsidy.
Subsequently, the designated Multi-sig members, established at the inception of the ADPC and voted in favour of by the ArbitrumDAO, will take charge of disbursing funds to the selected beneficiaries, whereby the transactions will be streamed using Hedgey.
In recognition of the additional responsibilities undertaken, each of the five multi-sig wallets is proposed to receive a supplementary compensation ranging from 500 ARB - 1,000 ARB monthly.
It is also important to note, as per the ratified proposal which led to the formation of the ADPC, that the multi-sig committee grants the ArbitrumDAO the authority to claw back funds from the ADPC’s multi-sig wallet using the Zodiac Governor Module, if necessary.
Checks & Balances
Kindly note that the subsidy fund will be subject to the same checks and balances found within the procurement committee proposal, regulated by an agreement entered into by all elected ADPC Members, with the Arbitrum Foundation serving as a counterparty to the agreement. These checks and balances include:
Conflict of Interest Provision: ADPC Members will be bound to act in absolute good faith, utmost honesty, refraining from deriving unauthorized profits from their position & disclose conflicts of interest. ADPC members should always disclose any potential or actual conflicts of interests to other ADPC members who will then proceed to mitigate the respective ADPC Members’ involvement in the task in relation to which such ADPC Member is conflicted.
To sum up, all ADPC Members must declare the nature and extent of any interest, direct or indirect, which the ADPC Member is aware that she, he or it has in a proposed task at hand.
Record-keeping and Reporting: Comprehensive and precise record-keeping is imperative. ADPC Members will be required to maintain detailed accounts and documentation of the ADPC’s internal operational workflow together with meeting minutes. Furthermore, periodic reporting is essential so as to keep the ArbitrumDAO updated re. Task-specific progress & internal ADPC Administration.
Duty of Impartiality: ADPC Members will have an obligation to act in an impartial manner in relation to their tasks & workflow, ensuring that the ADPC is not compromised by personal interests or external influences.
Obligation of Recusal: ADPC Members with a conflict of interest involving a project and/or service provider being reviewed by the ADPC should recuse themselves from participating in the evaluation, facilitation & administration of the applicable procurement process.
Prohibition of Self-Dealing: Participants should refrain from voting on sending funds to themselves or organizations where any portion of those funds is expected to flow to them, their other projects, or anyone they have a close personal or economic relationship with.
Ethical Trading: Members are required to follow ethical trading standards concerning ARB and any other relevant digital assets.
Grant Application Terms and Conditions can be found here.
CCing: @Immutablelawyer; @Pablo, @sid_areta, @cliffton.eth, @raam
https://forum.arbitrum.foundation/t/non-constitutional-subsidy-fund-for-security-services/22958/65
The Event Horizon Community Voted to Support this Proposal ehARB-13: EventHorizon.vote/vote/arbitrum/ehARB-13
https://forum.arbitrum.foundation/t/non-constitutional-subsidy-fund-for-security-services/22958/43
https://forum.arbitrum.foundation/t/non-constitutional-subsidy-fund-for-security-services/22958/65
The Event Horizon Community Voted to Support this Proposal ehARB-13: EventHorizon.vote/vote/arbitrum/ehARB-13
https://forum.arbitrum.foundation/t/non-constitutional-subsidy-fund-for-security-services/22958/43
https://forum.arbitrum.foundation/t/non-constitutional-subsidy-fund-for-security-services/22958/61?u=mcfly
At this point, it is standard for major Layer 2 ecosystems to offer subsidized auditing services to prospective and existing protocols. Arbitrum has to remain competitive.
https://forum.arbitrum.foundation/t/non-constitutional-subsidy-fund-for-security-services/22958/60?u=ocandocrypto
See Reasoning here. https://forum.arbitrum.foundation/t/savvy-dao-delegate-communication-thread/21266/58?u=alexlumley
https://forum.arbitrum.foundation/t/non-constitutional-subsidy-fund-for-security-services/22958/59?u=tane
https://forum.arbitrum.foundation/t/griff-green-delegate-communication-thread/25040/9?u=griff
I support auditing projects. I think this is a strong initiative that enhances security, attracts users, and benefits Arbitrum DAO. I voted for this proposal on Tally and look forward to its positive impact on the chain.
https://forum.arbitrum.foundation/t/non-constitutional-subsidy-fund-for-security-services/22958/57?u=0x_ultra
I think this is a good evolution of the procurement mandate, but believe we should be heavily reviewing and negotiating with service providers for maximum audit efficiency.
It’s been well planned and communicated over a long time.
Supporting projects in terms of audits is a good initiative
The subsidy fund of $2.5 million worth of ARB is not a small case based on the current market. I support this proposal and hope it can incentivise participation and growth among smaller projects helping them to overcome barriers to entry.
I've voted for this proposal since it benefits the development of Arbitrum DAO.
https://forum.arbitrum.foundation/t/non-constitutional-subsidy-fund-for-security-services/22958/45?u=princetonblockchain
Here https://forum.arbitrum.foundation/t/non-constitutional-subsidy-fund-for-security-services/22958/44?u=winverse
https://forum.arbitrum.foundation/t/non-constitutional-subsidy-fund-for-security-services/22958/43?u=bob-rossi
https://forum.arbitrum.foundation/t/non-constitutional-subsidy-fund-for-security-services/22958/40?u=blockworksresearch
https://forum.arbitrum.foundation/t/non-constitutional-subsidy-fund-for-security-services/22958/39
Voting FOR: https://forum.arbitrum.foundation/t/non-constitutional-subsidy-fund-for-security-services/22958/38?u=savvydao
https://forum.arbitrum.foundation/t/non-constitutional-subsidy-fund-for-security-services/22958/37?u=ocandocrypto
Generally in favor of the experiment - I think we need to refine it before the onchain vote.
I am skeptical of the proposed structure but love the goals. It's safe enough to try, but also wouldn't mind seeing another draft.
I believe the collective security level of dapps on Arbitrum is important for user acquisition, however, this approach is not good.
https://forum.arbitrum.foundation/t/non-constitutional-subsidy-fund-for-security-services/22958/34?u=jojo
https://forum.arbitrum.foundation/t/non-constitutional-subsidy-fund-for-security-services/22958/33?u=mcfly
The budget of $10 million is too high, and the initial expenses are too high, which is not conducive to later sponsorship and ecological dev
Supporting projects in terms of audits is a good initiative
https://forum.arbitrum.foundation/t/non-constitutional-subsidy-fund-for-security-services/22958/61?u=mcfly
At this point, it is standard for major Layer 2 ecosystems to offer subsidized auditing services to prospective and existing protocols. Arbitrum has to remain competitive.
https://forum.arbitrum.foundation/t/non-constitutional-subsidy-fund-for-security-services/22958/60?u=ocandocrypto
See Reasoning here. https://forum.arbitrum.foundation/t/savvy-dao-delegate-communication-thread/21266/58?u=alexlumley
https://forum.arbitrum.foundation/t/non-constitutional-subsidy-fund-for-security-services/22958/59?u=tane
https://forum.arbitrum.foundation/t/griff-green-delegate-communication-thread/25040/9?u=griff
I support auditing projects. I think this is a strong initiative that enhances security, attracts users, and benefits Arbitrum DAO. I voted for this proposal on Tally and look forward to its positive impact on the chain.
https://forum.arbitrum.foundation/t/non-constitutional-subsidy-fund-for-security-services/22958/57?u=0x_ultra
I think this is a good evolution of the procurement mandate, but believe we should be heavily reviewing and negotiating with service providers for maximum audit efficiency.
It’s been well planned and communicated over a long time.
Supporting projects in terms of audits is a good initiative
The subsidy fund of $2.5 million worth of ARB is not a small case based on the current market. I support this proposal and hope it can incentivise participation and growth among smaller projects helping them to overcome barriers to entry.
I've voted for this proposal since it benefits the development of Arbitrum DAO.
https://forum.arbitrum.foundation/t/non-constitutional-subsidy-fund-for-security-services/22958/45?u=princetonblockchain
Here https://forum.arbitrum.foundation/t/non-constitutional-subsidy-fund-for-security-services/22958/44?u=winverse
https://forum.arbitrum.foundation/t/non-constitutional-subsidy-fund-for-security-services/22958/43?u=bob-rossi
https://forum.arbitrum.foundation/t/non-constitutional-subsidy-fund-for-security-services/22958/40?u=blockworksresearch
https://forum.arbitrum.foundation/t/non-constitutional-subsidy-fund-for-security-services/22958/39
Voting FOR: https://forum.arbitrum.foundation/t/non-constitutional-subsidy-fund-for-security-services/22958/38?u=savvydao
https://forum.arbitrum.foundation/t/non-constitutional-subsidy-fund-for-security-services/22958/37?u=ocandocrypto
Generally in favor of the experiment - I think we need to refine it before the onchain vote.
I am skeptical of the proposed structure but love the goals. It's safe enough to try, but also wouldn't mind seeing another draft.
I believe the collective security level of dapps on Arbitrum is important for user acquisition, however, this approach is not good.
https://forum.arbitrum.foundation/t/non-constitutional-subsidy-fund-for-security-services/22958/34?u=jojo
https://forum.arbitrum.foundation/t/non-constitutional-subsidy-fund-for-security-services/22958/33?u=mcfly
The budget of $10 million is too high, and the initial expenses are too high, which is not conducive to later sponsorship and ecological dev
Supporting projects in terms of audits is a good initiative
Awesome. Thanks for the heads up!
Awesome. Thanks for the heads up!
@Frisson do you have any info on this for me?
Hey yall this would be really helpful for us as we get ready for the launch of Bunni v2. Are there any new application links I am missing?
The following comment represent the views of @SavvyDAO as I’m part of their team as Governance Analyst:
Savvy DAO voted for this proposal and we previously voted for 1 cohort of 8 weeks, $2.5 fund at Snapshot because it significantly boosts security and growth by covering audit costs, which is crucial for smaller projects. Additionally, the focus on key areas like RWAs & Tokenization and Stylus Adoption ensures long-term competitive advantage and growth for Arbitrum.
The following comment represent the views of @SavvyDAO as I’m part of their team as Governance Analyst:
Savvy DAO voted for this proposal and we previously voted for 1 cohort of 8 weeks, $2.5 fund at Snapshot because it significantly boosts security and growth by covering audit costs, which is crucial for smaller projects. Additionally, the focus on key areas like RWAs & Tokenization and Stylus Adoption ensures long-term competitive advantage and growth for Arbitrum.
However, it would be beneficial to include more detailed criteria for project selection to ensure transparency and fairness in the allocation process.
Dspyt Team after thoroughly reviewing the proposal for the Non-Constitutional Subsidy Fund for Security Services on the Arbitrum governance forum, we believe this initiative is essential for fostering a secure and robust ecosystem.
By subsidizing security services, the ArbitrumDAO aims to enhance the security posture of projects within the network, which is crucial for maintaining trust and reliability. Security concerns often present significant barriers for new projects; this fund will reduce onboarding friction, making it easier for innovative projects to join and thrive on Arbitrum. This influx of new projects will drive overall growth and innovation within the ecosystem.
Dspyt Team after thoroughly reviewing the proposal for the Non-Constitutional Subsidy Fund for Security Services on the Arbitrum governance forum, we believe this initiative is essential for fostering a secure and robust ecosystem.
By subsidizing security services, the ArbitrumDAO aims to enhance the security posture of projects within the network, which is crucial for maintaining trust and reliability. Security concerns often present significant barriers for new projects; this fund will reduce onboarding friction, making it easier for innovative projects to join and thrive on Arbitrum. This influx of new projects will drive overall growth and innovation within the ecosystem.
Furthermore, this initiative aligns perfectly with our goals at DSPYT and Evm Explorer. We are dedicated to promoting safe and sustainable growth in blockchain technology, and by supporting measures that enhance security, we contribute to a more resilient and trustworthy environment.
The positive feedback from various community members highlights a shared recognition of the need for such an initiative, reflecting a collective agreement on the importance of prioritizing security to safeguard the interests of all stakeholders involved.
We firmly believe that voting FOR this proposal will significantly benefit the Arbitrum community by ensuring a safer and more inviting ecosystem for new and existing projects. This initiative not only addresses immediate security needs but also strategically positions Arbitrum as a preferred platform for developers and startups. Supporting this proposal demonstrates our commitment to advancing blockchain technology and data science in a secure and sustainable manner.
@Frisson do you have any info on this for me?
Hey yall this would be really helpful for us as we get ready for the launch of Bunni v2. Are there any new application links I am missing?
The following comment represent the views of @SavvyDAO as I’m part of their team as Governance Analyst:
Savvy DAO voted for this proposal and we previously voted for 1 cohort of 8 weeks, $2.5 fund at Snapshot because it significantly boosts security and growth by covering audit costs, which is crucial for smaller projects. Additionally, the focus on key areas like RWAs & Tokenization and Stylus Adoption ensures long-term competitive advantage and growth for Arbitrum.
The following comment represent the views of @SavvyDAO as I’m part of their team as Governance Analyst:
Savvy DAO voted for this proposal and we previously voted for 1 cohort of 8 weeks, $2.5 fund at Snapshot because it significantly boosts security and growth by covering audit costs, which is crucial for smaller projects. Additionally, the focus on key areas like RWAs & Tokenization and Stylus Adoption ensures long-term competitive advantage and growth for Arbitrum.
However, it would be beneficial to include more detailed criteria for project selection to ensure transparency and fairness in the allocation process.
Dspyt Team after thoroughly reviewing the proposal for the Non-Constitutional Subsidy Fund for Security Services on the Arbitrum governance forum, we believe this initiative is essential for fostering a secure and robust ecosystem.
By subsidizing security services, the ArbitrumDAO aims to enhance the security posture of projects within the network, which is crucial for maintaining trust and reliability. Security concerns often present significant barriers for new projects; this fund will reduce onboarding friction, making it easier for innovative projects to join and thrive on Arbitrum. This influx of new projects will drive overall growth and innovation within the ecosystem.
Dspyt Team after thoroughly reviewing the proposal for the Non-Constitutional Subsidy Fund for Security Services on the Arbitrum governance forum, we believe this initiative is essential for fostering a secure and robust ecosystem.
By subsidizing security services, the ArbitrumDAO aims to enhance the security posture of projects within the network, which is crucial for maintaining trust and reliability. Security concerns often present significant barriers for new projects; this fund will reduce onboarding friction, making it easier for innovative projects to join and thrive on Arbitrum. This influx of new projects will drive overall growth and innovation within the ecosystem.
Furthermore, this initiative aligns perfectly with our goals at DSPYT and Evm Explorer. We are dedicated to promoting safe and sustainable growth in blockchain technology, and by supporting measures that enhance security, we contribute to a more resilient and trustworthy environment.
The positive feedback from various community members highlights a shared recognition of the need for such an initiative, reflecting a collective agreement on the importance of prioritizing security to safeguard the interests of all stakeholders involved.
We firmly believe that voting FOR this proposal will significantly benefit the Arbitrum community by ensuring a safer and more inviting ecosystem for new and existing projects. This initiative not only addresses immediate security needs but also strategically positions Arbitrum as a preferred platform for developers and startups. Supporting this proposal demonstrates our commitment to advancing blockchain technology and data science in a secure and sustainable manner.
Following on from @sid_areta's post, as I'm putting together the RFP, framework agreements and templates and have some relevant procurement experience, I thought it might be useful for me to respond to a few themes emerging here:
Following on from @sid_areta's post, as I'm putting together the RFP, framework agreements and templates and have some relevant procurement experience, I thought it might be useful for me to respond to a few themes emerging here:
The ADPC did discuss this in the beginning and the view was that having the ADPC establish the framework and administer the subsidy program was within the original mandate of the ADPC ultimately approved through governance.
This decision was not taken lightly. We carefully considered the original Snapshot and proposal as well as the significant workload involved and the resources within the team. It would have been far easier for us to handball this to someone else with the risk it falls into a hole at the end of the 6 month tenure. It did not strike any of us as good stewardship or professionalism.
The concern we have in bringing a new committee onboard is that (A) it creates a new workstream that was not part of the original mandate and, (B) even if we got a new committee spun up, would result in significant delays while new team gets voted in, briefed on the procurement strategy, wraps their head around the legalities of the framework agreement, state of negotiations, tools and processes etc. That’s 4-6 weeks of their 8 week sprint gone.
If the DAO supports a truncated proof-of-concept, the better "bang for buck" would be to let the current ADPC facilitate this first tranche, re-assess at the end of the POC and then feed the learnings into a more substantial program. There is a lot of upside doing it this way.
The ADPC identified this as a critical requirement early on. We have been in contact with several organisations and individuals who might be able to assist. However one challenge has been identifying suitable SMEs who are not already conflicted out or who might be seen to be biased. Both of these factors knock out many candidates.
