Summary:
It is industry standard and recommended practice that all projects with on-chain smart contracts undergo at least one third party audit. This is because smart contracts can potentially secure millions, if not billions of dollars, yet a single bug in the code can result in the loss of all funds. In many cases, when the smart contract is deployed, it can be difficult to upgrade after launch, and audits should be completed prior to the project going live.
Unfortunately, audits are prohibitively expensive. It is not uncommon for projects to pay ~$20k per auditor per week. If multiple auditors are required for the project, then the bill increases substantially into six figures. This is problematic for early stage projects who may simply lack the funds to pay for an audit or be forced to allocate a significant portion of the funds they have raised from investors to pay for the audit.
This proposal aims to implement a subsidy scheme that will allocate funds to projects that require financial assistance to pay for an audit. To be eligible for the funds, the project will need to satisfy certain requirements such as launching on Arbitrum and any code audited will need to remain exclusive to our ecosystem for a fixed period of time.
We are targeting relatively early stage projects, projects that have demonstrated product market fit on Arbitrum, and finally projects that have remained loyal to our ecosystem with an upcoming launch or upgrade that has the potential to help grow the ecosystem.
The subsidy program will run for 1 year or until all funds are spent. An appointed Arbitrum Audit committee will run the program. There will be 4 (quarterly) transparency reports alongside a final summary report to keep the DAO abreast about program updates.
The Arbitrum Audit Subsidy Program invites projects to apply via an open applications track with a standardised form to gather the following information:
The committee will screen the above information based on:
A project can be rejected at any stage of the process at the committee’s discretion.
If the committee approves the project during the screening process, then it will undertake due diligence which may include reference checks, reviewing the code related to the audit scope, and other information it may deem necessary to check. Assuming the due diligence succeeds, then the committee will aid the project in connecting with auditors to get the best quote alongside confirming the auditor has the capability to audit the project.
It is up to the project to decide on the auditor, but it must be in agreement with the Arbitrum Audit committee. We expect auditors to be selected based on the rate charged to the project (i.e., auditor per week cost), availability and timeline for completing the audit and experience with auditing similar projects. In the case of an auditing competition platform, the auditor will need to demonstrate that the auditors on their platform have the required skillset for the specific project.
Keep in mind, this is a subsidy program, which will require the project to pay a portion of the audit, which will also be negotiated as part of the application process.
We welcome applications from early stage and existing projects that satisfy the following requirements:
With the above in mind, our aim is to target early stage projects with potential to grow on Arbitrum as well as projects with a strong track record or loyalty to the Arbitrum ecosystem.
All audited code MUST remain exclusive to the Arbitrum ecosystem and this will be included in the relevant legal agreements. Breaching exclusivity will obligate the project to repay the full subsidy to the DAO via the Arbitrum Foundation (AF). Non-compliance may lead to legal recourse and/or a proposal to the DAO to ban the project from all future DAO-funded initiatives.
Subsidy payments will only be paid after the audit is completed. The Arbitrum Foundation will disburse the funds to the auditor. All payments are contingent upon the Foundation’s satisfaction that the audit meets acceptable quality and confirms to industry standards.
Additionally, we will seek when possible to offer the payment in ARB as opposed to USD, subject to the auditor’s needs.
The Arbitrum Foundation will take on the role of evaluating auditors who want to apply for this program which includes an interview, reference checks, compliance, and agreement to the terms & conditions of this program. It should be noted that we will conduct an individual negotiation with all approved auditors to take into account potential different rates and offerings from the auditors. Additionally, auditors can apply at any time to join the program.
An approved auditor will have an opportunity to post on the forum to advertise that they have been accepted to the program. This will assist projects with finding auditors that may be suitable for them even if a subsidy is not offered by this program.
Additionally, we will invite auditing firms from the ADPC’s Security Subsidy Fund to apply, with the intention for us to negotiate additional terms that are suitable for this new program.
We propose a committee with a mixture of technical expertise and DAO representation who will have the necessary skills and time to review proposals on an on-going basis.
We have included the OpCo as a potential team member as soon as it is operational and considers itself ready to join. The AF will chair the committee to lead the discussion and decision making process with consultation of other committee members.
The committee will enforce a strict conflict of interest policy such that no member should have any financial ties to an approved auditing firm that is taking part in the program and they should not have a significant conflict of interest with competing blockchain projects. The technical expert should not be part of the auditing firms engaged in the program and will be paid USD$5k per month. We expect the workload to be ~1-2 days per week.
Scope of work includes:
The committee will publish an update in regards to the program every 3 months with a total of 4 reports. Additionally, a final ‘conclusion report’ will be published, after the final audit subsidy is paid.
All reports will include the following information:
As mentioned during the governance calls, we do not plan to release specific financial details related to individual subsidy payment. The ADPC acknowledged that auditors are sensitive to revealing their rates to competitors. Additionally, this information is often leveraged by potential grantees during the negotiation process which would make the committee’s job more difficult.
We may also have a delay in reporting the ‘funds spent to date’ depending on the total grants issued to help preserve some privacy around individual subsidies paid. We hope to include success stories, but this will be in later reports as it will take time for audits to be completed, protocols to launch, and for success stories to emerge.
Additionally, all grantees of the program will be requested to publish a growth report to the DAO, 2, 4 and 6 months after their project is launched on Arbitrum. In this report, we expect the grantee to publish metrics relevant to their project, including but not limited to, total value locked (TVL), protocol fees generated, integration with other protocols in Arbitrum, utilization of assets, etc. The committee will work with the grantee to determine the relevant metrics and deadlines for publishing the report. The Arbitrum Foundation will keep track of the reports after the program has finished to ensure they are all published to the DAO.
It is not uncommon for projects to pay $10k to $40k per auditor per week depending on the complexity of the project with overall costs exceeding $100k.
If we assume, conservatively, that each project will receive a $100k subsidy, then with a $10m budget, we can subsidize around 100 projects to build on Arbitrum which is approximately 1.9 projects per week for 1 year.
We are requesting a $10m USD budget to subsidise audits for 1 year and $60k to pay for the technical expert. All other costs including legal, management of the program, etc, will be covered by the Arbitrum Foundation.
Our proposal will:
Whenever the program ends, the remaining funds in USDC and ARB, will be returned to the ArbitrumDAO unless the DAO approves the continuation of the program via an off-chain vote.
We intend to convert ARB to USD periodically throughout the duration of the auditing program as opposed to exchanging it all at once.
We consider the establishment of a long-term security subsidy fund as an urgent matter to support builders in Arbitrum and will work with contributors in the ArbitrumDAO to get the program set up as soon as possible.