Having run a lot of procurements both in government and the private sector, best practice involves establishing a core team consisting of strategic procurement specialists driving the Approach-to-Market and lawyers experienced in strategic sourcing. We believe we have those resources on hand.
Technical SMEs certainly have an important role to play in defining requirements, the technical evaluation criteria and evaluating RFP responses and we definitely want to include suitably qualified SMEs in that process. However the technical requirements are only one part of a procurement process and evaluation.
Given the problems flagged above in terms of conflicts of interest, one suggestion offered to the ADPC was to speak with experienced buyers of audit services so we are exploring that option as well.
As can be seen from the ADPC Dashboard, the ADPC has made great progress on significant pieces of the Framework. We have already released the first draft of the Means Test and the related Terms and Conditions. This alone was a considerable piece of work - we hope this serves as a role model for other grant programs.
The first draft of the Procurement Framework is being currently reviewed internally, pending input from SMEs and the Foundation. Once those steps are completed, we’ll be ready to publish the RFP and Head Agreement and officially kick off the procurement stage. We know everyone is super keen to get this ball rolling however we only have one chance to get it right. Once the RFP is published, it is inadvisable to make changes as it creates havoc for respondents and undermines probity of the process.
As part of the publication step, we’ll be developing a TLDR and overview to the legal documents to assist all participants. Keep an eye out for updates!
Following on from @sid_areta's post, as I'm putting together the RFP, framework agreements and templates and have some relevant procurement experience, I thought it might be useful for me to respond to a few themes emerging here:
Following on from @sid_areta's post, as I'm putting together the RFP, framework agreements and templates and have some relevant procurement experience, I thought it might be useful for me to respond to a few themes emerging here:
The ADPC did discuss this in the beginning and the view was that having the ADPC establish the framework and administer the subsidy program was within the original mandate of the ADPC ultimately approved through governance.
This decision was not taken lightly. We carefully considered the original Snapshot and proposal as well as the significant workload involved and the resources within the team. It would have been far easier for us to handball this to someone else with the risk it falls into a hole at the end of the 6 month tenure. It did not strike any of us as good stewardship or professionalism.
The concern we have in bringing a new committee onboard is that (A) it creates a new workstream that was not part of the original mandate and, (B) even if we got a new committee spun up, would result in significant delays while new team gets voted in, briefed on the procurement strategy, wraps their head around the legalities of the framework agreement, state of negotiations, tools and processes etc. That’s 4-6 weeks of their 8 week sprint gone.
If the DAO supports a truncated proof-of-concept, the better "bang for buck" would be to let the current ADPC facilitate this first tranche, re-assess at the end of the POC and then feed the learnings into a more substantial program. There is a lot of upside doing it this way.
The ADPC identified this as a critical requirement early on. We have been in contact with several organisations and individuals who might be able to assist. However one challenge has been identifying suitable SMEs who are not already conflicted out or who might be seen to be biased. Both of these factors knock out many candidates.
Having run a lot of procurements both in government and the private sector, best practice involves establishing a core team consisting of strategic procurement specialists driving the Approach-to-Market and lawyers experienced in strategic sourcing. We believe we have those resources on hand.
Technical SMEs certainly have an important role to play in defining requirements, the technical evaluation criteria and evaluating RFP responses and we definitely want to include suitably qualified SMEs in that process. However the technical requirements are only one part of a procurement process and evaluation.
Given the problems flagged above in terms of conflicts of interest, one suggestion offered to the ADPC was to speak with experienced buyers of audit services so we are exploring that option as well.
As can be seen from the ADPC Dashboard, the ADPC has made great progress on significant pieces of the Framework. We have already released the first draft of the Means Test and the related Terms and Conditions. This alone was a considerable piece of work - we hope this serves as a role model for other grant programs.
The first draft of the Procurement Framework is being currently reviewed internally, pending input from SMEs and the Foundation. Once those steps are completed, we’ll be ready to publish the RFP and Head Agreement and officially kick off the procurement stage. We know everyone is super keen to get this ball rolling however we only have one chance to get it right. Once the RFP is published, it is inadvisable to make changes as it creates havoc for respondents and undermines probity of the process.
As part of the publication step, we’ll be developing a TLDR and overview to the legal documents to assist all participants. Keep an eye out for updates!
Hello, Bernard! Thank you for this proposal I'm from the Crypto Unicorns project that is about to join the XAI and Arbitrum ecosystem late this month.
I tried clicking on Application Process Team document but I don't seem to have access to it. How do I request access to this? Thank you!
Hello, Bernard! Thank you for this proposal I'm from the Crypto Unicorns project that is about to join the XAI and Arbitrum ecosystem late this month.
I tried clicking on Application Process Team document but I don't seem to have access to it. How do I request access to this? Thank you!
Hey @GoodCookie! The subsidy fund should be open from September onwards and we'll share more information closer to then once we finish whitelisting security service providers for the DAO and begin to operationalize the fund.
DAOplomats voted FOR this proposal during the onchain vote.
We maintained our stance from Snapshot where we supported to fund with $2,500,000 worth of ARB for 1 cohort of 8 weeks.
I voted for this proposal on Tally for the reasons listed below.
I voted for this proposal, as the enhancements done on it since the Snapshot vote made it more focused and, overall, a better proposal for the DAO. Props to the ADPC that analysed the review from the delegates and improved it.
Hey @GoodCookie! The subsidy fund should be open from September onwards and we'll share more information closer to then once we finish whitelisting security service providers for the DAO and begin to operationalize the fund.
DAOplomats voted FOR this proposal during the onchain vote.
We maintained our stance from Snapshot where we supported to fund with $2,500,000 worth of ARB for 1 cohort of 8 weeks.
I voted for this proposal on Tally for the reasons listed below.
I voted for this proposal, as the enhancements done on it since the Snapshot vote made it more focused and, overall, a better proposal for the DAO. Props to the ADPC that analysed the review from the delegates and improved it.
We vote FOR the proposal on Tally.
We voted for the option, "8 weeks and $2.5M fund" and maintain the stance for the onchain proposal. It's critical for the DAO to allocate the fund for the smaller projects with security considered. We also appreciate the ADPC team for accommodating the feedback from the delegates and pushing through the proposal to get started.
Blockworks Research will be voting FOR this proposal on Tally.
Seeing as the proposal has been ameliorated to take into consideration our previous comments, we are voting FOR this proposal on Tally. To reiterate what we have said previously, we believe the subsidy fund is absolutely necessary for the establishment of smaller projects yet to achieve network effects. Additionally, we are pleased to see the proposal amended to a pilot phase first, as we believe that a test period is important and that the DAO should prioritize funds elsewhere before taking larger leaps.
voted FOR on Tally for the reasons expressed above
At first, I chose to abstain from voting on this proposal, but I decided to vote FOR on Tally.
I’ve come to realize that this initiative is vital for enhancing security and fostering growth by covering audit expenses, which is especially important for smaller projects.
At first, I chose to abstain from voting on this proposal, but I decided to vote FOR on Tally.
I’ve come to realize that this initiative is vital for enhancing security and fostering growth by covering audit expenses, which is especially important for smaller projects.
Also, the emphasis on areas like RWAs & Tokenization and the adoption of Stylus positions Arbitrum for sustained competitive advantage and future growth.
As match on our current proposals goals, pushing stylus, orbit and Arbitrum ecosystem as infrastructure in the long term.
We're voting FOR this proposal. We previously backed the 8-week pilot at the Snapshot stage. This initiative addresses a key barrier for web3 innovators - audit costs. By offering a clear path to audits, we'll attract builders, enhance ecosystem safety, and drive innovation on Arbitrum. No brainer. Starting small allows for refinement before scaling.
I've voted FOR this proposal because
Enhanced Security: The primary objective of this fund is to bolster the security infrastructure of the Arbitrum network. Allocating resources specifically for security services can help in preventing and mitigating potential threats, ensuring a more robust and secure environment for all users and developers involved in the ecosystem.
I've voted FOR this proposal because
Enhanced Security: The primary objective of this fund is to bolster the security infrastructure of the Arbitrum network. Allocating resources specifically for security services can help in preventing and mitigating potential threats, ensuring a more robust and secure environment for all users and developers involved in the ecosystem.
Proactive Measures: By setting up this subsidy fund, the DAO demonstrates a proactive approach to security, addressing vulnerabilities before they can be exploited. This forward-thinking strategy can help build trust among stakeholders and users, knowing that the network is committed to maintaining high security standards.
Attracting More Users and Developers: A well-secured platform is more attractive to new users and developers. Knowing that there are dedicated resources for maintaining security can incentivize more participants to join and contribute to the Arbitrum ecosystem, potentially leading to greater innovation and growth.
Voted FOR due to the following reasons:
Thank you for this proposal; we are enthusiastic about its progress. While we acknowledge that we might be a bit late in offering suggestions, we hope our input can still be considered.
A primary topic at the top of Entropy's mind at the moment is enabling projects to integrate Stylus into their tech stacks. We are working on a proposal in this regard. Given that Stylus is a key differentiator for Arbitrum, it's crucial to address the current lack of auditors proficient in dapps consisting of contracts written in multiple languages using Stylus. We urge the DAO to prioritize support for projects aiming to leverage this vital technology, ensuring they have the necessary resources for success, and that auditors have a proper incentive to learn how to audit projects using Stylus.
gm, late feedback here.
I have voted FOR and I am directionally supportive of the initiative as I believe it would be a fantastic incentive for the best undercapitalized builders to create and deploy on Arbitrum. This is another way to remove frictions.
gm, late feedback here.
I have voted FOR and I am directionally supportive of the initiative as I believe it would be a fantastic incentive for the best undercapitalized builders to create and deploy on Arbitrum. This is another way to remove frictions.
However, as others have pointed out, I am not convinced about the approach suggested, so voted for the smallest funding option as this will be an exploratory pilot.
The following reflects the views of L2BEAT’s governance team, composed of @krst and @Sinkas, and it’s based on the combined research, fact-checking, and ideation of the two.
We’ll be voting FOR this proposal.
The following reflects the views of L2BEAT’s governance team, composed of @krst and @Sinkas, and it’s based on the combined research, fact-checking, and ideation of the two.
We’ll be voting FOR this proposal.
We supported the proposal to establish the subsidy fund during temp-check, choosing to fund it with $2,500,000 worth of ARB for 1 cohort of 8 weeks. We’re maintaining our stance for the on-chain vote and therefore we’ll voting for it.
Hi all, thank you for your engagement on this proposal and for voting in favour on Snapshot! We appreciate all the feedback we have received and are in the process of implementing it.
Addressing the first major point of feedback, we are instituting an independent committee for selection of subsidy recipients and will provide further details regarding the proposed structure of the committee soon.
After consideration Treasure’s Arbitrum Representative Council (ARC) would like to share the following feedback on the proposal
We are directionally supportive of the proposal and have voted FOR allocating $2,500,000 to the Subsidy Fund, intended to support a single 8-week cohort. We view this as a trial phase, with the possibility of expansion contingent upon performance. Establishing the Subsidy Fund holds promise in aiding and drawing in builders, especially those engaged in smaller, emerging projects within the Arbitrum ecosystem.
I don't see why the DAO should pay for the audits of new protocols. Yes security is important, but so is creating an environment where real businesses decide to create real value based on real success. We're creating so much noise that it'll be hard to spot the signal and the protocols that truly deserve our attention.
SEED Latam voted to ABSTAIN on this proposal, since, even though we fully agree on the goal behind it - subsidizing security services could help a lot in reducing friction for onboarding new projects looking to build on arbitrum, we think there are still some points that have to be defined as mentioned by @pedrob.
Voted for this proposal on Tally as it enhances security, attracts more users and benefits the chain as a whole. I'm glad to see this proposal pushed through and I'm looking forward to seeing the first few projects tapping into it!
The Princeton Blockchain Club is voting 100% FOR funding one 8-week cohort at the Snapshot stage.
Just like many other delegates, we're directionally in favor of this proposal, though most options are quite high for an 8-week program. We're voting for the smallest funding option, as we'd like to see this first roll out as a pilot program and iron out the execution issues mentioned earlier in the thread.
DAOplomats voted in favor of funding one cohort of eight weeks, $2.5M.
There is still some clarity needed before this goes to Tally but we are in support of an eight week pilot. Also, we support the reduced cap of 500 ARB each for the multisig. It is extra work so they should at least be compensated for that.
I have voted for "1 cohort of 8 weeks, funding 2.5m".
The DAO has shown a near unanimous desire to create a framework for security service providers as indicated from the results of the proposal. As well as put their trust in the 3 committee members elected to use their expertise to find the best path forward. While I absolutely love to see the discussion and feedback, I also want to show a good-faith trust in those elected to the committee and see their idea through. For that reason, I think the 8 week trial funding is a good start for this. This should give us the opportunity to view how successful this type of process is and re-assess at a later date.
Thank you for all your feedback here. As an update, yesterday we published the proposed structure for the independent committee for the selection of subsidy recipients here.
To ensure we act with sufficient speed, we are aiming to put the proposal up on Snapshot next Monday (20 May) and would greatly appreciate your opinions on the committee structure!
While I appreciate the purpose of this subsidy fund proposal and recognize the considerable effort put into it, I have concerns about supporting it. I'd vote "no" on this proposal due to a few concerns. Firstly, it centralizes too much power with the ADPC over the large $10 million fund. There's also a risk that projects might become too dependent on these subsidies, potentially impacting their organic growth and innovation. Plus, the complex application and evaluation process could lead to inefficiencies or misallocation of funds. More community input and a decentralized decision-making process could improve the proposal's alignment with the broader ecosystem's needs but I still don't see the necessity for its execution. It's not a sustainable mean of enhancing security among Arbitrum projects. In fact, it's not ArbitrumDAO's job to cover its ecosystem audit costs. Most of the good projects (can) raise or earn enough fund to cover audits if needed. These grants might also negatively affect the ARB token's price action as usual. We should allow the ecosystem to grow more organically.
We vote FOR the proposal on Tally.
We voted for the option, "8 weeks and $2.5M fund" and maintain the stance for the onchain proposal. It's critical for the DAO to allocate the fund for the smaller projects with security considered. We also appreciate the ADPC team for accommodating the feedback from the delegates and pushing through the proposal to get started.
Blockworks Research will be voting FOR this proposal on Tally.
Seeing as the proposal has been ameliorated to take into consideration our previous comments, we are voting FOR this proposal on Tally. To reiterate what we have said previously, we believe the subsidy fund is absolutely necessary for the establishment of smaller projects yet to achieve network effects. Additionally, we are pleased to see the proposal amended to a pilot phase first, as we believe that a test period is important and that the DAO should prioritize funds elsewhere before taking larger leaps.
voted FOR on Tally for the reasons expressed above
At first, I chose to abstain from voting on this proposal, but I decided to vote FOR on Tally.
I’ve come to realize that this initiative is vital for enhancing security and fostering growth by covering audit expenses, which is especially important for smaller projects.
At first, I chose to abstain from voting on this proposal, but I decided to vote FOR on Tally.
I’ve come to realize that this initiative is vital for enhancing security and fostering growth by covering audit expenses, which is especially important for smaller projects.
Also, the emphasis on areas like RWAs & Tokenization and the adoption of Stylus positions Arbitrum for sustained competitive advantage and future growth.
As match on our current proposals goals, pushing stylus, orbit and Arbitrum ecosystem as infrastructure in the long term.
We're voting FOR this proposal. We previously backed the 8-week pilot at the Snapshot stage. This initiative addresses a key barrier for web3 innovators - audit costs. By offering a clear path to audits, we'll attract builders, enhance ecosystem safety, and drive innovation on Arbitrum. No brainer. Starting small allows for refinement before scaling.
I've voted FOR this proposal because
Enhanced Security: The primary objective of this fund is to bolster the security infrastructure of the Arbitrum network. Allocating resources specifically for security services can help in preventing and mitigating potential threats, ensuring a more robust and secure environment for all users and developers involved in the ecosystem.
I've voted FOR this proposal because
Enhanced Security: The primary objective of this fund is to bolster the security infrastructure of the Arbitrum network. Allocating resources specifically for security services can help in preventing and mitigating potential threats, ensuring a more robust and secure environment for all users and developers involved in the ecosystem.
Proactive Measures: By setting up this subsidy fund, the DAO demonstrates a proactive approach to security, addressing vulnerabilities before they can be exploited. This forward-thinking strategy can help build trust among stakeholders and users, knowing that the network is committed to maintaining high security standards.
Attracting More Users and Developers: A well-secured platform is more attractive to new users and developers. Knowing that there are dedicated resources for maintaining security can incentivize more participants to join and contribute to the Arbitrum ecosystem, potentially leading to greater innovation and growth.