We have run three governance calls with two recorded [1,2] and the temperature check vote has passed on Snapshot.
We plan to put the proposal up for an on-chain vote for the 13th March 2025.
This on-chain vote is ~2 weeks later than anticipated in the original proposal. The delay is due to the many helpful comments and discussions we have had with contributors in the DAO. We believe the proposal should hopefully satisfy most comments that have been raised over the past few weeks and the proposal is overall better thanks to the process.
Assuming the proposal is approved by the ArbitrumDAO, then we will:
An official announcement will be published to declare the start date and when the 1 year clock for the program begins.
Summary:
It is industry standard and recommended practice that all projects with on-chain smart contracts undergo at least one third party audit. This is because smart contracts can potentially secure millions, if not billions of dollars, yet a single bug in the code can result in the loss of all funds. In many cases, when the smart contract is deployed, it can be difficult to upgrade after launch, and audits should be completed prior to the project going live.
Unfortunately, audits are prohibitively expensive. It is not uncommon for projects to pay ~$20k per auditor per week. If multiple auditors are required for the project, then the bill increases substantially into six figures. This is problematic for early stage projects who may simply lack the funds to pay for an audit or be forced to allocate a significant portion of the funds they have raised from investors to pay for the audit.
This proposal aims to implement a subsidy scheme that will allocate funds to projects that require financial assistance to pay for an audit. To be eligible for the funds, the project will need to satisfy certain requirements such as launching on Arbitrum and any code audited will need to remain exclusive to our ecosystem for a fixed period of time.
We are targeting relatively early stage projects, projects that have demonstrated product market fit on Arbitrum, and finally projects that have remained loyal to our ecosystem with an upcoming launch or upgrade that has the potential to help grow the ecosystem.
The subsidy program will run for 1 year or until all funds are spent. An appointed Arbitrum Audit committee will run the program. There will be 4 (quarterly) transparency reports alongside a final summary report to keep the DAO abreast about program updates.
The Arbitrum Audit Subsidy Program invites projects to apply via an open applications track with a standardised form to gather the following information:
The committee will screen the above information based on:
A project can be rejected at any stage of the process at the committee’s discretion.
If the committee approves the project during the screening process, then it will undertake due diligence which may include reference checks, reviewing the code related to the audit scope, and other information it may deem necessary to check. Assuming the due diligence succeeds, then the committee will aid the project in connecting with auditors to get the best quote alongside confirming the auditor has the capability to audit the project.
It is up to the project to decide on the auditor, but it must be in agreement with the Arbitrum Audit committee. We expect auditors to be selected based on the rate charged to the project (i.e., auditor per week cost), availability and timeline for completing the audit and experience with auditing similar projects. In the case of an auditing competition platform, the auditor will need to demonstrate that the auditors on their platform have the required skillset for the specific project.
Keep in mind, this is a subsidy program, which will require the project to pay a portion of the audit, which will also be negotiated as part of the application process.
We welcome applications from early stage and existing projects that satisfy the following requirements:
With the above in mind, our aim is to target early stage projects with potential to grow on Arbitrum as well as projects with a strong track record or loyalty to the Arbitrum ecosystem.
All audited code MUST remain exclusive to the Arbitrum ecosystem and this will be included in the relevant legal agreements. Breaching exclusivity will obligate the project to repay the full subsidy to the DAO via the Arbitrum Foundation (AF). Non-compliance may lead to legal recourse and/or a proposal to the DAO to ban the project from all future DAO-funded initiatives.
Subsidy payments will only be paid after the audit is completed. The Arbitrum Foundation will disburse the funds to the auditor. All payments are contingent upon the Foundation’s satisfaction that the audit meets acceptable quality and confirms to industry standards.
Additionally, we will seek when possible to offer the payment in ARB as opposed to USD, subject to the auditor’s needs.
The Arbitrum Foundation will take on the role of evaluating auditors who want to apply for this program which includes an interview, reference checks, compliance, and agreement to the terms & conditions of this program. It should be noted that we will conduct an individual negotiation with all approved auditors to take into account potential different rates and offerings from the auditors. Additionally, auditors can apply at any time to join the program.
An approved auditor will have an opportunity to post on the forum to advertise that they have been accepted to the program. This will assist projects with finding auditors that may be suitable for them even if a subsidy is not offered by this program.
Additionally, we will invite auditing firms from the ADPC’s Security Subsidy Fund to apply, with the intention for us to negotiate additional terms that are suitable for this new program.
We propose a committee with a mixture of technical expertise and DAO representation who will have the necessary skills and time to review proposals on an on-going basis.
We have included the OpCo as a potential team member as soon as it is operational and considers itself ready to join. The AF will chair the committee to lead the discussion and decision making process with consultation of other committee members.
The committee will enforce a strict conflict of interest policy such that no member should have any financial ties to an approved auditing firm that is taking part in the program and they should not have a significant conflict of interest with competing blockchain projects. The technical expert should not be part of the auditing firms engaged in the program and will be paid USD$5k per month. We expect the workload to be ~1-2 days per week.
Scope of work includes:
The committee will publish an update in regards to the program every 3 months with a total of 4 reports. Additionally, a final ‘conclusion report’ will be published, after the final audit subsidy is paid.
All reports will include the following information:
As mentioned during the governance calls, we do not plan to release specific financial details related to individual subsidy payment. The ADPC acknowledged that auditors are sensitive to revealing their rates to competitors. Additionally, this information is often leveraged by potential grantees during the negotiation process which would make the committee’s job more difficult.
We may also have a delay in reporting the ‘funds spent to date’ depending on the total grants issued to help preserve some privacy around individual subsidies paid. We hope to include success stories, but this will be in later reports as it will take time for audits to be completed, protocols to launch, and for success stories to emerge.
Additionally, all grantees of the program will be requested to publish a growth report to the DAO, 2, 4 and 6 months after their project is launched on Arbitrum. In this report, we expect the grantee to publish metrics relevant to their project, including but not limited to, total value locked (TVL), protocol fees generated, integration with other protocols in Arbitrum, utilization of assets, etc. The committee will work with the grantee to determine the relevant metrics and deadlines for publishing the report. The Arbitrum Foundation will keep track of the reports after the program has finished to ensure they are all published to the DAO.
It is not uncommon for projects to pay $10k to $40k per auditor per week depending on the complexity of the project with overall costs exceeding $100k.
If we assume, conservatively, that each project will receive a $100k subsidy, then with a $10m budget, we can subsidize around 100 projects to build on Arbitrum which is approximately 1.9 projects per week for 1 year.
We are requesting a $10m USD budget to subsidise audits for 1 year and $60k to pay for the technical expert. All other costs including legal, management of the program, etc, will be covered by the Arbitrum Foundation.