Voted FOR due to the following reasons:
Thank you for this proposal; we are enthusiastic about its progress. While we acknowledge that we might be a bit late in offering suggestions, we hope our input can still be considered.
A primary topic at the top of Entropy's mind at the moment is enabling projects to integrate Stylus into their tech stacks. We are working on a proposal in this regard. Given that Stylus is a key differentiator for Arbitrum, it's crucial to address the current lack of auditors proficient in dapps consisting of contracts written in multiple languages using Stylus. We urge the DAO to prioritize support for projects aiming to leverage this vital technology, ensuring they have the necessary resources for success, and that auditors have a proper incentive to learn how to audit projects using Stylus.
gm, late feedback here.
I have voted FOR and I am directionally supportive of the initiative as I believe it would be a fantastic incentive for the best undercapitalized builders to create and deploy on Arbitrum. This is another way to remove frictions.
gm, late feedback here.
I have voted FOR and I am directionally supportive of the initiative as I believe it would be a fantastic incentive for the best undercapitalized builders to create and deploy on Arbitrum. This is another way to remove frictions.
However, as others have pointed out, I am not convinced about the approach suggested, so voted for the smallest funding option as this will be an exploratory pilot.
The following reflects the views of L2BEAT’s governance team, composed of @krst and @Sinkas, and it’s based on the combined research, fact-checking, and ideation of the two.
We’ll be voting FOR this proposal.
The following reflects the views of L2BEAT’s governance team, composed of @krst and @Sinkas, and it’s based on the combined research, fact-checking, and ideation of the two.
We’ll be voting FOR this proposal.
We supported the proposal to establish the subsidy fund during temp-check, choosing to fund it with $2,500,000 worth of ARB for 1 cohort of 8 weeks. We’re maintaining our stance for the on-chain vote and therefore we’ll voting for it.
Hi all, thank you for your engagement on this proposal and for voting in favour on Snapshot! We appreciate all the feedback we have received and are in the process of implementing it.
Addressing the first major point of feedback, we are instituting an independent committee for selection of subsidy recipients and will provide further details regarding the proposed structure of the committee soon.
After consideration Treasure’s Arbitrum Representative Council (ARC) would like to share the following feedback on the proposal
We are directionally supportive of the proposal and have voted FOR allocating $2,500,000 to the Subsidy Fund, intended to support a single 8-week cohort. We view this as a trial phase, with the possibility of expansion contingent upon performance. Establishing the Subsidy Fund holds promise in aiding and drawing in builders, especially those engaged in smaller, emerging projects within the Arbitrum ecosystem.
I don't see why the DAO should pay for the audits of new protocols. Yes security is important, but so is creating an environment where real businesses decide to create real value based on real success. We're creating so much noise that it'll be hard to spot the signal and the protocols that truly deserve our attention.
SEED Latam voted to ABSTAIN on this proposal, since, even though we fully agree on the goal behind it - subsidizing security services could help a lot in reducing friction for onboarding new projects looking to build on arbitrum, we think there are still some points that have to be defined as mentioned by @pedrob.
Voted for this proposal on Tally as it enhances security, attracts more users and benefits the chain as a whole. I'm glad to see this proposal pushed through and I'm looking forward to seeing the first few projects tapping into it!
The Princeton Blockchain Club is voting 100% FOR funding one 8-week cohort at the Snapshot stage.
Just like many other delegates, we're directionally in favor of this proposal, though most options are quite high for an 8-week program. We're voting for the smallest funding option, as we'd like to see this first roll out as a pilot program and iron out the execution issues mentioned earlier in the thread.
DAOplomats voted in favor of funding one cohort of eight weeks, $2.5M.
There is still some clarity needed before this goes to Tally but we are in support of an eight week pilot. Also, we support the reduced cap of 500 ARB each for the multisig. It is extra work so they should at least be compensated for that.
I have voted for "1 cohort of 8 weeks, funding 2.5m".
The DAO has shown a near unanimous desire to create a framework for security service providers as indicated from the results of the proposal. As well as put their trust in the 3 committee members elected to use their expertise to find the best path forward. While I absolutely love to see the discussion and feedback, I also want to show a good-faith trust in those elected to the committee and see their idea through. For that reason, I think the 8 week trial funding is a good start for this. This should give us the opportunity to view how successful this type of process is and re-assess at a later date.
Thank you for all your feedback here. As an update, yesterday we published the proposed structure for the independent committee for the selection of subsidy recipients here.
To ensure we act with sufficient speed, we are aiming to put the proposal up on Snapshot next Monday (20 May) and would greatly appreciate your opinions on the committee structure!
While I appreciate the purpose of this subsidy fund proposal and recognize the considerable effort put into it, I have concerns about supporting it. I'd vote "no" on this proposal due to a few concerns. Firstly, it centralizes too much power with the ADPC over the large $10 million fund. There's also a risk that projects might become too dependent on these subsidies, potentially impacting their organic growth and innovation. Plus, the complex application and evaluation process could lead to inefficiencies or misallocation of funds. More community input and a decentralized decision-making process could improve the proposal's alignment with the broader ecosystem's needs but I still don't see the necessity for its execution. It's not a sustainable mean of enhancing security among Arbitrum projects. In fact, it's not ArbitrumDAO's job to cover its ecosystem audit costs. Most of the good projects (can) raise or earn enough fund to cover audits if needed. These grants might also negatively affect the ARB token's price action as usual. We should allow the ecosystem to grow more organically.
Hi all, thank you for your engagement on this proposal and for voting in favour on Snapshot! We appreciate all the feedback we have received and are in the process of implementing it.
Addressing the first major point of feedback, we are instituting an independent committee for selection of subsidy recipients and will provide further details regarding the proposed structure of the committee soon.
Regarding the second major point of feedback, i.e., proposing to add a Security SME to the ADPC, we managed to secure a trusted third party, who we are proposing to provide its services to the ADPC including:
We have managed to secure the help of DeDaub. DeDaub is a well-known security services firm which has worked with the likes of the Ethereum Foundation, EigenLayer, Chainlink, GMX, Lido, Maple, Pendle, etc., and has completed 200+ audits for 59 clients over 14 chains.
The next step before onboarding DeDaub is to get the DAO’s confirmation via Snapshot to use part of the ADPC’s budget to pay them. Note, the ADPC already has the funds in the Multi-Sig as part of the original endowment, but since this was not explicitly approved for spending by the DAO in the original Tally vote, we are requesting approval via Snapshot to use these funds to pay DeDaub. Find details below:
We propose to pay DeDaub a total of 12k ARB for their assistance on crafting the requirements and helping whitelist the security service providers. We believe this is fair since:
As such, we believe a compensation of 12k ARB is fair for the value DeDaub will bring to the ADPC and to this process.
Moreover, we also request an additional 10k ARB to the ADPC’s budget as an operational buffer to ensure that the ADPC can operate with speed and does not need to get the DAO’s approval for any small operational matters. Of course, this will be returned to the DAO’s treasury upon the completion of the ADPC’s tenure if it has not been utilized, and will not be spent on any internal salaries.
We will put up a Snapshot to get the ball rolling on this budget approval and reduce the likelihood of any delay in meeting timelines.
Summary Ask: 22k ARB in total (12k ARB compensation for DeDaub and 10k ARB operational buffer) to use from the ADPC’s buffer in the multi-sig.
Note: To confirm, DeDaub’s participation as the Security SME will preclude them from responding to the RFP and applying to be a whitelisted security service provider.
SEED Latam voted to ABSTAIN on this proposal, since, even though we fully agree on the goal behind it - subsidizing security services could help a lot in reducing friction for onboarding new projects looking to build on arbitrum, we think there are still some points that have to be defined as mentioned by @pedrob.
The ADPC identified this as a critical requirement early on. We have been in contact with several organisations and individuals who might be able to assist. However one challenge has been identifying suitable SMEs who are not already conflicted out or who might be seen to be biased. Both of these factors knock out many candidates.
On this part tho, I think we could simply have someone who served as a member of a past Security Council cohort. Since they would already be somewhat vetted and "Arbitrum aligned".
I have voted for "1 cohort of 8 weeks, funding 2.5m".
The DAO has shown a near unanimous desire to create a framework for security service providers as indicated from the results of the proposal. As well as put their trust in the 3 committee members elected to use their expertise to find the best path forward. While I absolutely love to see the discussion and feedback, I also want to show a good-faith trust in those elected to the committee and see their idea through. For that reason, I think the 8 week trial funding is a good start for this. This should give us the opportunity to view how successful this type of process is and re-assess at a later date.
I'll add, the ADPC's willingness to take feedback into consideration is noted and part of the reason I think it's fair to move this forward with an exploratory period. This is a good indication that they are willing to take a look at how the next 8 weeks go and have an honest feedback on what can be improved.
As for general opinions, I do think @McFly brings up a good point regarding negotiating discounts. I don't even want to begin to pretend I know what going rates are, but I think it's important to remember that Arbitrum is a leader in this space and should be able to reap some of the benefits of that when it comes to bargaining power.
I will also agree with others - I'm not sure I'm for giving additional compensation to multisig signers after the fact.
Edit: My opinion is unchanged since the Snapshot vote, to save space editing this response to indicate that I will be voting "For" on Tally.
Thank you for all your engagement and feedback on this proposal! Given the complexity of the task at hand, the feedback has been extremely useful in helping us refine and improve the proposal.
This post will break down a subset of the major themes of the feedback and outline our plan for incorporating it. @Pablo will be providing responses on the following feedback themes in due course that this post will not cover:
Thank you for all your engagement and feedback on this proposal! Given the complexity of the task at hand, the feedback has been extremely useful in helping us refine and improve the proposal.
This post will break down a subset of the major themes of the feedback and outline our plan for incorporating it. @Pablo will be providing responses on the following feedback themes in due course that this post will not cover:
I. Mandate of the ADPC & Process for Whitelisting of Security Service Providers for the Provision of Subsidies II. Set-up of Independent Committee to Disburse Subsidies III. Addition of a Security Expert to the ADPC IV. Timeline and Sequence of Events V. Proposed Alternative Approaches
Feedback
There has been an ask from @coinflip and @mcfly around the input collated to define the size of the subsidy fund.
Response
To clarify, as mentioned in the proposal, we directly consulted with security service providers on their scope of services and fees:
The figure of up to $10 million worth of ARB has been determined via a benchmarking exercise conducted with various security audit service providers. This form was shared with these service providers and based on the responses of 10 service providers (including the likes of Spearbit, Halborn, Nethermind, Three Sigma, Guardian, Zellic, etc.) on their scope of services and fees associated, we have estimated that each project will require a 2-month security audit at an average cost of $200K.
As @ImmutableLawyer has mentioned above, the specific fees provided by each service provider cannot be made public due to privacy requirements and competition issues from the service providers. However, as @coinflip has suggested, we are happy to run the data points and our assumptions past members of the Foundation, who we already shared this with. To provide further clarity, the figure of $200K for a 2-month audit was based on data points / fee structures provided of:
Edit: Having spoken to the Foundation on whether they can publicly confirm the sanity check, as a rule of thumb their role is not to approve what the DAO does or provide public endorsements. As such, we will find another party to do so, most likely the security expert we are currently sourcing.
Feedback
A fund of $10 million worth of ARB is too high to begin with and a smaller pilot fund is more desirable.
Response
We are happy to institute a smaller pilot fund and already took this feedback on board in providing the different options for fund size and duration on Snapshot.
Feedback
There is no need to expand the budget to control the multi-sig to disburse the Subsidy Funds, as pointed out by @pedrob and @mcfly.
Response
As you can see in the Tally vote, the responsibilities for the Multi-Sig signers are the following:
Given that the signers will now have an additional responsibility to disburse the subsidy funds to recipients, and this is a more time-intensive task with potentially higher frequency, it may be fair to compensate them accordingly. We'd propose limiting the additional pay to 500 ARB in that case, given they already have an existing mandate. However, if there are allergic reactions to this or the MSig signers want to waive payment, we are open to any proposal.
I voted for this proposal with the 1 cohort of 8 weeks option. A subsidy fund for security services is a valuable service to provide the Arbitrum ecosystem. I'd like to see this rolled out as a pilot and then reviewed and scaled from there based on learnings from the pilot. I'm open to increasing the scope/size of the pilot if additional details are added to the proposal prior to the onchain vote.
Blockworks Research will be splitting its vote on Snapshot; 50% for do not fund and 50% for the $2.5M fund.
On a fundamental level, we like the idea behind the subsidy fund and think it’s highly beneficial to support smaller, non-established projects. While this proposal is undoubtedly extensive and showcases that a vast amount of thought has gone into different frameworks, as pointed out by other delegates, we feel that it is still somewhat rushed. Consequently, more work is required before we feel comfortable voting for this proposal onchain. In particular, we agree with points 1. and 2. made by @mcfly, and it would be great to have a further discussion around this point:
Furthermore, the proposed average cost of $200k for a 2-month security audit seems significantly higher than what many small projects have experienced in the past. In my personal experience contributing to projects since 2017, I have never paid more than $110k for a security audit with top-tier firms, with the usual average price among the latest invoices received being around $30 per line of Solidity code as of the end of 2023.
Blockworks Research will be splitting its vote on Snapshot; 50% for do not fund and 50% for the $2.5M fund.
On a fundamental level, we like the idea behind the subsidy fund and think it’s highly beneficial to support smaller, non-established projects. While this proposal is undoubtedly extensive and showcases that a vast amount of thought has gone into different frameworks, as pointed out by other delegates, we feel that it is still somewhat rushed. Consequently, more work is required before we feel comfortable voting for this proposal onchain. In particular, we agree with points 1. and 2. made by @mcfly, and it would be great to have a further discussion around this point:
Furthermore, the proposed average cost of $200k for a 2-month security audit seems significantly higher than what many small projects have experienced in the past. In my personal experience contributing to projects since 2017, I have never paid more than $110k for a security audit with top-tier firms, with the usual average price among the latest invoices received being around $30 per line of Solidity code as of the end of 2023.
In addition to the above points, we think the fund being run by the ADPC would lead to a sub-optimal operational structure. As pointed out by @coinflip, the ADPC’s original mandate was to focus on the operational side by, for example, establishing frameworks and setting up programs. By engaging in the selection and oversight process as well, effectively 1/3 of the ADPC’s current term would be diverted from the important task of creating a foundational procurement structure for the DAO. Having said that, we are conscious of the ADPC having expressed willingness to establish a separate committee for the fund, which we think would be a great addition to this proposal. This could be structured such that both security and procurement experts could be appointed, and would be another avenue through which the ADPC would standardize the procurement framework for the DAO.
I have decided to ABSTAIN from voting on the "Subsidy Fund Proposal from the Arbitrum DAO Procurement Committee" at this stage.
Rationale:
I have decided to ABSTAIN from voting on the "Subsidy Fund Proposal from the Arbitrum DAO Procurement Committee" at this stage.
Rationale:
While the proposal significantly addresses a crucial aspect of the Arbitrum ecosystem—enhancing security, which I deeply value—there are numerous legal and procedural details that I need to understand better. The complexity of the issues presented requires more thorough consideration to make a fully informed decision.
Comments:
Before moving forward with my final decision in the on-chain voting, I would love to first understand:
Cohort Program Execution: What is the expected execution of this program? For example, if the option of 1 cohort, 8 weeks, and say, 2.5M ARB is chosen, what would be expected from a program like this? How is going to run this effort, etc. I'm not seeing this detail in this proposal and as we saw on another programs there's a lot of work involved. Apart from reports, results, KPIs, etc.
Regarding the audit firms, I appreciate the diversity. And of course, I applaud Joseph and the procurement committee for pushing these efforts in the DAO which, although quite technical to implement, are very necessary for the security and long-term well-being of the ecosystem.
The following reflects the views of L2BEAT’s governance team, composed of @krst and @Sinkas, and it’s based on the combined research, fact-checking, and ideation of the two.
We’re voting in favor of the proposal and specifically to fund the SF with 2,500,000 for 1 cohort of 8 weeks to run as a pilot. The Subsidy Fund is something that we definitely want to see established as it could be extremely helpful for builders, especially of smaller, newer projects, building on Arbitrum.
The following reflects the views of L2BEAT’s governance team, composed of @krst and @Sinkas, and it’s based on the combined research, fact-checking, and ideation of the two.
We’re voting in favor of the proposal and specifically to fund the SF with 2,500,000 for 1 cohort of 8 weeks to run as a pilot. The Subsidy Fund is something that we definitely want to see established as it could be extremely helpful for builders, especially of smaller, newer projects, building on Arbitrum.
We would have supported the proposal for a larger amount and a longer duration as we believe there has been a lot of thought gone into it, but there are some concerns with the execution side of the proposal that led us to rethink our decision.
To conclude, we’re voting in favor of the proposal as a signal when it comes to its direction, but we’d like to clarify the details before the proposal goes to an on-chain vote.
Savvy DAO has voted FOR "100% for 1 cohort of 8 weeks, $2.5M fund" for the Subsidy Fund for Security Services proposal for the following compelling reasons:
Savvy DAO has voted FOR "100% for 1 cohort of 8 weeks, $2.5M fund" for the Subsidy Fund for Security Services proposal for the following compelling reasons:
See delegate thread: https://forum.arbitrum.foundation/t/non-constitutional-subsidy-fund-for-security-services/22958/38?u=savvydao
We are in favor of the proposal to establish a subsidy fund. This initiative aligns well with our vision for the DAO as a support system for developers and protocols building on the Arbitrum platform. By providing financial assistance for essential security audits, this fund would greatly benefit developers who might otherwise lack access to such critical services, thereby fostering a secure and robust development environment within the Arbitrum ecosystem. However, there are some concerns raised by other delegates about the essential groundwork that remains to be completed to ensure the effectiveness and integrity of the subsidy fund. Given these considerations, we propose to support this initiative as a pilot program initially. We suggest allocating a portion of the total fund $2.5 million for the first cohort. This approach will allow us to observe the program's implementation and effectiveness, address any unforeseen challenges, and evaluate the program's results before committing further resources.
For snapshot, voting "for" on 2 cohort of 8 weeks for 5M arb.
I partially share some concerns about the size, and dao wanting to first try with a lower amount. But, I think 2 months are just not enough. Audits can potentially be complex as a process, in 60 days we might just not encounter enough different situations to properly assess the best way to operate.
For snapshot, voting "for" on 2 cohort of 8 weeks for 5M arb.
I partially share some concerns about the size, and dao wanting to first try with a lower amount. But, I think 2 months are just not enough. Audits can potentially be complex as a process, in 60 days we might just not encounter enough different situations to properly assess the best way to operate.
On the whitelisting of operators. I agree that there can be a concern about ADPC whitelisting operators. But I also know security is hard, and there are few people who actually know security, both in holistic terms and in specific, vertical terms. I used to work in cyber threat intelligence myself before larping as a cow on the internet, and want to touch this.
Hope the ADPC takes this feedback to help refine their proposal, and to critcally evaluate what role they are intended to have during this initial 6 month mandate, is it to run procurement for the DAO or is it to recommend and hopefully implement systems for the DAO to be able to handle such activities at scale in many areas of DAO procurement.
There is a merit in what flip said. But there is also a merit in understanding that a "simple" election from the dao on people able to vet security expert is in my opinion not feasible. Either we pre fetch strong candidates, publicly known workers in the security fields and make them run (but, a figure like this one, who can clearly contribute to protocols and ecosystems with just their own means and skills, why should it take the hassle to run an election?), or we trust adpc, or we find something in the middle which I don't know what it could be.
I personally feel this is one of the situation in which a democratized vote is less positive than an intelligence dictator stepping in so to say. Optimistic challenge can make sense to exclude vendors proposed. Would it work to include new ones tho? Don't think so.
This could make a lot of sense. But the composition of this committee, while lighter in requirements compared to the above, is still subject to issue because there is the need of a certain background imho.
The above comments from Bernard illustrate some pending work that should be completed before snapshot.
This is logic but i personally disagree. I interpret the current snapshot as a sentiment check, and also a reference number that the program can obtain if X, Y, Z, K is solved. I think, to fetch good experts, knowing what the budget is is mandatory. I don't personally mind having a decision process in snapshot, that clears partially the sky for further discussion and decision process before tally.
To conclude, I totally understand why there is a lot of fuss around economics. Makes sense. But the topic requires somehow a differnt approach from the usual being very specific, and needs some steering from the usual way the DAO is used to work due to the necessity of several professional figures and vendors being integrated in the program.
This doesn't mean we have a white page on which we can write whatever, there are stuff to solve like for example a committee for deciding the receivers of the funds for audits, and a way to onboard security expert (i don't like elections on this as i explained but also i don't currently have an answer).
I'm sorry to post this right now as it'll be very late to get a Q&A on all the topics, though here is my rationale to only support a small 8-week program with 2.5m ARB or less and go over some feedback before this proposal moves to an on-chain vote. Here are my notes on why I'll support the general essence of this proposal but am looking for further discussion to get it more mature and less prone to unforeseen consequences for the whole ecosystem.
I'm sorry to post this right now as it'll be very late to get a Q&A on all the topics, though here is my rationale to only support a small 8-week program with 2.5m ARB or less and go over some feedback before this proposal moves to an on-chain vote. Here are my notes on why I'll support the general essence of this proposal but am looking for further discussion to get it more mature and less prone to unforeseen consequences for the whole ecosystem.
Furthermore, the proposed average cost of $200k for a 2-month security audit seems significantly higher than what many small projects have experienced in the past. In my personal experience contributing to projects since 2017, I have never paid more than $110k for a security audit with top-tier firms, with the usual average price among the latest invoices received being around $30 per line of Solidity code as of the end of 2023. I'd like to discuss ways to structure the program to encourage competition, maintain fair market prices for security audits, and ensure that the allocated funds are used efficiently to support a larger number of projects. It's important to note that the security firms involved will likely profit either way from this program if they do a good job at securing the first codebase audited. However, it's crucial to recognize that many audited projects have ended up as graveyards, as evidenced by the Rekt list, which highlights the varying effectiveness of audit firms.
In conclusion, while I support the general essence of this proposal and believe it could significantly enhance the security of the Arbitrum ecosystem, I believe further discussion is necessary to address the potential drawbacks and refine the proposal before moving to an on-chain vote. By addressing the concerns raised and exploring alternative approaches, we can create a more effective and efficient program that minimizes unforeseen consequences for the ecosystem as a whole. I look forward to engaging in constructive dialogue with the community to refine this proposal and ensure its success.
To be clear, I think this is a great initiative; however the execution is suboptimal. Potentially an oversight, but I don’t believe the ADPC are best suited to whitelist Security providers nor should they be handing out grants. Although it is a group of well skilled individuals, their backgrounds and skill set don’t seem suit this specific goal and a more suited member / another committee should be handling it.
If the following are done before tally, then Im happy to support:
To be clear, I think this is a great initiative; however the execution is suboptimal. Potentially an oversight, but I don’t believe the ADPC are best suited to whitelist Security providers nor should they be handing out grants. Although it is a group of well skilled individuals, their backgrounds and skill set don’t seem suit this specific goal and a more suited member / another committee should be handling it.
If the following are done before tally, then Im happy to support:
Hi all,
We've posted an update on the ADPC's mandate, progress to date, timelines, open items, and links to our public pages - feel free to have a look here.
Hi all,
We've posted an update on the ADPC's mandate, progress to date, timelines, open items, and links to our public pages - feel free to have a look here.
Re. the open item of having a committee to disburse the Subsidy Funds, as we have mentioned above, we are in favour of exploring this idea and setting up a committee if there is consensus from delegates. We'll aim to discuss this on the bi-weekly governance call tomorrow so please attend - would love to gain a variety of perspectives on this topic in addition to those voiced by @coinflip and @pedrob!
Nowhere did I state that we cannot utilise the ARDC (or want to) - as we have already queried w/the DAOAdvocate in this regard.
I am just pointing out that we cannot use the security seat of the ARDC (which would have fit within the role of an external security advisor) as OpenZeppelin has shown its interest in participating in the Security SP RFP process and this would naturally be a COI - i.e. Security Advisors advising on its own application/advising on direct competitor's applications :)
Nowhere did I state that we cannot utilise the ARDC (or want to) - as we have already queried w/the DAOAdvocate in this regard.
I am just pointing out that we cannot use the security seat of the ARDC (which would have fit within the role of an external security advisor) as OpenZeppelin has shown its interest in participating in the Security SP RFP process and this would naturally be a COI - i.e. Security Advisors advising on its own application/advising on direct competitor's applications :)
Thanks CF :handshake:
@Immutablelawyer thank you for the response but my query wasn't related to the ARDC but was related to the Foundation program and team working on a similar scope.
Has there been active work coordinating efforts?
Unfortunately, we cannot make the input collated public yet as it contains data tantamount to business secrecy from the Security SPs end. Hence, we would not like to put the members of the ADPC at risk by making public the fees that were disclosed to us in good faith so that we can create an optimal well-structured and thought out proposal (as I believe this one is).
Hey @AbdullahUmar !
Appreciate your comments ser :handshake:
Addressing your queries hereunder:
Hey @AbdullahUmar !
Appreciate your comments ser :handshake:
Addressing your queries hereunder:
The pending matters are close to being resolved (in consideration of the fact that these can be submitted on the on-chain voting stage, we thought it best to first get a sense of whether this proposal has the ancillary appetite from the DAO, and in the meantime, hash out these pending facets - naturally, at on-chain stage these will be in place - we first wanted to see whether the SF's structure, assessment etc. is to the DAO's liking hence the temperature check).
Keep in mind that the RFP to be issued is re. Security SPs, not Projects.
There are two piles of work here so to speak:
[i] Whitelisting Security SPs as per the Security Procurement Framework and the RFP to be published by (latest) beginning next week - SPs apply, ADPC vets, ADPC whitelists.
[ii] Subsidy Fund - Projects apply for subsidies, ADPC assesses in light of Means Test, ADPC issues Subsidy % amount, Project chooses SP from whitelisted SP List, APDC pays the % service subsidy.
Apprecaite your feedback ser <3
Hence, votes weren’t cast on capability, but rather on social capital/optics (this is not to say that good work hasn’t been done as I have not assessed the LTIPP’s work yet - but maybe better work could have been done should votes have been cast on capabilities? I think the answer to this is always a resounding yes whatever the endeavor).
Hi @ruslanklinkov ,
Should you have any feedback on specific points in the proposal we're all ears. We put in a lot of work to make sure that it does indeed contain transperancy requirements and targets all the specifics needed.
Hi @ruslanklinkov ,
Should you have any feedback on specific points in the proposal we're all ears. We put in a lot of work to make sure that it does indeed contain transperancy requirements and targets all the specifics needed.
We believe that a proposal aiding projects cut down on their security service cost is an important endeavor to implement - hence, we're all ears to hear your feedback even privately if needed to see how we can improve - keep in mind amendments can be made pre-on-chain vote :handshake:
I am concerned by the current trend and the perception that the Arbitrum Foundation is a pie everyone wants a slice of for an easy life. Most proposals lack transparency, requesting huge sums (yes, I find 10 million ARB excessive for these purposes), with no specifics and often just a collection of abstract ideas without practical applicability. People are only asking for funds. But instead of asking, why not start contributing?
Create a pilot project, conduct audits, show how it works. Demonstrate your success stories from past projects and please be more modest in your demands. Let's start with smaller amounts, remembering that there are people who can't afford food and water.
Hi Pedro,
Firstly, appreciate your insightful analysis as always ser!
Addressing queries hereunder:
Hi Pedro,
Firstly, appreciate your insightful analysis as always ser!
Addressing queries hereunder:
We do not have a list of 'pre-approved whitelist'. What we will have is the publication of an RFP process for security service providers to be then assessed in light of the Security Framework for Security SPs and also, the RFP itself. I reiterate, there is no pre-approved whitelist - The whitelisting process will start soon and announced publicly on the forums.
Unfortunately, we cannot make the input collated public yet as it contains data tantamount to business secrecy from the Security SPs end. Hence, we would not like to put the members of the ADPC at risk by making public the fees that were disclosed to us in good faith so that we can create an optimal well-structured and thought out proposal (as I believe this one is).
This isn't an incentive program like STIP, Backfund, LTIPP, or STIP-Bridge (just realising now that we had quite a bit). This is a subsidy fund for procurement where the ADPC serves as a facilitator (a bridge so to speak), between projects eligible for subsidies and whitelisted SPs themselves. The ADPC whitelists SPs as part of the Security Procurement Framework and the ancillary documentation (RFP & legal documentation we have drafted led predominantly by Paul Imseh). Separately the ADPC assesses applications for subsidies by Projects requesting subsidies for a service they desire from a security SP. At no point do we serve as decision-makers re. which SP a project uses - this is at the Project's discretion. To facilitate the aforementioned process, a background in procurement is vital (in this regard, members of the ADPC do have this background). In LTIPP (a comment that was voiced by many members), elections turned out to be a popularity contest and one not based on merity - by way of disclosure even I participated in the LTIPP elections, yet I am of full belief that there were better candidates than I was that unfortunately placed at the bottom of the pile. Hence, votes weren't cast on capability, but rather on social capital/optics (this is not to say that good work hasn't been done as I have not assessed the LTIPP's work yet - but maybe better work could have been done should votes have been cast on capabilities? I think the answer to this is always a resounding yes whatever the endeavor).
To sum up this point, given the low applicants we even had for the ADPC w/a Procurement Background, we sought to put this under our cap (AT NO ADDITIONAL COST FOR THE DAO) so as to ensure that it's done correctly. Should there be consensus for a committee setup, we'll naturally implement it as we are merely vessels of tokenholders' wants and needs.
Re. "Why is there a need to rush this snapshot vote before having this defined?" Bernard there refers to a separate altogether process for whitelisting SPs which has nothing to do with this proposal. This RFP will be done soon (latest, beginning next week).
Re. the Security Expert; it is not an acknowledgement of lack of security expertise (speaking for myself, I deal with Security SPs, scopes of work, reports, audit structuring etc. on a daily basis due to my firm's clientele). This was merely a comment posted by a contributor that we saw generated general consensus and also made sense and thus (as we always do) we sought to implement. Re. Additional Costs, this is yet tbd as we have interested parties willing to do it free of charge due to their non-profit nature. Re. utilising ARDC, let me remind you that OpenZeppeling is on the ARDC - and OZ will be participating in the RFP - hence this would be a conflict of interest.
Re. "I sincerely believe that it was not sufficiently discussed. I have requested information about the public notion, the biweekly reports, and the minutes of the meetings, none of which were made available to the DAO.
The only message with information about a call was in the Telegram group regarding the first call, which was announced approximately an hour before it actually took place. If I am mistaken or do not have the correct source of information, I apologize."
Firstly, the call was on the ArbitrumDAO calendar for circa 1.5/2 weeks before the call occurred. In addition, we also had another call this week to discuss which was pre-announced, also put in the calendar, yet no delegates attended aside from Krzystof from L2Beat. It is a delegate's responsibility to ensure he/she stays up to date so that the voting rationale mirrors diligent work done. In addition, the proposal has also now been up on the Forums for 20 days - 13 days more than the pre-required timeperiod by the ArbitrumDAO Constitution. We reached out to delegates to discuss, hosted calls, one-on-ones, etc. Not much more we can do - we cannot force people to participate ser :)
Also, our Notion will be made public in the coming days containing all details (was not made public previously as we were sorting out confidentiality issues).
The MS Members undertake potential legal risk for being signers. At this point in time, they merely sign ADPC-member payments yet, with the Subsidy Fund in place, we require an additional level of security to pay project subsidies. Hence, we believe that with an additional task in place, an addiitonal reimbursement is sensical and fair.
Re. "I believe it would be ideal for this entire document to be presented on the forum rather than in a separate PDF on Drive that could be modified in the future." - Not an issue to post on the Forum - when I have posted on the Forum previously, the comment was the opposite from delegates i.e. post a doc as it's difficult to read on the forum. No issue doing both :)
Re. "Regarding this, I believe it would be better for the funds paid by the DAO to be denominated in ARB" - We do not agree as Projects needing to pay service costs cannot exactly pay SPs in ARB tokens. We also need the funds in stables so that we can ensure that we cover a certain amount of service fees (which are always USD Denomianted and payable).
Appreciate your rigorous assessment @pedrob - I appreciate your diligence in providing feedback to us ser <3
To those ends, we would like to signal our support for $2.5M for a single cohort, treating this as a pilot.
Appreciate the reasoning provided! I too have voted with $2.5 million for a single cohort, i am generally in favor doing pilots at this stage rather than scaled up programs
Hi all, thank you for your engagement on this proposal and for voting in favour on Snapshot! We appreciate all the feedback we have received and are in the process of implementing it.
Addressing the first major point of feedback, we are instituting an independent committee for selection of subsidy recipients and will provide further details regarding the proposed structure of the committee soon.
Regarding the second major point of feedback, i.e., proposing to add a Security SME to the ADPC, we managed to secure a trusted third party, who we are proposing to provide its services to the ADPC including:
We have managed to secure the help of DeDaub. DeDaub is a well-known security services firm which has worked with the likes of the Ethereum Foundation, EigenLayer, Chainlink, GMX, Lido, Maple, Pendle, etc., and has completed 200+ audits for 59 clients over 14 chains.