Our proposal will:
Whenever the program ends, the remaining funds in USDC and ARB, will be returned to the ArbitrumDAO unless the DAO approves the continuation of the program via an off-chain vote.
We intend to convert ARB to USD periodically throughout the duration of the auditing program as opposed to exchanging it all at once.
We consider the establishment of a long-term security subsidy fund as an urgent matter to support builders in Arbitrum and will work with contributors in the ArbitrumDAO to get the program set up as soon as possible.
We have run three governance calls with two recorded [1,2] and the temperature check vote has passed on Snapshot.
We plan to put the proposal up for an on-chain vote for the 13th March 2025.
This on-chain vote is ~2 weeks later than anticipated in the original proposal. The delay is due to the many helpful comments and discussions we have had with contributors in the DAO. We believe the proposal should hopefully satisfy most comments that have been raised over the past few weeks and the proposal is overall better thanks to the process.
Assuming the proposal is approved by the ArbitrumDAO, then we will:
An official announcement will be published to declare the start date and when the 1 year clock for the program begins.
Democratising lobbyism, on-chain. Check out lobbyfi.xyz
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/126
Democratising lobbyism, on-chain. Check out lobbyfi.xyz
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/126
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/127?u=ocandocrypto
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/125?u=griff
The Event Horizon Community voted FOR on this Proposal (ehARB-91): EventHorizon.vote/vote/arbitrum/ehARB-91
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/120
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/110
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/119?u=tane
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/117?u=tekr0x.eth
Vote Against. These programs are industry standard, but this is several multiples the size of the comparable program at Optimism, which has around $1.2m for the first half of 2025. We would fully support this program with a smaller size.
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/116
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/115?u=blockful
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/114?u=dragonawr
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/113?u=pedrob
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/112?u=mcfly
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/111?u=0x_ultra
I don't agree with internalizing this program into the Arbitrum Foundation. https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/107?u=paulofonseca
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/105
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/53?u=0xalex
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/104?u=blueweb
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/103?u=ezr3al
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/44?u=tempetechie
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/102?u=maxlomu
I totally agree that it's important to support early-stage projects because audits can be quite expensive. However, there needs to be more clarification on how transparent the audit process within the ecosystem with be .
A smaller test budget (1-2M USD) to evaluate the efficacy of such a program and evaluating the positive impact for the Arbitrum ecosystem seems a prudent first step before committing 10M USD.
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/100?u=todayindefi
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/45?u=bruce
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/98?u=0xtalvo.eth_mty
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/97?u=danielm
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/80?u=blockworksresearch
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/77?u=ocandocrypto
Democratising lobbyism, on-chain. Check out lobbyfi.xyz
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/75?u=linzerd
I don’t agree with internalizing into the Arbitrum Foundation, a job that the DAO was previously doing. Even when the service providers doing that job for the DAO were taking too long, wasting resources, denying audit subsidies to worthy projects, porting the whole program to competing ecosystems, etc. I don’t condone the way the ADPC acted in their past 2 terms, but I also don’t think internalizing this job into the Foundation is the right approach. What I think we need is an Arbitrum DAO run, dedicated Audit Subsidy program, that would run continuously and would report their actions to the DAO with the utmost transparency possible. And executed by new and fresh service providers that are exclusive to Arbitrum. https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/73?u=paulofonseca
The Event Horizon Community voted FOR on this proposal (ehARB-87): EventHorizon.vote/vote/arbitrum/ehARB-87
The Event Horizon Community voted on this proposal (ehARB-87): EventHorizon.vote/vote/arbitrum/ehARB-87
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/71
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/68?u=danielm
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/66?u=0x_ultra
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/65?u=griff
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/63?u=euphoria
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/62?u=tekr0x.eth
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/56
https://forum.arbitrum.foundation/t/gfx-labs-delegate-communication-thread/13794
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/60?u=tane
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/34
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/57?u=ezr3al
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/54
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/53?u=0xalex
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/52?u=todayindefi
https://forum.arbitrum.foundation/t/juanrah-delegate-communication-thread/27395/29?u=juanrah
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/47?u=dragonawr
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/45?u=bruce
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/44?u=tempetechie
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/42?u=pedrob
https://forum.arbitrum.foundation/t/larva-delegate-communication-thread/24476/125?u=larva
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/21?u=castlecapital
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/127?u=ocandocrypto
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/125?u=griff
The Event Horizon Community voted FOR on this Proposal (ehARB-91): EventHorizon.vote/vote/arbitrum/ehARB-91
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/120
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/110
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/119?u=tane
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/117?u=tekr0x.eth
Vote Against. These programs are industry standard, but this is several multiples the size of the comparable program at Optimism, which has around $1.2m for the first half of 2025. We would fully support this program with a smaller size.
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/116
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/115?u=blockful
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/114?u=dragonawr
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/113?u=pedrob
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/112?u=mcfly
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/111?u=0x_ultra
I don't agree with internalizing this program into the Arbitrum Foundation. https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/107?u=paulofonseca
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/105
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/53?u=0xalex
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/104?u=blueweb
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/103?u=ezr3al
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/44?u=tempetechie
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/102?u=maxlomu
I totally agree that it's important to support early-stage projects because audits can be quite expensive. However, there needs to be more clarification on how transparent the audit process within the ecosystem with be .
A smaller test budget (1-2M USD) to evaluate the efficacy of such a program and evaluating the positive impact for the Arbitrum ecosystem seems a prudent first step before committing 10M USD.
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/100?u=todayindefi
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/45?u=bruce
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/98?u=0xtalvo.eth_mty
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/97?u=danielm
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/80?u=blockworksresearch
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/77?u=ocandocrypto
Democratising lobbyism, on-chain. Check out lobbyfi.xyz
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/75?u=linzerd
I don’t agree with internalizing into the Arbitrum Foundation, a job that the DAO was previously doing. Even when the service providers doing that job for the DAO were taking too long, wasting resources, denying audit subsidies to worthy projects, porting the whole program to competing ecosystems, etc. I don’t condone the way the ADPC acted in their past 2 terms, but I also don’t think internalizing this job into the Foundation is the right approach. What I think we need is an Arbitrum DAO run, dedicated Audit Subsidy program, that would run continuously and would report their actions to the DAO with the utmost transparency possible. And executed by new and fresh service providers that are exclusive to Arbitrum. https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/73?u=paulofonseca
The Event Horizon Community voted FOR on this proposal (ehARB-87): EventHorizon.vote/vote/arbitrum/ehARB-87
The Event Horizon Community voted on this proposal (ehARB-87): EventHorizon.vote/vote/arbitrum/ehARB-87
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/71
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/68?u=danielm
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/66?u=0x_ultra
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/65?u=griff
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/63?u=euphoria
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/62?u=tekr0x.eth
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/56
https://forum.arbitrum.foundation/t/gfx-labs-delegate-communication-thread/13794
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/60?u=tane
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/34
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/57?u=ezr3al
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/54
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/53?u=0xalex
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/52?u=todayindefi
https://forum.arbitrum.foundation/t/juanrah-delegate-communication-thread/27395/29?u=juanrah
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/47?u=dragonawr
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/45?u=bruce
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/44?u=tempetechie
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/42?u=pedrob
https://forum.arbitrum.foundation/t/larva-delegate-communication-thread/24476/125?u=larva
https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/21?u=castlecapital
Hey! Im a co-founder of hashlock.com. We are one of the fastest growing firms in the industry, and our reputation and track record has helped us to secure some of the largest protocols in recent memory. We would love to support Arbitrum and be part of this program if more auditing firms are accepted, as we didn’t get a chance to apply last time. We are happy to support Arbitrum’s mission and work towards growing the ecosystem securely.
Hey, Wui here from FailSafe, a security audit company. We're currently protecting mostly OP, Arb and eth main net projects, and one of our partners pointed us to this Arb audit program - Question: how would FailSafe apply to be in the panel of auditors under consideration when projects are being given a grant! would love to participate deeper in the Arb ecosystem!
Hey! Im a co-founder of hashlock.com. We are one of the fastest growing firms in the industry, and our reputation and track record has helped us to secure some of the largest protocols in recent memory. We would love to support Arbitrum and be part of this program if more auditing firms are accepted, as we didn’t get a chance to apply last time. We are happy to support Arbitrum’s mission and work towards growing the ecosystem securely.
Hey, Wui here from FailSafe, a security audit company. We're currently protecting mostly OP, Arb and eth main net projects, and one of our partners pointed us to this Arb audit program - Question: how would FailSafe apply to be in the panel of auditors under consideration when projects are being given a grant! would love to participate deeper in the Arb ecosystem!
Now that this proposal is moving to onchain voting. How can auditors apply for the program? Please advise.
Now that this proposal is moving to onchain voting. How can auditors apply for the program? Please advise.
Hi all, we wanted to post an update here following the Office Hours on 24 February and conversations we’ve had with the Arbitrum Foundation. As stated in the call, we are in the process of supporting the handover of the program to Arbitrum Foundation to support their internalisation approach.
We are proud of the outcome of the program, and that the work of structuring and running the pilot program is now continuing as a core program of the ecosystem with more funds being allocated to it. It's a moment to celebrate our achievements that we outline in the final Outcome Report linked here, and we thank everyone for the positive feedback.
Hi all, we wanted to post an update here following the Office Hours on 24 February and conversations we’ve had with the Arbitrum Foundation. As stated in the call, we are in the process of supporting the handover of the program to Arbitrum Foundation to support their internalisation approach.
We are proud of the outcome of the program, and that the work of structuring and running the pilot program is now continuing as a core program of the ecosystem with more funds being allocated to it. It's a moment to celebrate our achievements that we outline in the final Outcome Report linked here, and we thank everyone for the positive feedback.
Our ultimate goal and that of the Foundation’s are aligned: to help grow the Arbitrum ecosystem. As such, we will support the Arbitrum Foundation in an advisory function during the roll-out and make sure our expertise and learnings will carry on.
As individual service providers, we believe each of us can positively impact the Arbitrum ecosystem in a multitude of ways and double down on the value creation and the success case of the Security Subsidy Fund. There are a lot of problems to be solved and a lot of ways in which the ecosystem can grow, be it by supporting the vibrant builder ecosystem with critical services and infrastructure, through growth programs that focus on sustainably growing the number of quality apps and bring in net new users to the ecosystem, or through meeting the needs of builders across the builder funnel in an effort to provide them with consistent support across all stages of their growth.
As individual service providers outside of the remit of the ADPC, we’re looking forward to working in concert with the Foundation and the rest of the DAO on such efforts to grow the ecosystem, ensuring that their design, strategy, and execution is handled as professionally as we have managed to do so far.
Hi all, we wanted to post an update here following the Office Hours on 24 February and conversations we’ve had with the Arbitrum Foundation. As stated in the call, we are in the process of supporting the handover of the program to Arbitrum Foundation to support their internalisation approach.
We are proud of the outcome of the program, and that the work of structuring and running the pilot program is now continuing as a core program of the ecosystem with more funds being allocated to it. It's a moment to celebrate our achievements that we outline in the final Outcome Report linked here, and we thank everyone for the positive feedback.
Hi all, we wanted to post an update here following the Office Hours on 24 February and conversations we’ve had with the Arbitrum Foundation. As stated in the call, we are in the process of supporting the handover of the program to Arbitrum Foundation to support their internalisation approach.
We are proud of the outcome of the program, and that the work of structuring and running the pilot program is now continuing as a core program of the ecosystem with more funds being allocated to it. It's a moment to celebrate our achievements that we outline in the final Outcome Report linked here, and we thank everyone for the positive feedback.
Our ultimate goal and that of the Foundation’s are aligned: to help grow the Arbitrum ecosystem. As such, we will support the Arbitrum Foundation in an advisory function during the roll-out and make sure our expertise and learnings will carry on.
As individual service providers, we believe each of us can positively impact the Arbitrum ecosystem in a multitude of ways and double down on the value creation and the success case of the Security Subsidy Fund. There are a lot of problems to be solved and a lot of ways in which the ecosystem can grow, be it by supporting the vibrant builder ecosystem with critical services and infrastructure, through growth programs that focus on sustainably growing the number of quality apps and bring in net new users to the ecosystem, or through meeting the needs of builders across the builder funnel in an effort to provide them with consistent support across all stages of their growth.
As individual service providers outside of the remit of the ADPC, we’re looking forward to working in concert with the Foundation and the rest of the DAO on such efforts to grow the ecosystem, ensuring that their design, strategy, and execution is handled as professionally as we have managed to do so far.
“The committee will enforce a strict conflict of interest policy such that no member should have any financial ties to an approved auditing firm that is taking part in the program and they should not have a significant conflict of interest with competing blockchain projects.”
What about the projects that end up receiving the security subsidy though? Since there are individuals in the foundation and the offchain labs team that also vcs/investors, will the committee disclose their personal/professional investments publicly and then recuse themselves in cases of such project applications?
“The committee will enforce a strict conflict of interest policy such that no member should have any financial ties to an approved auditing firm that is taking part in the program and they should not have a significant conflict of interest with competing blockchain projects.”