The next step before onboarding DeDaub is to get the DAO’s confirmation via Snapshot to use part of the ADPC’s budget to pay them. Note, the ADPC already has the funds in the Multi-Sig as part of the original endowment, but since this was not explicitly approved for spending by the DAO in the original Tally vote, we are requesting approval via Snapshot to use these funds to pay DeDaub. Find details below:
We propose to pay DeDaub a total of 12k ARB for their assistance on crafting the requirements and helping whitelist the security service providers. We believe this is fair since:
As such, we believe a compensation of 12k ARB is fair for the value DeDaub will bring to the ADPC and to this process.
Moreover, we also request an additional 10k ARB to the ADPC’s budget as an operational buffer to ensure that the ADPC can operate with speed and does not need to get the DAO’s approval for any small operational matters. Of course, this will be returned to the DAO’s treasury upon the completion of the ADPC’s tenure if it has not been utilized, and will not be spent on any internal salaries.
We will put up a Snapshot to get the ball rolling on this budget approval and reduce the likelihood of any delay in meeting timelines.
Summary Ask: 22k ARB in total (12k ARB compensation for DeDaub and 10k ARB operational buffer) to use from the ADPC’s buffer in the multi-sig.
Note: To confirm, DeDaub’s participation as the Security SME will preclude them from responding to the RFP and applying to be a whitelisted security service provider.
SEED Latam voted to ABSTAIN on this proposal, since, even though we fully agree on the goal behind it - subsidizing security services could help a lot in reducing friction for onboarding new projects looking to build on arbitrum, we think there are still some points that have to be defined as mentioned by @pedrob.
The ADPC identified this as a critical requirement early on. We have been in contact with several organisations and individuals who might be able to assist. However one challenge has been identifying suitable SMEs who are not already conflicted out or who might be seen to be biased. Both of these factors knock out many candidates.
On this part tho, I think we could simply have someone who served as a member of a past Security Council cohort. Since they would already be somewhat vetted and "Arbitrum aligned".
I have voted for "1 cohort of 8 weeks, funding 2.5m".
The DAO has shown a near unanimous desire to create a framework for security service providers as indicated from the results of the proposal. As well as put their trust in the 3 committee members elected to use their expertise to find the best path forward. While I absolutely love to see the discussion and feedback, I also want to show a good-faith trust in those elected to the committee and see their idea through. For that reason, I think the 8 week trial funding is a good start for this. This should give us the opportunity to view how successful this type of process is and re-assess at a later date.
I'll add, the ADPC's willingness to take feedback into consideration is noted and part of the reason I think it's fair to move this forward with an exploratory period. This is a good indication that they are willing to take a look at how the next 8 weeks go and have an honest feedback on what can be improved.
As for general opinions, I do think @McFly brings up a good point regarding negotiating discounts. I don't even want to begin to pretend I know what going rates are, but I think it's important to remember that Arbitrum is a leader in this space and should be able to reap some of the benefits of that when it comes to bargaining power.
I will also agree with others - I'm not sure I'm for giving additional compensation to multisig signers after the fact.
Edit: My opinion is unchanged since the Snapshot vote, to save space editing this response to indicate that I will be voting "For" on Tally.
Thank you for all your engagement and feedback on this proposal! Given the complexity of the task at hand, the feedback has been extremely useful in helping us refine and improve the proposal.
This post will break down a subset of the major themes of the feedback and outline our plan for incorporating it. @Pablo will be providing responses on the following feedback themes in due course that this post will not cover:
Thank you for all your engagement and feedback on this proposal! Given the complexity of the task at hand, the feedback has been extremely useful in helping us refine and improve the proposal.
This post will break down a subset of the major themes of the feedback and outline our plan for incorporating it. @Pablo will be providing responses on the following feedback themes in due course that this post will not cover:
I. Mandate of the ADPC & Process for Whitelisting of Security Service Providers for the Provision of Subsidies II. Set-up of Independent Committee to Disburse Subsidies III. Addition of a Security Expert to the ADPC IV. Timeline and Sequence of Events V. Proposed Alternative Approaches
Feedback
There has been an ask from @coinflip and @mcfly around the input collated to define the size of the subsidy fund.
Response
To clarify, as mentioned in the proposal, we directly consulted with security service providers on their scope of services and fees:
The figure of up to $10 million worth of ARB has been determined via a benchmarking exercise conducted with various security audit service providers. This form was shared with these service providers and based on the responses of 10 service providers (including the likes of Spearbit, Halborn, Nethermind, Three Sigma, Guardian, Zellic, etc.) on their scope of services and fees associated, we have estimated that each project will require a 2-month security audit at an average cost of $200K.
As @ImmutableLawyer has mentioned above, the specific fees provided by each service provider cannot be made public due to privacy requirements and competition issues from the service providers. However, as @coinflip has suggested, we are happy to run the data points and our assumptions past members of the Foundation, who we already shared this with. To provide further clarity, the figure of $200K for a 2-month audit was based on data points / fee structures provided of:
Edit: Having spoken to the Foundation on whether they can publicly confirm the sanity check, as a rule of thumb their role is not to approve what the DAO does or provide public endorsements. As such, we will find another party to do so, most likely the security expert we are currently sourcing.
Feedback
A fund of $10 million worth of ARB is too high to begin with and a smaller pilot fund is more desirable.
Response
We are happy to institute a smaller pilot fund and already took this feedback on board in providing the different options for fund size and duration on Snapshot.
Feedback
There is no need to expand the budget to control the multi-sig to disburse the Subsidy Funds, as pointed out by @pedrob and @mcfly.
Response
As you can see in the Tally vote, the responsibilities for the Multi-Sig signers are the following:
Given that the signers will now have an additional responsibility to disburse the subsidy funds to recipients, and this is a more time-intensive task with potentially higher frequency, it may be fair to compensate them accordingly. We'd propose limiting the additional pay to 500 ARB in that case, given they already have an existing mandate. However, if there are allergic reactions to this or the MSig signers want to waive payment, we are open to any proposal.
I voted for this proposal with the 1 cohort of 8 weeks option. A subsidy fund for security services is a valuable service to provide the Arbitrum ecosystem. I'd like to see this rolled out as a pilot and then reviewed and scaled from there based on learnings from the pilot. I'm open to increasing the scope/size of the pilot if additional details are added to the proposal prior to the onchain vote.
Blockworks Research will be splitting its vote on Snapshot; 50% for do not fund and 50% for the $2.5M fund.
On a fundamental level, we like the idea behind the subsidy fund and think it’s highly beneficial to support smaller, non-established projects. While this proposal is undoubtedly extensive and showcases that a vast amount of thought has gone into different frameworks, as pointed out by other delegates, we feel that it is still somewhat rushed. Consequently, more work is required before we feel comfortable voting for this proposal onchain. In particular, we agree with points 1. and 2. made by @mcfly, and it would be great to have a further discussion around this point:
Furthermore, the proposed average cost of $200k for a 2-month security audit seems significantly higher than what many small projects have experienced in the past. In my personal experience contributing to projects since 2017, I have never paid more than $110k for a security audit with top-tier firms, with the usual average price among the latest invoices received being around $30 per line of Solidity code as of the end of 2023.
Blockworks Research will be splitting its vote on Snapshot; 50% for do not fund and 50% for the $2.5M fund.
On a fundamental level, we like the idea behind the subsidy fund and think it’s highly beneficial to support smaller, non-established projects. While this proposal is undoubtedly extensive and showcases that a vast amount of thought has gone into different frameworks, as pointed out by other delegates, we feel that it is still somewhat rushed. Consequently, more work is required before we feel comfortable voting for this proposal onchain. In particular, we agree with points 1. and 2. made by @mcfly, and it would be great to have a further discussion around this point:
Furthermore, the proposed average cost of $200k for a 2-month security audit seems significantly higher than what many small projects have experienced in the past. In my personal experience contributing to projects since 2017, I have never paid more than $110k for a security audit with top-tier firms, with the usual average price among the latest invoices received being around $30 per line of Solidity code as of the end of 2023.
In addition to the above points, we think the fund being run by the ADPC would lead to a sub-optimal operational structure. As pointed out by @coinflip, the ADPC’s original mandate was to focus on the operational side by, for example, establishing frameworks and setting up programs. By engaging in the selection and oversight process as well, effectively 1/3 of the ADPC’s current term would be diverted from the important task of creating a foundational procurement structure for the DAO. Having said that, we are conscious of the ADPC having expressed willingness to establish a separate committee for the fund, which we think would be a great addition to this proposal. This could be structured such that both security and procurement experts could be appointed, and would be another avenue through which the ADPC would standardize the procurement framework for the DAO.
I have decided to ABSTAIN from voting on the "Subsidy Fund Proposal from the Arbitrum DAO Procurement Committee" at this stage.
Rationale:
I have decided to ABSTAIN from voting on the "Subsidy Fund Proposal from the Arbitrum DAO Procurement Committee" at this stage.
Rationale:
While the proposal significantly addresses a crucial aspect of the Arbitrum ecosystem—enhancing security, which I deeply value—there are numerous legal and procedural details that I need to understand better. The complexity of the issues presented requires more thorough consideration to make a fully informed decision.
Comments:
Before moving forward with my final decision in the on-chain voting, I would love to first understand:
Cohort Program Execution: What is the expected execution of this program? For example, if the option of 1 cohort, 8 weeks, and say, 2.5M ARB is chosen, what would be expected from a program like this? How is going to run this effort, etc. I'm not seeing this detail in this proposal and as we saw on another programs there's a lot of work involved. Apart from reports, results, KPIs, etc.
Regarding the audit firms, I appreciate the diversity. And of course, I applaud Joseph and the procurement committee for pushing these efforts in the DAO which, although quite technical to implement, are very necessary for the security and long-term well-being of the ecosystem.
The following reflects the views of L2BEAT’s governance team, composed of @krst and @Sinkas, and it’s based on the combined research, fact-checking, and ideation of the two.
We’re voting in favor of the proposal and specifically to fund the SF with 2,500,000 for 1 cohort of 8 weeks to run as a pilot. The Subsidy Fund is something that we definitely want to see established as it could be extremely helpful for builders, especially of smaller, newer projects, building on Arbitrum.
The following reflects the views of L2BEAT’s governance team, composed of @krst and @Sinkas, and it’s based on the combined research, fact-checking, and ideation of the two.
We’re voting in favor of the proposal and specifically to fund the SF with 2,500,000 for 1 cohort of 8 weeks to run as a pilot. The Subsidy Fund is something that we definitely want to see established as it could be extremely helpful for builders, especially of smaller, newer projects, building on Arbitrum.
We would have supported the proposal for a larger amount and a longer duration as we believe there has been a lot of thought gone into it, but there are some concerns with the execution side of the proposal that led us to rethink our decision.
To conclude, we’re voting in favor of the proposal as a signal when it comes to its direction, but we’d like to clarify the details before the proposal goes to an on-chain vote.
Savvy DAO has voted FOR "100% for 1 cohort of 8 weeks, $2.5M fund" for the Subsidy Fund for Security Services proposal for the following compelling reasons:
Savvy DAO has voted FOR "100% for 1 cohort of 8 weeks, $2.5M fund" for the Subsidy Fund for Security Services proposal for the following compelling reasons:
See delegate thread: https://forum.arbitrum.foundation/t/non-constitutional-subsidy-fund-for-security-services/22958/38?u=savvydao
We are in favor of the proposal to establish a subsidy fund. This initiative aligns well with our vision for the DAO as a support system for developers and protocols building on the Arbitrum platform. By providing financial assistance for essential security audits, this fund would greatly benefit developers who might otherwise lack access to such critical services, thereby fostering a secure and robust development environment within the Arbitrum ecosystem. However, there are some concerns raised by other delegates about the essential groundwork that remains to be completed to ensure the effectiveness and integrity of the subsidy fund. Given these considerations, we propose to support this initiative as a pilot program initially. We suggest allocating a portion of the total fund $2.5 million for the first cohort. This approach will allow us to observe the program's implementation and effectiveness, address any unforeseen challenges, and evaluate the program's results before committing further resources.
For snapshot, voting "for" on 2 cohort of 8 weeks for 5M arb.
I partially share some concerns about the size, and dao wanting to first try with a lower amount. But, I think 2 months are just not enough. Audits can potentially be complex as a process, in 60 days we might just not encounter enough different situations to properly assess the best way to operate.
For snapshot, voting "for" on 2 cohort of 8 weeks for 5M arb.
I partially share some concerns about the size, and dao wanting to first try with a lower amount. But, I think 2 months are just not enough. Audits can potentially be complex as a process, in 60 days we might just not encounter enough different situations to properly assess the best way to operate.
On the whitelisting of operators. I agree that there can be a concern about ADPC whitelisting operators. But I also know security is hard, and there are few people who actually know security, both in holistic terms and in specific, vertical terms. I used to work in cyber threat intelligence myself before larping as a cow on the internet, and want to touch this.
Hope the ADPC takes this feedback to help refine their proposal, and to critcally evaluate what role they are intended to have during this initial 6 month mandate, is it to run procurement for the DAO or is it to recommend and hopefully implement systems for the DAO to be able to handle such activities at scale in many areas of DAO procurement.
There is a merit in what flip said. But there is also a merit in understanding that a "simple" election from the dao on people able to vet security expert is in my opinion not feasible. Either we pre fetch strong candidates, publicly known workers in the security fields and make them run (but, a figure like this one, who can clearly contribute to protocols and ecosystems with just their own means and skills, why should it take the hassle to run an election?), or we trust adpc, or we find something in the middle which I don't know what it could be.
I personally feel this is one of the situation in which a democratized vote is less positive than an intelligence dictator stepping in so to say. Optimistic challenge can make sense to exclude vendors proposed. Would it work to include new ones tho? Don't think so.
This could make a lot of sense. But the composition of this committee, while lighter in requirements compared to the above, is still subject to issue because there is the need of a certain background imho.
The above comments from Bernard illustrate some pending work that should be completed before snapshot.
This is logic but i personally disagree. I interpret the current snapshot as a sentiment check, and also a reference number that the program can obtain if X, Y, Z, K is solved. I think, to fetch good experts, knowing what the budget is is mandatory. I don't personally mind having a decision process in snapshot, that clears partially the sky for further discussion and decision process before tally.
To conclude, I totally understand why there is a lot of fuss around economics. Makes sense. But the topic requires somehow a differnt approach from the usual being very specific, and needs some steering from the usual way the DAO is used to work due to the necessity of several professional figures and vendors being integrated in the program.
This doesn't mean we have a white page on which we can write whatever, there are stuff to solve like for example a committee for deciding the receivers of the funds for audits, and a way to onboard security expert (i don't like elections on this as i explained but also i don't currently have an answer).
I'm sorry to post this right now as it'll be very late to get a Q&A on all the topics, though here is my rationale to only support a small 8-week program with 2.5m ARB or less and go over some feedback before this proposal moves to an on-chain vote. Here are my notes on why I'll support the general essence of this proposal but am looking for further discussion to get it more mature and less prone to unforeseen consequences for the whole ecosystem.
I'm sorry to post this right now as it'll be very late to get a Q&A on all the topics, though here is my rationale to only support a small 8-week program with 2.5m ARB or less and go over some feedback before this proposal moves to an on-chain vote. Here are my notes on why I'll support the general essence of this proposal but am looking for further discussion to get it more mature and less prone to unforeseen consequences for the whole ecosystem.
Furthermore, the proposed average cost of $200k for a 2-month security audit seems significantly higher than what many small projects have experienced in the past. In my personal experience contributing to projects since 2017, I have never paid more than $110k for a security audit with top-tier firms, with the usual average price among the latest invoices received being around $30 per line of Solidity code as of the end of 2023. I'd like to discuss ways to structure the program to encourage competition, maintain fair market prices for security audits, and ensure that the allocated funds are used efficiently to support a larger number of projects. It's important to note that the security firms involved will likely profit either way from this program if they do a good job at securing the first codebase audited. However, it's crucial to recognize that many audited projects have ended up as graveyards, as evidenced by the Rekt list, which highlights the varying effectiveness of audit firms.
In conclusion, while I support the general essence of this proposal and believe it could significantly enhance the security of the Arbitrum ecosystem, I believe further discussion is necessary to address the potential drawbacks and refine the proposal before moving to an on-chain vote. By addressing the concerns raised and exploring alternative approaches, we can create a more effective and efficient program that minimizes unforeseen consequences for the ecosystem as a whole. I look forward to engaging in constructive dialogue with the community to refine this proposal and ensure its success.