What about the projects that end up receiving the security subsidy though? Since there are individuals in the foundation and the offchain labs team that also vcs/investors, will the committee disclose their personal/professional investments publicly and then recuse themselves in cases of such project applications?
One only needs to look at the stylus sprint grant receivers to substantiate this simple need…
“The committee will enforce a strict conflict of interest policy such that no member should have any financial ties to an approved auditing firm that is taking part in the program and they should not have a significant conflict of interest with competing blockchain projects.”
What about the projects that end up receiving the security subsidy though? Since there are individuals in the foundation and the offchain labs team that also vcs/investors, will the committee disclose their personal/professional investments publicly and then recuse themselves in cases of such project applications?
“The committee will enforce a strict conflict of interest policy such that no member should have any financial ties to an approved auditing firm that is taking part in the program and they should not have a significant conflict of interest with competing blockchain projects.”
What about the projects that end up receiving the security subsidy though? Since there are individuals in the foundation and the offchain labs team that also vcs/investors, will the committee disclose their personal/professional investments publicly and then recuse themselves in cases of such project applications?
One only needs to look at the stylus sprint grant receivers to substantiate this simple need…
I am writing on behalf of the Arbitrum Governance Collective (AGC), a newly formed group of significant token holders focused on active participation in governance and value creation for the Arbitrum ecosystem.
Before addressing the proposal's structural flaws, we must address a critical credibility issue: The Foundation claims to be "heavily involved in the process of selecting which teams get the subsidy." The ADPC explicitly states this is false - that "the Foundation did not review a single application." One of these statements is untrue. Token holders deserve to know which version is accurate before being asked to trust the Foundation with $10M in DAO funds.
I am writing on behalf of the Arbitrum Governance Collective (AGC), a newly formed group of significant token holders focused on active participation in governance and value creation for the Arbitrum ecosystem.
Before addressing the proposal's structural flaws, we must address a critical credibility issue: The Foundation claims to be "heavily involved in the process of selecting which teams get the subsidy." The ADPC explicitly states this is false - that "the Foundation did not review a single application." One of these statements is untrue. Token holders deserve to know which version is accurate before being asked to trust the Foundation with $10M in DAO funds.
Let me outline our major concerns:
The Foundation proposes to run a $10M program with part-time, unpaid committee members "next to their everyday duties." This is frankly absurd. You don't run what you yourself call a "mission-critical" program as a side hobby. The proposed structure screams of inexperience in running professional investment operations.
The Foundation's claim they will "waive fees" is either naive or deliberately misleading. These costs will simply be absorbed into their DAO-funded operational budget. More concerning is the opportunity cost of running this critical program sub-optimally. One bad investment decision could cost multiples of any supposed savings.
The Foundation's fixation on "technical expertise" demonstrates a basic misunderstanding of what this program requires. What's needed is deep knowledge of the security services market and audit space - not generic technical knowledge. The ADPC demonstrated this understanding by engaging DeDaub, an established security firm. Why would a random technical person from the Foundation or OCL have more relevant expertise than actual auditing professionals? This misalignment of expertise requirements raises serious concerns about the Foundation's ability to even properly scope this program.
This is fundamentally an investment program requiring sophisticated venture capital and private equity experience in evaluating early-stage projects. The Foundation's emphasis on technical expertise while completely ignoring the need for investment acumen shows a fundamental misunderstanding of what drives successful project selection and portfolio management. Where is the venture capital expertise on their proposed committee? Who has experience managing comparable investment programs?
The Foundation states they have been "stepping in via our grant program to sponsor audits for builders over the past year." This raises serious governance concerns. The DAO funded the Foundation for specific operational purposes and the ADPC was explicitly voted in to manage audit subsidies. The Foundation's operational budget was not intended as a shadow grant program. While we appreciate the desire to support builders, this pattern of unilateral actions outside established governance frameworks and apparent repurposing of operational funds demands immediate scrutiny. We request:
Full transparency regarding these expenditures
Clarification on which operational budget lines were used
Explanation of how this aligns with their DAO-approved mandate
The Foundation's complete failure to coordinate internally is alarming. They were actively working with the ADPC on this exact initiative, received a detailed proposal, and then launched a competing proposal without any communication. This level of organizational dysfunction raises serious questions about their capacity to manage complex programs.
While the current ADPC structure has inefficiencies, we believe these primarily stem from the three-party structure and alignment with the Foundation. The solution isn't to add more bureaucracy - it's to streamline operations.
Our Solution:
Rather than allowing the Foundation to experiment with DAO funds or maintaining a complex multi-party structure, we propose selecting ONE premier service provider with:
Proven track record in initiative management
Established relationships with top audit firms
Clear accountability structure
Performance-based compensation alignment
Deep venture capital/private equity expertise
This is how professional investment operations work. Not through part-time committees, not through complex multi-party structures, and certainly not through foundation bureaucrats playing venture capitalist.
Questions the Foundation Must Answer:
Will you address the discrepancy between your claim of involvement in project selection and ADPC's statement?
Can you name a single successful program of this magnitude you've managed?
How do you justify running a $10M program as a part-time endeavor?
What governance framework guided your unilateral audit funding decisions?
We urge all token holders to vote NO on this proposal and support bringing in a qualified professional firm to manage this critical program.
The DAO deserves professional management of its resources, not amateur hour experiments with critical infrastructure.
Hi all, given the Foundation’s response concerning the ADPC, we thought it was important to respond and clarify the facts.
In regards to the Foundation's proposal, it needs to be mentioned that we shared a detailed proposal for continuing the Subsidy Fund — including a proposed $10M fund size and other specifics, such as a detailed scope — with the Foundation a week prior to their announcement to internalise the extension, and discussed it with them until the day they posted this Audit Program proposal.
Hi all, given the Foundation’s response concerning the ADPC, we thought it was important to respond and clarify the facts.
In regards to the Foundation's proposal, it needs to be mentioned that we shared a detailed proposal for continuing the Subsidy Fund — including a proposed $10M fund size and other specifics, such as a detailed scope — with the Foundation a week prior to their announcement to internalise the extension, and discussed it with them until the day they posted this Audit Program proposal.
We had also spent several weeks educating the Foundation on the operation of the framework, including a session in Bangkok with the core members of the team to walk through the tasks involved in running such a procurement framework and fund. On the basis of the feedback during that session, as well as strong support from the community, the industry and project teams involved in the initial 8 week run, we concluded that the ADPC was best placed to manage this for the DAO and prepared a proposal to submit last week.