To be clear, I think this is a great initiative; however the execution is suboptimal. Potentially an oversight, but I don’t believe the ADPC are best suited to whitelist Security providers nor should they be handing out grants. Although it is a group of well skilled individuals, their backgrounds and skill set don’t seem suit this specific goal and a more suited member / another committee should be handling it.
If the following are done before tally, then Im happy to support:
To be clear, I think this is a great initiative; however the execution is suboptimal. Potentially an oversight, but I don’t believe the ADPC are best suited to whitelist Security providers nor should they be handing out grants. Although it is a group of well skilled individuals, their backgrounds and skill set don’t seem suit this specific goal and a more suited member / another committee should be handling it.
If the following are done before tally, then Im happy to support:
Hi all,
We've posted an update on the ADPC's mandate, progress to date, timelines, open items, and links to our public pages - feel free to have a look here.
Hi all,
We've posted an update on the ADPC's mandate, progress to date, timelines, open items, and links to our public pages - feel free to have a look here.
Re. the open item of having a committee to disburse the Subsidy Funds, as we have mentioned above, we are in favour of exploring this idea and setting up a committee if there is consensus from delegates. We'll aim to discuss this on the bi-weekly governance call tomorrow so please attend - would love to gain a variety of perspectives on this topic in addition to those voiced by @coinflip and @pedrob!
Nowhere did I state that we cannot utilise the ARDC (or want to) - as we have already queried w/the DAOAdvocate in this regard.
I am just pointing out that we cannot use the security seat of the ARDC (which would have fit within the role of an external security advisor) as OpenZeppelin has shown its interest in participating in the Security SP RFP process and this would naturally be a COI - i.e. Security Advisors advising on its own application/advising on direct competitor's applications :)
Nowhere did I state that we cannot utilise the ARDC (or want to) - as we have already queried w/the DAOAdvocate in this regard.
I am just pointing out that we cannot use the security seat of the ARDC (which would have fit within the role of an external security advisor) as OpenZeppelin has shown its interest in participating in the Security SP RFP process and this would naturally be a COI - i.e. Security Advisors advising on its own application/advising on direct competitor's applications :)
Thanks CF :handshake:
@Immutablelawyer thank you for the response but my query wasn't related to the ARDC but was related to the Foundation program and team working on a similar scope.
Has there been active work coordinating efforts?
Unfortunately, we cannot make the input collated public yet as it contains data tantamount to business secrecy from the Security SPs end. Hence, we would not like to put the members of the ADPC at risk by making public the fees that were disclosed to us in good faith so that we can create an optimal well-structured and thought out proposal (as I believe this one is).
Hey @AbdullahUmar !
Appreciate your comments ser :handshake:
Addressing your queries hereunder:
Hey @AbdullahUmar !
Appreciate your comments ser :handshake:
Addressing your queries hereunder:
The pending matters are close to being resolved (in consideration of the fact that these can be submitted on the on-chain voting stage, we thought it best to first get a sense of whether this proposal has the ancillary appetite from the DAO, and in the meantime, hash out these pending facets - naturally, at on-chain stage these will be in place - we first wanted to see whether the SF's structure, assessment etc. is to the DAO's liking hence the temperature check).
Keep in mind that the RFP to be issued is re. Security SPs, not Projects.
There are two piles of work here so to speak:
[i] Whitelisting Security SPs as per the Security Procurement Framework and the RFP to be published by (latest) beginning next week - SPs apply, ADPC vets, ADPC whitelists.
[ii] Subsidy Fund - Projects apply for subsidies, ADPC assesses in light of Means Test, ADPC issues Subsidy % amount, Project chooses SP from whitelisted SP List, APDC pays the % service subsidy.
Apprecaite your feedback ser <3
Hence, votes weren’t cast on capability, but rather on social capital/optics (this is not to say that good work hasn’t been done as I have not assessed the LTIPP’s work yet - but maybe better work could have been done should votes have been cast on capabilities? I think the answer to this is always a resounding yes whatever the endeavor).
Hi @ruslanklinkov ,
Should you have any feedback on specific points in the proposal we're all ears. We put in a lot of work to make sure that it does indeed contain transperancy requirements and targets all the specifics needed.
Hi @ruslanklinkov ,
Should you have any feedback on specific points in the proposal we're all ears. We put in a lot of work to make sure that it does indeed contain transperancy requirements and targets all the specifics needed.
We believe that a proposal aiding projects cut down on their security service cost is an important endeavor to implement - hence, we're all ears to hear your feedback even privately if needed to see how we can improve - keep in mind amendments can be made pre-on-chain vote :handshake:
I am concerned by the current trend and the perception that the Arbitrum Foundation is a pie everyone wants a slice of for an easy life. Most proposals lack transparency, requesting huge sums (yes, I find 10 million ARB excessive for these purposes), with no specifics and often just a collection of abstract ideas without practical applicability. People are only asking for funds. But instead of asking, why not start contributing?
Create a pilot project, conduct audits, show how it works. Demonstrate your success stories from past projects and please be more modest in your demands. Let's start with smaller amounts, remembering that there are people who can't afford food and water.
Hi Pedro,
Firstly, appreciate your insightful analysis as always ser!
Addressing queries hereunder:
Hi Pedro,
Firstly, appreciate your insightful analysis as always ser!
Addressing queries hereunder:
We do not have a list of 'pre-approved whitelist'. What we will have is the publication of an RFP process for security service providers to be then assessed in light of the Security Framework for Security SPs and also, the RFP itself. I reiterate, there is no pre-approved whitelist - The whitelisting process will start soon and announced publicly on the forums.
Unfortunately, we cannot make the input collated public yet as it contains data tantamount to business secrecy from the Security SPs end. Hence, we would not like to put the members of the ADPC at risk by making public the fees that were disclosed to us in good faith so that we can create an optimal well-structured and thought out proposal (as I believe this one is).
This isn't an incentive program like STIP, Backfund, LTIPP, or STIP-Bridge (just realising now that we had quite a bit). This is a subsidy fund for procurement where the ADPC serves as a facilitator (a bridge so to speak), between projects eligible for subsidies and whitelisted SPs themselves. The ADPC whitelists SPs as part of the Security Procurement Framework and the ancillary documentation (RFP & legal documentation we have drafted led predominantly by Paul Imseh). Separately the ADPC assesses applications for subsidies by Projects requesting subsidies for a service they desire from a security SP. At no point do we serve as decision-makers re. which SP a project uses - this is at the Project's discretion. To facilitate the aforementioned process, a background in procurement is vital (in this regard, members of the ADPC do have this background). In LTIPP (a comment that was voiced by many members), elections turned out to be a popularity contest and one not based on merity - by way of disclosure even I participated in the LTIPP elections, yet I am of full belief that there were better candidates than I was that unfortunately placed at the bottom of the pile. Hence, votes weren't cast on capability, but rather on social capital/optics (this is not to say that good work hasn't been done as I have not assessed the LTIPP's work yet - but maybe better work could have been done should votes have been cast on capabilities? I think the answer to this is always a resounding yes whatever the endeavor).
To sum up this point, given the low applicants we even had for the ADPC w/a Procurement Background, we sought to put this under our cap (AT NO ADDITIONAL COST FOR THE DAO) so as to ensure that it's done correctly. Should there be consensus for a committee setup, we'll naturally implement it as we are merely vessels of tokenholders' wants and needs.
Re. "Why is there a need to rush this snapshot vote before having this defined?" Bernard there refers to a separate altogether process for whitelisting SPs which has nothing to do with this proposal. This RFP will be done soon (latest, beginning next week).
Re. the Security Expert; it is not an acknowledgement of lack of security expertise (speaking for myself, I deal with Security SPs, scopes of work, reports, audit structuring etc. on a daily basis due to my firm's clientele). This was merely a comment posted by a contributor that we saw generated general consensus and also made sense and thus (as we always do) we sought to implement. Re. Additional Costs, this is yet tbd as we have interested parties willing to do it free of charge due to their non-profit nature. Re. utilising ARDC, let me remind you that OpenZeppeling is on the ARDC - and OZ will be participating in the RFP - hence this would be a conflict of interest.
Re. "I sincerely believe that it was not sufficiently discussed. I have requested information about the public notion, the biweekly reports, and the minutes of the meetings, none of which were made available to the DAO.
The only message with information about a call was in the Telegram group regarding the first call, which was announced approximately an hour before it actually took place. If I am mistaken or do not have the correct source of information, I apologize."
Firstly, the call was on the ArbitrumDAO calendar for circa 1.5/2 weeks before the call occurred. In addition, we also had another call this week to discuss which was pre-announced, also put in the calendar, yet no delegates attended aside from Krzystof from L2Beat. It is a delegate's responsibility to ensure he/she stays up to date so that the voting rationale mirrors diligent work done. In addition, the proposal has also now been up on the Forums for 20 days - 13 days more than the pre-required timeperiod by the ArbitrumDAO Constitution. We reached out to delegates to discuss, hosted calls, one-on-ones, etc. Not much more we can do - we cannot force people to participate ser :)
Also, our Notion will be made public in the coming days containing all details (was not made public previously as we were sorting out confidentiality issues).
The MS Members undertake potential legal risk for being signers. At this point in time, they merely sign ADPC-member payments yet, with the Subsidy Fund in place, we require an additional level of security to pay project subsidies. Hence, we believe that with an additional task in place, an addiitonal reimbursement is sensical and fair.
Re. "I believe it would be ideal for this entire document to be presented on the forum rather than in a separate PDF on Drive that could be modified in the future." - Not an issue to post on the Forum - when I have posted on the Forum previously, the comment was the opposite from delegates i.e. post a doc as it's difficult to read on the forum. No issue doing both :)
Re. "Regarding this, I believe it would be better for the funds paid by the DAO to be denominated in ARB" - We do not agree as Projects needing to pay service costs cannot exactly pay SPs in ARB tokens. We also need the funds in stables so that we can ensure that we cover a certain amount of service fees (which are always USD Denomianted and payable).
Appreciate your rigorous assessment @pedrob - I appreciate your diligence in providing feedback to us ser <3
To those ends, we would like to signal our support for $2.5M for a single cohort, treating this as a pilot.
Appreciate the reasoning provided! I too have voted with $2.5 million for a single cohort, i am generally in favor doing pilots at this stage rather than scaled up programs
Unfortunately, we cannot make the input collated public yet as it contains data tantamount to business secrecy from the Security SPs end. Hence, we would not like to put the members of the ADPC at risk by making public the fees that were disclosed to us in good faith so that we can create an optimal well-structured and thought out proposal (as I believe this one is).
Fully respect the need for confidentiality but at the same time it would be great to get some seperate validation given that currently the proposal places immense power and less checks on the ADPC.
For example have you discussed with the two members of the Foundation (one who oversaw and created and another now running it) about their Audit support program to validate numbers and input provided to you by SPs, and to understand what negotiation and terms the Foundation secured for their program from similar SPs.
Not sure if there is any other source we can propose to validate this
Hence, votes weren’t cast on capability, but rather on social capital/optics (this is not to say that good work hasn’t been done as I have not assessed the LTIPP’s work yet - but maybe better work could have been done should votes have been cast on capabilities? I think the answer to this is always a resounding yes whatever the endeavor).
Saying we should hire based on capabilities is an obvious yes but your logic for arriving at the ARDC self deciding to step into this role are somewhat flawed.
Given the ADPC was also elected the point seems mute since it could have been just as much a social or popularity contest instead of capability. This is not to say that good work hasn’t been done as the DAO has not assessed the ADPC work yet.
Hope my questions are taken in the spirit of improving the proposal, because it would be disappointing if the audit support program which could be a key unlock to our tools available to new builders gets sidetracked by an potential perceived overreach on the part of ADPC, because I see these as two seperate topics.
I am concerned by the current trend and the perception that the Arbitrum Foundation is a pie everyone wants a slice of for an easy life. Most proposals lack transparency, requesting huge sums (yes, I find 10 million ARB excessive for these purposes), with no specifics and often just a collection of abstract ideas without practical applicability. People are only asking for funds. But instead of asking, why not start contributing?
Create a pilot project, conduct audits, show how it works. Demonstrate your success stories from past projects and please be more modest in your demands. Let's start with smaller amounts, remembering that there are people who can't afford food and water.
My message might be a bit emotional, I don't intend to offend or devalue anyone's work. I like this proposal, it's important and needed, but let's approach targeted funding more responsibly.
Here are some comments from the UADP:
Directionally, we are in favor of this proposal. There is clearly a need to help front some of the costs associated with audits. However, the proposal does seem a bit rushed. There are a couple of aspects that could have been addressed prior to taking this proposal to snapshot, which would’ve assured a higher success rate as opposed to the current divisiveness we’re seeing in the polls.
Here are some comments from the UADP:
Directionally, we are in favor of this proposal. There is clearly a need to help front some of the costs associated with audits. However, the proposal does seem a bit rushed. There are a couple of aspects that could have been addressed prior to taking this proposal to snapshot, which would’ve assured a higher success rate as opposed to the current divisiveness we’re seeing in the polls.
“we are in the process of sourcing a neutral security expert as an advisor to aid us in judging both, applications from service providers during the RFP process and applications from projects looking to receive subsidies from the Subsidy Fund”
“the ADPC is currently in the process of setting up the procurement framework to whitelist security service providers for the DAO. Given the large amount of legal work required to structure an RFP, it is still in the drafting phase and has not yet been published to procure any security service providers.”
The above comments from Bernard illustrate some pending work that should be completed before snapshot.
Perhaps a better order of operations is to attain a soft commitment from the DAO regarding how much an initial pilot cohort will require. Say, the snapshot vote leads to the $2.5M fund being selected. Then, the ADPC can run an RFP process, collect the projects that require subsidy, present the findings to the DAO, then follow up with an onchain vote finalizing the payment transfer from the DAO to the ADPC for distribution. This way, there’s a soft commitment present from the DAO, and the contingency at hand is that the initiative attains the earmarked funds only if it’s run in a reasonable manner. What if the DAO disapproves the onchain vote? I doubt that this will happen as long as the ADPC delivers on its promises properly. To those ends, we would like to signal our support for $2.5M for a single cohort, treating this as a pilot. If this proposal fails the snapshot, the ADPC should return to the DAO with a more comprehensive proposal once the aspects from the above quotes have been addressed.
Also, regarding the stated areas of interest–RWA, gaming, and collab tech are noted as the main sectors for audits since there are many developments occurring here. I may be wrong in my assumption, but isn’t the best use of audits for protocols that perhaps have the most value at risk? This would largely include DeFi protocols, especially high TVL ones like money markets. RWA seems like another sector that falls under this umbrella. I’d assume the cost for audits regarding tooling/collab tech and even gaming is properly lower. All this to say I’d think critically about what teams really need an audit to begin/sustain operations–versus those who can delay a full-fledged audit until they either raise more or earn more revenue.
It was actually hence why I addressed it "your logic for arriving at the ARDC self deciding to step into this role are somewhat flawed" - the logic was explained i.e. why it isn't actually flawed :)
Re. Foundation and audit support - we went directly to the source i.e. Security Service Providers themselves and solicited consultations from 10+ security SPs to establish the quantiative metrics needed. However, we'll have additional discussions w/Foundation as well - no harm in getting further data :handshake:
@Bernard @Immutablelawyer thank you for the work on getting this proposal up for evaluation and taking feedback from the DAO, its good to see ADPC progressing on putting up a framework for the Audit subsidy support program.
I am supportive that we need a framework and program to support development of our ecosystem to have access to the best audit and security partners, including hopefully in later rounds a wider selection of safety and security tools and inputs (threat detection, economic security, formal verification (especially for Stylus protocols) etc...).
@Bernard @Immutablelawyer thank you for the work on getting this proposal up for evaluation and taking feedback from the DAO, its good to see ADPC progressing on putting up a framework for the Audit subsidy support program.
I am supportive that we need a framework and program to support development of our ecosystem to have access to the best audit and security partners, including hopefully in later rounds a wider selection of safety and security tools and inputs (threat detection, economic security, formal verification (especially for Stylus protocols) etc...).
Having said all that I have some concerns with the framework that is put up because it feels like it has veered somewhat from the original mandate which was to propose and assist the DAO in handling procurement operations, establishing frameworks and setup procurement programs with the Subsidy Fund being named as one of the first initiatives.
While I appreciate the urgent need for these programs, intentionally or unintentionally you have proposed a system where the ADPC is seeking to deploy up to $10m under the following process:
To be clear do not take my comments as a total rebuke there is much to like in this proposal including in the sections for Application Process an Selection Process & Reporting which show great thought. Still we we might be better served by the ADPC not trying to take on all roles in this process.
A good procurement process even if not whole transparent should be auditable and have good checks and balances, the current process simply lacks any material checks and balances. Which isn't a good precedent for the ADPC to set out the gate for establishing such frameworks.
For reference looking at other grant programs that are $1m or more to date in the DAO to see their process and how there is some clear aspect of checks and balances.
Hope the ADPC takes this feedback to help refine their proposal, and to critcally evaluate what role they are intended to have during this initial 6 month mandate, is it to run procurement for the DAO or is it to recommend and hopefully implement systems for the DAO to be able to handle such activities at scale in many areas of DAO procurement.
ps. if you feel the proposal should go to the DAO as is please do consider providing delegates multiple voting options on significantly smaller program size, because it's possible that there is interest in funding a quick and dirty pilot program while a full program is formally put in place.
ADPC Recording for call 18/04/2024:
https://drive.google.com/file/d/14ANJPriFf2lYbMLHpvtZ0rno7MX43XNg/view
Hello! Thank you very much for developing this proposal and process. With @SEEDGov we've been involved as an Advisor in the LTIPP and I think this process has a very interesting and well-thought-out design. So, congratulations and thank you.
That said, I have some questions and concerns very similar to those expressed by @coinflip, which I support and believe need further discussion.
Hello! Thank you very much for developing this proposal and process. With @SEEDGov we've been involved as an Advisor in the LTIPP and I think this process has a very interesting and well-thought-out design. So, congratulations and thank you.
That said, I have some questions and concerns very similar to those expressed by @coinflip, which I support and believe need further discussion.
According to the proposal approved in Tally “The mandate of the ADPC aims to create an optimal organizational framework for service procurement while also creating a marketplace for service providers that would have gone through preemptive quality assurance.”
These subsidies will be exclusive to a pre-approved whitelisted set of security audit service providers, selected by the ADPC, who will publicly display their fees.
It is my understanding that mandate 1/5 was to develop the RFP for the selection of these service providers. How is it that now it depends on a pre-approved white list? Am I wrong?
Also, when listing your mandates, you mention that:
Steps [2], [3] & [4] of the mandate will necessarily have to be coupled with a 14-day consultation period pre-structuring so that input is solicit from the ArbitrumDAO and other relevant third-parties. The input collated during the public consultation period will necessarily need to be made public.
Where can I find the “input collated” for the evaluation criteria (mandate 2) of small projects that will receive the subsidies? Have you discussed the rubric with the LTIPP Council? There have been very useful learnings from their scoring experience that I think can be helpful.
The administration and selection process of these subsidies will be managed by the ADPC. Even though the ultimate decision will lie with the judgment of the ADPC, their assessment will be strongly guided by a means test that evaluates key metrics to determine deserving projects.
As Conflip mentions, and with whom I agree regarding the question of involving ADPC in the process as program manager, committee, and decision maker, I believe it is better to limit your participation to a sort of program management role (similar to StableLab in the LTIPP where the other decisions are made by Advisors and Council).
Furthermore, the ADPC’s mandate was always to act as the screening committee to decide the vendors to whitelist for the program. As you can see in the Tally vote which established the ADPC, ‘the ADPC bears the responsibility of diligently executing the steps essential to implement the aforementioned procurement framework’.
I don't believe this response satisfactorily addresses his question. 'Diligently executing the steps' means managing or advancing a process, not positioning oneself as the decision maker for everything related to it.
Exactly right, the ADPC is currently in the process of setting up the procurement framework to whitelist security service providers for the DAO. Given the large amount of legal work required to structure an RFP, it is still in the drafting phase and has not yet been published to procure any security service providers.
Why is there a need to rush this snapshot vote before having this defined?
Fully agree here on gap in security experience - as mentioned above, we are in the process of sourcing a neutral security expert as an advisor to aid us in judging both, applications from service providers during the RFP process and applications from projects looking to receive subsidies from the Subsidy Fund.
Assuming it is approved, wouldn't this incur additional costs? Given that you acknowledge a lack of security experience, the role of the 'security expert' would be crucial in assessing the applicants. Why not directly appoint a manager or a committee of security experts and provide them with compensation to carry out the task?
It might be interesting to involve the ARDC in this process, as it includes a DAO advocate, a member qualified for Risk Assessment, and a member qualified for Security Assessment.
and we have received no other indication from the rest of the community that another committee is required to handle fund disbursement.
I sincerely believe that it was not sufficiently discussed. I have requested information about the public notion, the biweekly reports, and the minutes of the meetings, none of which were made available to the DAO.
The only message with information about a call was in the Telegram group regarding the first call, which was announced approximately an hour before it actually took place. If I am mistaken or do not have the correct source of information, I apologize.
In recognition of the additional responsibilities undertaken, each of the five multi-sig wallets is proposed to receive a supplementary compensation ranging from 500 ARB - 1,000 ARB monthly.
What is the need to expand the budget that has already been approved for controlling one (or the same) multisig?
I believe it would be ideal for this entire document to be presented on the forum rather than in a separate PDF on Drive that could be modified in the future.
1 cohort of 8 weeks (2 months) for a total fund size of $2.5 million.
2 cohorts of 8 weeks each (4 months) for a total fund size of $5 million.
4 cohorts of 8 weeks each (8 months) for a total fund size of $10 million.
Regarding this, I believe it would be better for the funds paid by the DAO to be denominated in ARB
Thanks again, I think overall the proposal is good and well thought out.
Thank you all for the feedback! The proposal will incorporate the following amendments and subsequently be posted on Snapshot:
Amendments
Thank you all for the feedback! The proposal will incorporate the following amendments and subsequently be posted on Snapshot:
Amendments
We also discussed forming an entirely additional committee to disburse the Subsidy Fund and collectively landed on that for this initial iteration, it may make more sense to operate in the "committee-light" way, i.e., ADPC + security expert given:
Lastly, we are currently in discussion with the Foundation’s legal counsel regarding the addition of an exclusivity clause for projects receiving subsidies, namely around the provision being added to the Grant Agreement and the practicality of enforcing oversight post-disbursement.
@coinflip, thanks for the feedback! Appreciate the time you took going through, and happy to clarify a few aspects about the ADPC’s mandate and process - some of them might directly resolve a few of your remarks:
(1) On your comment ‘ADPC has not made public (or not linked here) which vendors qualified or didn’t qualify and why’:
@coinflip, thanks for the feedback! Appreciate the time you took going through, and happy to clarify a few aspects about the ADPC’s mandate and process - some of them might directly resolve a few of your remarks:
(1) On your comment ‘ADPC has not made public (or not linked here) which vendors qualified or didn’t qualify and why’:
(2) On your remarks ‘ADPC will directly administer and decide on which protocols are recipients of this $10m’ and ‘no oversight board or technical board with specific expertise in the area of these grants’:
(3) On your question ‘no DAO voting either directly or via an Optimistic process with challenge’:
(4) On your comment ‘if you feel the proposal should go to the DAO as is please do consider providing delegates multiple voting options on significantly smaller program size’:
Just to recap, if there is consensus from delegates on the below, we are happy to:
If you have time to respond, obviously much appreciated and thanks again for the helpful guidance
These comments and thoughts reflect my personal opinions on this proposal. Whilst I am a member of the Arbitrum Representative Council (ARC), they do not necessarily represent the overall views of the council or provide an indication of final voting decision
I'm directionally in favour of this proposal as it aligns well with my vision for the DAO as a support service for protocols building on Arbitrum. This would be a competitive advantage which would draw builders to Arbitrum by offering them a range of free/discounted support services they could not access elsewhere.
These comments and thoughts reflect my personal opinions on this proposal. Whilst I am a member of the Arbitrum Representative Council (ARC), they do not necessarily represent the overall views of the council or provide an indication of final voting decision
I'm directionally in favour of this proposal as it aligns well with my vision for the DAO as a support service for protocols building on Arbitrum. This would be a competitive advantage which would draw builders to Arbitrum by offering them a range of free/discounted support services they could not access elsewhere.
I'm also in favour of this change for the reasons pointed out by @dk3 and @JoJo. Thanks for being flexible.
Re. the %-based approach, following your comments and internal discussions w/ fellow ADPC Members, we have decided to amend the proposal to reflect a %-based approach to subsidies which will entail the ADPC covering up to 70% (maximum threshold) of the corresponding service solicited by the project.
@coinflip makes an interesting point RE check and balances. I lean towards greater empowerment of the groups like the ADPC to make decision on behalf of the DAO. However, adding in greater transparency (i.e. details on vendors qualifying / didn't qualify) and/or an optimistic process with challenge on decisions may be beneficial.
Appreciate the comment @PennBlockchain !
Answering your query below:
Appreciate the comment @PennBlockchain !
Answering your query below:
The need for the ADPC initially came about when several projects were requesting subsidies from the DAO in relation to [primarily] security services so as to get their project up and running. Hence, this was where the initial concern (and subsequent need of the ADPC) materialised. In addition, we've already gotten some projects (mainly non-VC funded ones), that have shown their interest in the Subsidy program.
This was further substantiated following our public consultation with security service providers wherein we solicited their input in relation to the average/median security-service fees applicable to certain service-classes.
As a final point the intention is not to fully allocate the 10Million budget. The threshold per-cohort (as delineated above), is a maximum threshold that cannot be exceeded and not a sum that is to be fully disbersed. Naturally, unutilised funds would be sent to the ArbitrumDAO Treasury or, if the ADPC's mandate is extended, transitioned over to the next iteration of the ADPC.
Should you have any further questions or queries, we remain at your disposal!
The SF is expected to attract a large number of projects as we have already gotten numerous inquiries pre-launch.
Hence, we needed to impose a maximum cap.
Yes, thanks for the clarification. But there is still one question remaining regarding the number of projects Why exactly so many projects?
Appreciate the comment @cp0x !
The amount requested was based on the data emanating from a public consultation carried out by the Procurement Committee w/the participation from security service providers.
Appreciate the comment @cp0x !
The amount requested was based on the data emanating from a public consultation carried out by the Procurement Committee w/the participation from security service providers.
It is based on an average maximum amount needed to cover enough funding for X Project per/Cohort. Hence, having funding options in place would eliminate the data-driven approach that we utilised in structuring the internal mechanics and funding allocation applicable to project subsidies.
I agree that since we have a commission, it needs funds to carry out its functions. The proposal itself is good and I support it. But to begin with, I would suggest a more modest amount for this. I suggest making options for funding amounts during a temperature check
@dk3 @JoJo
Sharing replies to feedback hereunder:
Thanks for the constructive feedback lads!
Re. the co-insurance method:
This method/mode of administration was discussed internally when structuring the operational and administrational parameters that would underpin fund disbersement. In this regard, we opted for a service-by-service approach due to the following reasons:
Thank you for the comments everyone! We're drafting our responses and will share them soon.
@CU-ManicUnicorn, @dk3, apologies - the Google Docs for the Grant Application Terms and Conditions is now viewable.
In life, markets and magic the gathering, anything that costs 0 would be eventually exploited by external forces. A partial payment would be in my opinion quite good:
Is the idea to pay for the audit in full? I know a previous discussion was to do something like:
We appreciate the ADPC for this clear proposal that outlines the goals, purpose, and evaluation criteria for projects that might receive the security audit subsidy. We believe this proposal could be quite beneficial to onboarding new applications. A few questions came to mind:
Unfortunately, we cannot make the input collated public yet as it contains data tantamount to business secrecy from the Security SPs end. Hence, we would not like to put the members of the ADPC at risk by making public the fees that were disclosed to us in good faith so that we can create an optimal well-structured and thought out proposal (as I believe this one is).
Fully respect the need for confidentiality but at the same time it would be great to get some seperate validation given that currently the proposal places immense power and less checks on the ADPC.
For example have you discussed with the two members of the Foundation (one who oversaw and created and another now running it) about their Audit support program to validate numbers and input provided to you by SPs, and to understand what negotiation and terms the Foundation secured for their program from similar SPs.
Not sure if there is any other source we can propose to validate this
Hence, votes weren’t cast on capability, but rather on social capital/optics (this is not to say that good work hasn’t been done as I have not assessed the LTIPP’s work yet - but maybe better work could have been done should votes have been cast on capabilities? I think the answer to this is always a resounding yes whatever the endeavor).
Saying we should hire based on capabilities is an obvious yes but your logic for arriving at the ARDC self deciding to step into this role are somewhat flawed.
Given the ADPC was also elected the point seems mute since it could have been just as much a social or popularity contest instead of capability. This is not to say that good work hasn’t been done as the DAO has not assessed the ADPC work yet.
Hope my questions are taken in the spirit of improving the proposal, because it would be disappointing if the audit support program which could be a key unlock to our tools available to new builders gets sidetracked by an potential perceived overreach on the part of ADPC, because I see these as two seperate topics.
I am concerned by the current trend and the perception that the Arbitrum Foundation is a pie everyone wants a slice of for an easy life. Most proposals lack transparency, requesting huge sums (yes, I find 10 million ARB excessive for these purposes), with no specifics and often just a collection of abstract ideas without practical applicability. People are only asking for funds. But instead of asking, why not start contributing?
Create a pilot project, conduct audits, show how it works. Demonstrate your success stories from past projects and please be more modest in your demands. Let's start with smaller amounts, remembering that there are people who can't afford food and water.
My message might be a bit emotional, I don't intend to offend or devalue anyone's work. I like this proposal, it's important and needed, but let's approach targeted funding more responsibly.
Here are some comments from the UADP:
Directionally, we are in favor of this proposal. There is clearly a need to help front some of the costs associated with audits. However, the proposal does seem a bit rushed. There are a couple of aspects that could have been addressed prior to taking this proposal to snapshot, which would’ve assured a higher success rate as opposed to the current divisiveness we’re seeing in the polls.
Here are some comments from the UADP:
Directionally, we are in favor of this proposal. There is clearly a need to help front some of the costs associated with audits. However, the proposal does seem a bit rushed. There are a couple of aspects that could have been addressed prior to taking this proposal to snapshot, which would’ve assured a higher success rate as opposed to the current divisiveness we’re seeing in the polls.
“we are in the process of sourcing a neutral security expert as an advisor to aid us in judging both, applications from service providers during the RFP process and applications from projects looking to receive subsidies from the Subsidy Fund”
“the ADPC is currently in the process of setting up the procurement framework to whitelist security service providers for the DAO. Given the large amount of legal work required to structure an RFP, it is still in the drafting phase and has not yet been published to procure any security service providers.”
The above comments from Bernard illustrate some pending work that should be completed before snapshot.
Perhaps a better order of operations is to attain a soft commitment from the DAO regarding how much an initial pilot cohort will require. Say, the snapshot vote leads to the $2.5M fund being selected. Then, the ADPC can run an RFP process, collect the projects that require subsidy, present the findings to the DAO, then follow up with an onchain vote finalizing the payment transfer from the DAO to the ADPC for distribution. This way, there’s a soft commitment present from the DAO, and the contingency at hand is that the initiative attains the earmarked funds only if it’s run in a reasonable manner. What if the DAO disapproves the onchain vote? I doubt that this will happen as long as the ADPC delivers on its promises properly. To those ends, we would like to signal our support for $2.5M for a single cohort, treating this as a pilot. If this proposal fails the snapshot, the ADPC should return to the DAO with a more comprehensive proposal once the aspects from the above quotes have been addressed.
Also, regarding the stated areas of interest–RWA, gaming, and collab tech are noted as the main sectors for audits since there are many developments occurring here. I may be wrong in my assumption, but isn’t the best use of audits for protocols that perhaps have the most value at risk? This would largely include DeFi protocols, especially high TVL ones like money markets. RWA seems like another sector that falls under this umbrella. I’d assume the cost for audits regarding tooling/collab tech and even gaming is properly lower. All this to say I’d think critically about what teams really need an audit to begin/sustain operations–versus those who can delay a full-fledged audit until they either raise more or earn more revenue.
It was actually hence why I addressed it "your logic for arriving at the ARDC self deciding to step into this role are somewhat flawed" - the logic was explained i.e. why it isn't actually flawed :)
Re. Foundation and audit support - we went directly to the source i.e. Security Service Providers themselves and solicited consultations from 10+ security SPs to establish the quantiative metrics needed. However, we'll have additional discussions w/Foundation as well - no harm in getting further data :handshake:
@Bernard @Immutablelawyer thank you for the work on getting this proposal up for evaluation and taking feedback from the DAO, its good to see ADPC progressing on putting up a framework for the Audit subsidy support program.
I am supportive that we need a framework and program to support development of our ecosystem to have access to the best audit and security partners, including hopefully in later rounds a wider selection of safety and security tools and inputs (threat detection, economic security, formal verification (especially for Stylus protocols) etc...).
@Bernard @Immutablelawyer thank you for the work on getting this proposal up for evaluation and taking feedback from the DAO, its good to see ADPC progressing on putting up a framework for the Audit subsidy support program.