The Foundation promised to get back with feedback, but instead posted this proposal by themselves without informing us. At no point in the past 12 months did the Foundation raise any concerns with us about ADPC operations, timeliness or cost effectiveness despite us having near daily communications with them. We strongly believe that the Foundation is a key stakeholder in the operation of the DAO and wanted to ensure they were not blindsided by any work being undertaken by the ADPC as poor communication between us could result in the DAO being ambushed by events. The ADPC is proud of its exemplary professionalism shown to date and are deeply troubled by any implications suggesting otherwise.
In summary it is incorrect to state that the DAO would not have had another subsidy fund - this was, in fact, on the horizon and we had planned on posting it imminently after receiving the Foundation’s feedback which, in the end, we never received.
We can discuss what it means to work for a DAO, the associated costs, and how pricing is determined among various stakeholders. However, we would have appreciated a more transparent communication process from the Foundation.
Respectfully, we can understand a business decision of wanting to run an ecosystem like a corporation and not a DAO. This is not what we are arguing against.
We, delegates, and other service providers have contributed to the ecosystem, effectively taking a bet on its success. This also means working together in a partnership. We understand the Foundation’s decision to internalise the DAO and its key initiatives run by service providers and would only ever want them success in continuing the innovative procurement models designed by the ADPC team.
More broadly, we think the Foundation’s expertise and resources (which the DAO has significantly funded) could be better utilised in spinning up programs that are not already tackled by contributors vs. going on a hiring sprint to internalise these functions.
Considering the history of the DAO and involvement of its participants (delegates and service providers) who have spent 2 years to try to get this experiment right, our strong preference is a continuation of the direct communication we had had with the Foundation until very recently as this shift by the Foundation to internalise a proposal that external contributors had been working on (and that the Foundation were aware of) could have resulted in a more streamlined approach and more seamless transition planning. The current approach is sub-optimal for the DAO, and we believe other delegates and ecosystem participants would tend to agree. The ADPC remains prepared to work with the Foundation on the understanding this can be done with mutual respect and transparency.
This is not an effort to challenge who runs the program, we are happy to support the transition to make sure the value we created is not lost, if the push to internalize continues.
Rather, we hope the Foundation will reconsider its overall communication and collaboration approach.
Otherwise, we are concerned it may lead to the offboarding of other remaining DAO contributors and delegates, who have long been the core of the ecosystem - as this is not how partners should be treated.
Find below responses to some of the statements:
The first step towards running the subsidy fund was creating the procurement framework for whitelisting security auditors for the DAO. As we mentioned in the Phase I Outcome Report, we began operations for ADPC Phase I from February 21, 2024, while the RFP process to whitelist auditors took place between June 19 and July 22, 2024.
During this period, the Foundation took more than a month to get back to us on our proposed framework (as mentioned in the Phase I Outcome Report), and ultimately told us that the legal terms would be redundant due to the Foundation having its own preferred model. This introduced significant delays into the process.
Moreover, the ADPC was ready to begin the Subsidy Fund even earlier and we announced the whitelisted security service providers in August - another month’s delay took place since the providers had to undergo KYB and sign the Head Agreement with the Foundation.
The ADPC took this feedback into consideration early on and onboarded DeDaub as a technical expert. This was based on feedback from the DAO and actioned immediately. DeDaub was funded for a total cost of 12K ARB, which we think is very fair for a technical party of their calibre.
If the Arbitrum Foundation preferred to use technical members at the AF to sense-check audit proposals, we would have been happy to implement this feedback had this been communicated to us.
Regardless, we think engaging a third-party audit expert as an impartial referee makes much more sense than involving technical AF members who do not have a keen view into the dynamics of the audit market.
This is not correct - the Foundation did not review a single application or was in any other way involved in the selection of projects. The Foundation was only involved in (1) an investigation of potential malicious behaviour (as they are the legal counterparty) and (2) aligning with ADPC on adherence to legal terms (as they are the legal counterparty).
For further questions, we will join the office hours later and then plan to refrain from further comments.
I am writing on behalf of the Arbitrum Governance Collective (AGC), a newly formed group of significant token holders focused on active participation in governance and value creation for the Arbitrum ecosystem.
Before addressing the proposal's structural flaws, we must address a critical credibility issue: The Foundation claims to be "heavily involved in the process of selecting which teams get the subsidy." The ADPC explicitly states this is false - that "the Foundation did not review a single application." One of these statements is untrue. Token holders deserve to know which version is accurate before being asked to trust the Foundation with $10M in DAO funds.
I am writing on behalf of the Arbitrum Governance Collective (AGC), a newly formed group of significant token holders focused on active participation in governance and value creation for the Arbitrum ecosystem.
Before addressing the proposal's structural flaws, we must address a critical credibility issue: The Foundation claims to be "heavily involved in the process of selecting which teams get the subsidy." The ADPC explicitly states this is false - that "the Foundation did not review a single application." One of these statements is untrue. Token holders deserve to know which version is accurate before being asked to trust the Foundation with $10M in DAO funds.
Let me outline our major concerns:
The Foundation proposes to run a $10M program with part-time, unpaid committee members "next to their everyday duties." This is frankly absurd. You don't run what you yourself call a "mission-critical" program as a side hobby. The proposed structure screams of inexperience in running professional investment operations.
The Foundation's claim they will "waive fees" is either naive or deliberately misleading. These costs will simply be absorbed into their DAO-funded operational budget. More concerning is the opportunity cost of running this critical program sub-optimally. One bad investment decision could cost multiples of any supposed savings.
The Foundation's fixation on "technical expertise" demonstrates a basic misunderstanding of what this program requires. What's needed is deep knowledge of the security services market and audit space - not generic technical knowledge. The ADPC demonstrated this understanding by engaging DeDaub, an established security firm. Why would a random technical person from the Foundation or OCL have more relevant expertise than actual auditing professionals? This misalignment of expertise requirements raises serious concerns about the Foundation's ability to even properly scope this program.
This is fundamentally an investment program requiring sophisticated venture capital and private equity experience in evaluating early-stage projects. The Foundation's emphasis on technical expertise while completely ignoring the need for investment acumen shows a fundamental misunderstanding of what drives successful project selection and portfolio management. Where is the venture capital expertise on their proposed committee? Who has experience managing comparable investment programs?
The Foundation states they have been "stepping in via our grant program to sponsor audits for builders over the past year." This raises serious governance concerns. The DAO funded the Foundation for specific operational purposes and the ADPC was explicitly voted in to manage audit subsidies. The Foundation's operational budget was not intended as a shadow grant program. While we appreciate the desire to support builders, this pattern of unilateral actions outside established governance frameworks and apparent repurposing of operational funds demands immediate scrutiny. We request:
Full transparency regarding these expenditures
Clarification on which operational budget lines were used
Explanation of how this aligns with their DAO-approved mandate
The Foundation's complete failure to coordinate internally is alarming. They were actively working with the ADPC on this exact initiative, received a detailed proposal, and then launched a competing proposal without any communication. This level of organizational dysfunction raises serious questions about their capacity to manage complex programs.