I am supportive that we need a framework and program to support development of our ecosystem to have access to the best audit and security partners, including hopefully in later rounds a wider selection of safety and security tools and inputs (threat detection, economic security, formal verification (especially for Stylus protocols) etc...).
Having said all that I have some concerns with the framework that is put up because it feels like it has veered somewhat from the original mandate which was to propose and assist the DAO in handling procurement operations, establishing frameworks and setup procurement programs with the Subsidy Fund being named as one of the first initiatives.
While I appreciate the urgent need for these programs, intentionally or unintentionally you have proposed a system where the ADPC is seeking to deploy up to $10m under the following process:
To be clear do not take my comments as a total rebuke there is much to like in this proposal including in the sections for Application Process an Selection Process & Reporting which show great thought. Still we we might be better served by the ADPC not trying to take on all roles in this process.
A good procurement process even if not whole transparent should be auditable and have good checks and balances, the current process simply lacks any material checks and balances. Which isn't a good precedent for the ADPC to set out the gate for establishing such frameworks.
For reference looking at other grant programs that are $1m or more to date in the DAO to see their process and how there is some clear aspect of checks and balances.
Hope the ADPC takes this feedback to help refine their proposal, and to critcally evaluate what role they are intended to have during this initial 6 month mandate, is it to run procurement for the DAO or is it to recommend and hopefully implement systems for the DAO to be able to handle such activities at scale in many areas of DAO procurement.
ps. if you feel the proposal should go to the DAO as is please do consider providing delegates multiple voting options on significantly smaller program size, because it's possible that there is interest in funding a quick and dirty pilot program while a full program is formally put in place.
ADPC Recording for call 18/04/2024:
https://drive.google.com/file/d/14ANJPriFf2lYbMLHpvtZ0rno7MX43XNg/view
Hello! Thank you very much for developing this proposal and process. With @SEEDGov we've been involved as an Advisor in the LTIPP and I think this process has a very interesting and well-thought-out design. So, congratulations and thank you.
That said, I have some questions and concerns very similar to those expressed by @coinflip, which I support and believe need further discussion.
Hello! Thank you very much for developing this proposal and process. With @SEEDGov we've been involved as an Advisor in the LTIPP and I think this process has a very interesting and well-thought-out design. So, congratulations and thank you.
That said, I have some questions and concerns very similar to those expressed by @coinflip, which I support and believe need further discussion.
According to the proposal approved in Tally “The mandate of the ADPC aims to create an optimal organizational framework for service procurement while also creating a marketplace for service providers that would have gone through preemptive quality assurance.”
These subsidies will be exclusive to a pre-approved whitelisted set of security audit service providers, selected by the ADPC, who will publicly display their fees.
It is my understanding that mandate 1/5 was to develop the RFP for the selection of these service providers. How is it that now it depends on a pre-approved white list? Am I wrong?
Also, when listing your mandates, you mention that:
Steps [2], [3] & [4] of the mandate will necessarily have to be coupled with a 14-day consultation period pre-structuring so that input is solicit from the ArbitrumDAO and other relevant third-parties. The input collated during the public consultation period will necessarily need to be made public.
Where can I find the “input collated” for the evaluation criteria (mandate 2) of small projects that will receive the subsidies? Have you discussed the rubric with the LTIPP Council? There have been very useful learnings from their scoring experience that I think can be helpful.
The administration and selection process of these subsidies will be managed by the ADPC. Even though the ultimate decision will lie with the judgment of the ADPC, their assessment will be strongly guided by a means test that evaluates key metrics to determine deserving projects.
As Conflip mentions, and with whom I agree regarding the question of involving ADPC in the process as program manager, committee, and decision maker, I believe it is better to limit your participation to a sort of program management role (similar to StableLab in the LTIPP where the other decisions are made by Advisors and Council).
Furthermore, the ADPC’s mandate was always to act as the screening committee to decide the vendors to whitelist for the program. As you can see in the Tally vote which established the ADPC, ‘the ADPC bears the responsibility of diligently executing the steps essential to implement the aforementioned procurement framework’.
I don't believe this response satisfactorily addresses his question. 'Diligently executing the steps' means managing or advancing a process, not positioning oneself as the decision maker for everything related to it.
Exactly right, the ADPC is currently in the process of setting up the procurement framework to whitelist security service providers for the DAO. Given the large amount of legal work required to structure an RFP, it is still in the drafting phase and has not yet been published to procure any security service providers.
Why is there a need to rush this snapshot vote before having this defined?
Fully agree here on gap in security experience - as mentioned above, we are in the process of sourcing a neutral security expert as an advisor to aid us in judging both, applications from service providers during the RFP process and applications from projects looking to receive subsidies from the Subsidy Fund.
Assuming it is approved, wouldn't this incur additional costs? Given that you acknowledge a lack of security experience, the role of the 'security expert' would be crucial in assessing the applicants. Why not directly appoint a manager or a committee of security experts and provide them with compensation to carry out the task?
It might be interesting to involve the ARDC in this process, as it includes a DAO advocate, a member qualified for Risk Assessment, and a member qualified for Security Assessment.
and we have received no other indication from the rest of the community that another committee is required to handle fund disbursement.
I sincerely believe that it was not sufficiently discussed. I have requested information about the public notion, the biweekly reports, and the minutes of the meetings, none of which were made available to the DAO.
The only message with information about a call was in the Telegram group regarding the first call, which was announced approximately an hour before it actually took place. If I am mistaken or do not have the correct source of information, I apologize.
In recognition of the additional responsibilities undertaken, each of the five multi-sig wallets is proposed to receive a supplementary compensation ranging from 500 ARB - 1,000 ARB monthly.
What is the need to expand the budget that has already been approved for controlling one (or the same) multisig?
I believe it would be ideal for this entire document to be presented on the forum rather than in a separate PDF on Drive that could be modified in the future.
1 cohort of 8 weeks (2 months) for a total fund size of $2.5 million.
2 cohorts of 8 weeks each (4 months) for a total fund size of $5 million.
4 cohorts of 8 weeks each (8 months) for a total fund size of $10 million.
Regarding this, I believe it would be better for the funds paid by the DAO to be denominated in ARB
Thanks again, I think overall the proposal is good and well thought out.
Thank you all for the feedback! The proposal will incorporate the following amendments and subsequently be posted on Snapshot:
Amendments
Thank you all for the feedback! The proposal will incorporate the following amendments and subsequently be posted on Snapshot:
Amendments
We also discussed forming an entirely additional committee to disburse the Subsidy Fund and collectively landed on that for this initial iteration, it may make more sense to operate in the "committee-light" way, i.e., ADPC + security expert given:
Lastly, we are currently in discussion with the Foundation’s legal counsel regarding the addition of an exclusivity clause for projects receiving subsidies, namely around the provision being added to the Grant Agreement and the practicality of enforcing oversight post-disbursement.
@coinflip, thanks for the feedback! Appreciate the time you took going through, and happy to clarify a few aspects about the ADPC’s mandate and process - some of them might directly resolve a few of your remarks:
(1) On your comment ‘ADPC has not made public (or not linked here) which vendors qualified or didn’t qualify and why’:
@coinflip, thanks for the feedback! Appreciate the time you took going through, and happy to clarify a few aspects about the ADPC’s mandate and process - some of them might directly resolve a few of your remarks:
(1) On your comment ‘ADPC has not made public (or not linked here) which vendors qualified or didn’t qualify and why’:
(2) On your remarks ‘ADPC will directly administer and decide on which protocols are recipients of this $10m’ and ‘no oversight board or technical board with specific expertise in the area of these grants’:
(3) On your question ‘no DAO voting either directly or via an Optimistic process with challenge’:
(4) On your comment ‘if you feel the proposal should go to the DAO as is please do consider providing delegates multiple voting options on significantly smaller program size’:
Just to recap, if there is consensus from delegates on the below, we are happy to:
If you have time to respond, obviously much appreciated and thanks again for the helpful guidance
These comments and thoughts reflect my personal opinions on this proposal. Whilst I am a member of the Arbitrum Representative Council (ARC), they do not necessarily represent the overall views of the council or provide an indication of final voting decision
I'm directionally in favour of this proposal as it aligns well with my vision for the DAO as a support service for protocols building on Arbitrum. This would be a competitive advantage which would draw builders to Arbitrum by offering them a range of free/discounted support services they could not access elsewhere.
These comments and thoughts reflect my personal opinions on this proposal. Whilst I am a member of the Arbitrum Representative Council (ARC), they do not necessarily represent the overall views of the council or provide an indication of final voting decision
I'm directionally in favour of this proposal as it aligns well with my vision for the DAO as a support service for protocols building on Arbitrum. This would be a competitive advantage which would draw builders to Arbitrum by offering them a range of free/discounted support services they could not access elsewhere.
I'm also in favour of this change for the reasons pointed out by @dk3 and @JoJo. Thanks for being flexible.
Re. the %-based approach, following your comments and internal discussions w/ fellow ADPC Members, we have decided to amend the proposal to reflect a %-based approach to subsidies which will entail the ADPC covering up to 70% (maximum threshold) of the corresponding service solicited by the project.
@coinflip makes an interesting point RE check and balances. I lean towards greater empowerment of the groups like the ADPC to make decision on behalf of the DAO. However, adding in greater transparency (i.e. details on vendors qualifying / didn't qualify) and/or an optimistic process with challenge on decisions may be beneficial.
Appreciate the comment @PennBlockchain !
Answering your query below:
Appreciate the comment @PennBlockchain !
Answering your query below:
The need for the ADPC initially came about when several projects were requesting subsidies from the DAO in relation to [primarily] security services so as to get their project up and running. Hence, this was where the initial concern (and subsequent need of the ADPC) materialised. In addition, we've already gotten some projects (mainly non-VC funded ones), that have shown their interest in the Subsidy program.
This was further substantiated following our public consultation with security service providers wherein we solicited their input in relation to the average/median security-service fees applicable to certain service-classes.
As a final point the intention is not to fully allocate the 10Million budget. The threshold per-cohort (as delineated above), is a maximum threshold that cannot be exceeded and not a sum that is to be fully disbersed. Naturally, unutilised funds would be sent to the ArbitrumDAO Treasury or, if the ADPC's mandate is extended, transitioned over to the next iteration of the ADPC.
Should you have any further questions or queries, we remain at your disposal!
The SF is expected to attract a large number of projects as we have already gotten numerous inquiries pre-launch.
Hence, we needed to impose a maximum cap.
Yes, thanks for the clarification. But there is still one question remaining regarding the number of projects Why exactly so many projects?
Appreciate the comment @cp0x !
The amount requested was based on the data emanating from a public consultation carried out by the Procurement Committee w/the participation from security service providers.
Appreciate the comment @cp0x !
The amount requested was based on the data emanating from a public consultation carried out by the Procurement Committee w/the participation from security service providers.
It is based on an average maximum amount needed to cover enough funding for X Project per/Cohort. Hence, having funding options in place would eliminate the data-driven approach that we utilised in structuring the internal mechanics and funding allocation applicable to project subsidies.
I agree that since we have a commission, it needs funds to carry out its functions. The proposal itself is good and I support it. But to begin with, I would suggest a more modest amount for this. I suggest making options for funding amounts during a temperature check
@dk3 @JoJo
Sharing replies to feedback hereunder:
Thanks for the constructive feedback lads!
Re. the co-insurance method:
This method/mode of administration was discussed internally when structuring the operational and administrational parameters that would underpin fund disbersement. In this regard, we opted for a service-by-service approach due to the following reasons:
Thank you for the comments everyone! We're drafting our responses and will share them soon.
@CU-ManicUnicorn, @dk3, apologies - the Google Docs for the Grant Application Terms and Conditions is now viewable.
In life, markets and magic the gathering, anything that costs 0 would be eventually exploited by external forces. A partial payment would be in my opinion quite good:
Is the idea to pay for the audit in full? I know a previous discussion was to do something like:
We appreciate the ADPC for this clear proposal that outlines the goals, purpose, and evaluation criteria for projects that might receive the security audit subsidy. We believe this proposal could be quite beneficial to onboarding new applications. A few questions came to mind:
@dk3 @JoJo
Sharing replies to feedback hereunder:
Thanks for the constructive feedback lads!
Re. the co-insurance method:
This method/mode of administration was discussed internally when structuring the operational and administrational parameters that would underpin fund disbersement. In this regard, we opted for a service-by-service approach due to the following reasons:
The ADPC’s current mandate is that of a mere 6 months (extendable by a further period which is still not determined due to our nascent stage), hence, we cannot (in good faith) enter into an agreement w/ a third party project-applicant and guarantee an annual remuneration given the mandate would not align with such a timeline.
Giving a one-time grant to use of security-services in general as opposed to projects electing to choose an SP, choose a service they need, and then apply for the subsidy would entail more workload on the administration side in ensuring that funds allocated are actually being spent for security services, and not for other unintended purposes. Hence, from a proper administration perspective, it would be more difficult to trace fund expenditure in this manner.
Were we to go with this model, (in line with Point 1), should we grant an annual Stipend to Project X to be used within a 12-month period, and the ADPC be terminated within 6 months, there would be no one in place to actually vet whether the funds are being spent in accordance with their intended purposes (a concern highlighted in 2).
Re. the %-based approach, following your comments and internal discussions w/ fellow ADPC Members, we have decided to amend the proposal to reflect a %-based approach to subsidies which will entail the ADPC covering up to 70% (maximum threshold) of the corresponding service solicited by the project.
In life, markets and magic the gathering, anything that costs 0 would be eventually exploited by external forces. A partial payment would be in my opinion quite good:
Maybe numbers might be a bit different, to favour smaller teams that could tap into a budget that can potentially be 65-70k (effectively if the audit then costs 100k, a normal project has 50% covered, a smaller project has 65-70% covered, which likely would be instead 2 audits of 50k covereted by 70% cause team is smaller so likely product is initially smaller). To do this tho, a due diligence on effective runaway and spending of the team would be needed, which in some cases might just be very very hard to do.
Is the idea to pay for the audit in full? I know a previous discussion was to do something like:
This would allow for casting a wider net and be more of a cost-sharing program for being an arbitrum-aligned project rather than a blanket welfare program, IMO. The numbers I used were just ballpark, but it was my understanding that it would be more like a coinsurance program. This also allows projects at various stages to choose the best auditor for their project based on the negotiated rates, auditor expertise, and specific needs.
Also, the Google Docs are not publicly shared; we need to change the permissions so they are viewable.
@dk3 @JoJo
Sharing replies to feedback hereunder:
Thanks for the constructive feedback lads!
Re. the co-insurance method:
This method/mode of administration was discussed internally when structuring the operational and administrational parameters that would underpin fund disbersement. In this regard, we opted for a service-by-service approach due to the following reasons:
The ADPC’s current mandate is that of a mere 6 months (extendable by a further period which is still not determined due to our nascent stage), hence, we cannot (in good faith) enter into an agreement w/ a third party project-applicant and guarantee an annual remuneration given the mandate would not align with such a timeline.
Giving a one-time grant to use of security-services in general as opposed to projects electing to choose an SP, choose a service they need, and then apply for the subsidy would entail more workload on the administration side in ensuring that funds allocated are actually being spent for security services, and not for other unintended purposes. Hence, from a proper administration perspective, it would be more difficult to trace fund expenditure in this manner.
Were we to go with this model, (in line with Point 1), should we grant an annual Stipend to Project X to be used within a 12-month period, and the ADPC be terminated within 6 months, there would be no one in place to actually vet whether the funds are being spent in accordance with their intended purposes (a concern highlighted in 2).
Re. the %-based approach, following your comments and internal discussions w/ fellow ADPC Members, we have decided to amend the proposal to reflect a %-based approach to subsidies which will entail the ADPC covering up to 70% (maximum threshold) of the corresponding service solicited by the project.
In life, markets and magic the gathering, anything that costs 0 would be eventually exploited by external forces. A partial payment would be in my opinion quite good:
Maybe numbers might be a bit different, to favour smaller teams that could tap into a budget that can potentially be 65-70k (effectively if the audit then costs 100k, a normal project has 50% covered, a smaller project has 65-70% covered, which likely would be instead 2 audits of 50k covereted by 70% cause team is smaller so likely product is initially smaller). To do this tho, a due diligence on effective runaway and spending of the team would be needed, which in some cases might just be very very hard to do.
Is the idea to pay for the audit in full? I know a previous discussion was to do something like:
This would allow for casting a wider net and be more of a cost-sharing program for being an arbitrum-aligned project rather than a blanket welfare program, IMO. The numbers I used were just ballpark, but it was my understanding that it would be more like a coinsurance program. This also allows projects at various stages to choose the best auditor for their project based on the negotiated rates, auditor expertise, and specific needs.
Also, the Google Docs are not publicly shared; we need to change the permissions so they are viewable.