While the current ADPC structure has inefficiencies, we believe these primarily stem from the three-party structure and alignment with the Foundation. The solution isn't to add more bureaucracy - it's to streamline operations.
Our Solution:
Rather than allowing the Foundation to experiment with DAO funds or maintaining a complex multi-party structure, we propose selecting ONE premier service provider with:
Proven track record in initiative management
Established relationships with top audit firms
Clear accountability structure
Performance-based compensation alignment
Deep venture capital/private equity expertise
This is how professional investment operations work. Not through part-time committees, not through complex multi-party structures, and certainly not through foundation bureaucrats playing venture capitalist.
Questions the Foundation Must Answer:
Will you address the discrepancy between your claim of involvement in project selection and ADPC's statement?
Can you name a single successful program of this magnitude you've managed?
How do you justify running a $10M program as a part-time endeavor?
What governance framework guided your unilateral audit funding decisions?
We urge all token holders to vote NO on this proposal and support bringing in a qualified professional firm to manage this critical program.
The DAO deserves professional management of its resources, not amateur hour experiments with critical infrastructure.
Hi all, given the Foundation’s response concerning the ADPC, we thought it was important to respond and clarify the facts.
In regards to the Foundation's proposal, it needs to be mentioned that we shared a detailed proposal for continuing the Subsidy Fund — including a proposed $10M fund size and other specifics, such as a detailed scope — with the Foundation a week prior to their announcement to internalise the extension, and discussed it with them until the day they posted this Audit Program proposal.
Hi all, given the Foundation’s response concerning the ADPC, we thought it was important to respond and clarify the facts.
In regards to the Foundation's proposal, it needs to be mentioned that we shared a detailed proposal for continuing the Subsidy Fund — including a proposed $10M fund size and other specifics, such as a detailed scope — with the Foundation a week prior to their announcement to internalise the extension, and discussed it with them until the day they posted this Audit Program proposal.
We had also spent several weeks educating the Foundation on the operation of the framework, including a session in Bangkok with the core members of the team to walk through the tasks involved in running such a procurement framework and fund. On the basis of the feedback during that session, as well as strong support from the community, the industry and project teams involved in the initial 8 week run, we concluded that the ADPC was best placed to manage this for the DAO and prepared a proposal to submit last week.
The Foundation promised to get back with feedback, but instead posted this proposal by themselves without informing us. At no point in the past 12 months did the Foundation raise any concerns with us about ADPC operations, timeliness or cost effectiveness despite us having near daily communications with them. We strongly believe that the Foundation is a key stakeholder in the operation of the DAO and wanted to ensure they were not blindsided by any work being undertaken by the ADPC as poor communication between us could result in the DAO being ambushed by events. The ADPC is proud of its exemplary professionalism shown to date and are deeply troubled by any implications suggesting otherwise.
In summary it is incorrect to state that the DAO would not have had another subsidy fund - this was, in fact, on the horizon and we had planned on posting it imminently after receiving the Foundation’s feedback which, in the end, we never received.
We can discuss what it means to work for a DAO, the associated costs, and how pricing is determined among various stakeholders. However, we would have appreciated a more transparent communication process from the Foundation.
Respectfully, we can understand a business decision of wanting to run an ecosystem like a corporation and not a DAO. This is not what we are arguing against.
We, delegates, and other service providers have contributed to the ecosystem, effectively taking a bet on its success. This also means working together in a partnership. We understand the Foundation’s decision to internalise the DAO and its key initiatives run by service providers and would only ever want them success in continuing the innovative procurement models designed by the ADPC team.
More broadly, we think the Foundation’s expertise and resources (which the DAO has significantly funded) could be better utilised in spinning up programs that are not already tackled by contributors vs. going on a hiring sprint to internalise these functions.
Considering the history of the DAO and involvement of its participants (delegates and service providers) who have spent 2 years to try to get this experiment right, our strong preference is a continuation of the direct communication we had had with the Foundation until very recently as this shift by the Foundation to internalise a proposal that external contributors had been working on (and that the Foundation were aware of) could have resulted in a more streamlined approach and more seamless transition planning. The current approach is sub-optimal for the DAO, and we believe other delegates and ecosystem participants would tend to agree. The ADPC remains prepared to work with the Foundation on the understanding this can be done with mutual respect and transparency.
This is not an effort to challenge who runs the program, we are happy to support the transition to make sure the value we created is not lost, if the push to internalize continues.
Rather, we hope the Foundation will reconsider its overall communication and collaboration approach.
Otherwise, we are concerned it may lead to the offboarding of other remaining DAO contributors and delegates, who have long been the core of the ecosystem - as this is not how partners should be treated.
Find below responses to some of the statements:
The first step towards running the subsidy fund was creating the procurement framework for whitelisting security auditors for the DAO. As we mentioned in the Phase I Outcome Report, we began operations for ADPC Phase I from February 21, 2024, while the RFP process to whitelist auditors took place between June 19 and July 22, 2024.
During this period, the Foundation took more than a month to get back to us on our proposed framework (as mentioned in the Phase I Outcome Report), and ultimately told us that the legal terms would be redundant due to the Foundation having its own preferred model. This introduced significant delays into the process.
Moreover, the ADPC was ready to begin the Subsidy Fund even earlier and we announced the whitelisted security service providers in August - another month’s delay took place since the providers had to undergo KYB and sign the Head Agreement with the Foundation.
The ADPC took this feedback into consideration early on and onboarded DeDaub as a technical expert. This was based on feedback from the DAO and actioned immediately. DeDaub was funded for a total cost of 12K ARB, which we think is very fair for a technical party of their calibre.
If the Arbitrum Foundation preferred to use technical members at the AF to sense-check audit proposals, we would have been happy to implement this feedback had this been communicated to us.
Regardless, we think engaging a third-party audit expert as an impartial referee makes much more sense than involving technical AF members who do not have a keen view into the dynamics of the audit market.
This is not correct - the Foundation did not review a single application or was in any other way involved in the selection of projects. The Foundation was only involved in (1) an investigation of potential malicious behaviour (as they are the legal counterparty) and (2) aligning with ADPC on adherence to legal terms (as they are the legal counterparty).
For further questions, we will join the office hours later and then plan to refrain from further comments.
hey, please see details about how to apply as an audit firm, here: https://forum.arbitrum.foundation/t/arbitrum-audit-program-audit-firms-application-process/29245
hey, please see details about how to apply as an audit firm, here: https://forum.arbitrum.foundation/t/arbitrum-audit-program-audit-firms-application-process/29245
We'd like to thank everyone for their comments!
We have updated the main forum post with the following new sections:
We'd like to thank everyone for their comments!
We have updated the main forum post with the following new sections:
We have explicitly highlighted that we will not exchange all ARB to USD from the onset and perform an exchange periodically throughout the program’s duration. Additionally, relevant legal agreements will require any audited code to remain exclusive to Arbitrum for a fixed period of time.
We hope everyone can take this opportunity to review the changes, leave additional feedback, and hopefully we will be ready to put the proposal up for a vote next Thursday (13th March 2025)
Arbitrum Audit Program - Office Hours - 2025/03/03 12:57 EST - Recording - Google Drive here is the recording of yesterday’s office hours (3rd March). Only 2 delegates attended and there were no questions raised.
Quick heads up that the recording from the call today is restricted.
https://drive.google.com/file/d/1nnBbdk02VTDLFfDy-MMzmgm3rGx6fzrP/view?usp=drive_web
Here is the SimScore Report during the Snapshot Round of forum replies.
The visualization shows how community consensus has evolved from the Forum to Snapshot round:
Here is the SimScore Report during the Snapshot Round of forum replies.
The visualization shows how community consensus has evolved from the Forum to Snapshot round:
Stronger Preference for DAO Governance
Consistent Support for Audit Program Concept
Historical Context Recognition
The snapshot position approaches what appears to be a higher-value point on the curve - maintaining support for the program while showing stronger preference for DAO governance rather than Foundation control."
Top 10 Responses
Top 1 voting Against on the current offchain vote because I don’t agree with internalizing into the Arbitrum Foundation, a job that the DAO was previously doing. Even when the service providers doing that job for the DAO were taking too long, wasting resources, denying audit subsidies to worthy projects, porting the whole program to competing ecosystems, etc. I don’t condone the way the ADPC acted in their past 2 terms, but I also don’t think internalizing this job into the Foundation is the right approach. What I think we need is an Arbitrum DAO run, dedicated Audit Subsidy program, that would run continuously and would report their actions to the DAO with the utmost transparency possible. And executed by new and fresh service providers that are exclusive to Arbitrum. @paulofonseca
Top 2 The DAO currently lacks an active audit program, and launching this initiative at the earliest could be highly beneficial for the ecosystem. Based on our daily interactions with builders, audit support is one of the most frequently requested forms of assistance. The first iteration of the ADPC’s audit program was highly successful, and this new proposal builds on that foundation while addressing previous gaps. @Saurabh
Top 3 I think the Arbitrum Audit Program has a lot of potential and addresses an important need. Smart contract audits are essential, especially for early-stage projects that might not have the resources to afford them. Helping these teams launch securely not only protects users but also strengthens the entire Arbitrum ecosystem. I also appreciate the idea of offering subsidies as investments in some cases, which could help align projects with Arbitrum over the long term. @TodayInDeFi
Top 4 Overall, we believe that key, high-impact projects within the Arbitrum ecosystem should have the opportunity to be part of this initiative. This would allow the Audit Program not only to support the growth of new participants but also to strengthen the projects that currently contribute the most on-chain value. @Camelot
Top 5 Voted For: Controversy about this proposal comes from how this was handled and not the content of the proposal itself. From my understanding, the audit program at the moment doesn’t exist, which is a bad thing. For many new projects (especially DeFi), audits are a crucial and most expensive task to do before launch. To be a welcoming chain, it would be awesome to help high-end projects with this. This is the reason I voted and support this proposal. @Tekr0x.eth
Top 6 I think Arbitrum Audit Program will help new projects on Arbitrum pay for security audits, which are very expensive but very important. It will make sure smart contracts are safe and protect users’ money. @danielM
Top 7 Given ADPC’s track record, I am uncertain whether the Arbitrum Audit Program will be able to replicate or improve upon these ecosystem-building efforts. While this new program may enhance the technical side of audits, it is unclear if it will achieve the same level of community engagement, exposure, and long-term protocol support that ADPC has demonstrated. @TodayInDeFi
Top 8 Camelot is voting “Abstain” on the Arbitrum Audit Program. @Camelot
Top 9 While I see the potential benefits of this proposal, I remain uncertain about whether it will be a significant improvement over ADPC. The Arbitrum Foundation may have better technical expertise to optimize the audit selection and facilitation process, but ADPC has been exceptionally strong at ecosystem growth, marketing, and building lasting relationships with protocols. Additionally the cost savings is not enough that it’s a major deciding factor for this proposal. @TodayInDeFi
Top 10 I voted FOR the proposal on Snapshot. I’d like to add here that the Arbitrum DAO has recently begun the process of selecting Arbitrum’s strategic objectives (SOS). Eventually this will lead to initiatives that will help launch apps/projects on Arbitrum that align with these objectives. Why do I mention that? I hope Arbitrum Audit Committee will prioritize such projects and dApps. @TempeTechie
SimScore finds the center of collective thinking. The top responses by similarity represent the replies closest to the community's collective mindset.
The visualization above shows how this collective wisdom evolved from the open forum round to the Snapshot forum round.
Hi @KlausBrave,
The issue you bring up is affecting decision quality.
Another approach I have been experimenting with is unbiased aggregation of forum replies.
Here's a spreadsheet that calculates consensus priority of forum replies. In this case, forum replies from the Snapshot round are prioritized. The top 20 responses are displayed along with a relationship graph:
Hi @KlausBrave,
The issue you bring up is affecting decision quality.
Another approach I have been experimenting with is unbiased aggregation of forum replies.
Here's a spreadsheet that calculates consensus priority of forum replies. In this case, forum replies from the Snapshot round are prioritized. The top 20 responses are displayed along with a relationship graph:
https://docs.google.com/spreadsheets/d/10MoTxyT61Qn2beM61jxRaNL738LgXH3rJhXuNW7HyMA/edit?usp=sharing
Unbiased aggregation is considered necessary step of wisdom of crowds technology.
If proposers edited proposals bases on the aggregated forum feedback for each of the open, snapshot and Tally rounds, I feel decision quality would be improved because it would reflect the Delegates Wisdom.
Paul
We'd like to thank everyone for their comments!
We have updated the main forum post with the following new sections:
We'd like to thank everyone for their comments!
We have updated the main forum post with the following new sections:
We have explicitly highlighted that we will not exchange all ARB to USD from the onset and perform an exchange periodically throughout the program’s duration. Additionally, relevant legal agreements will require any audited code to remain exclusive to Arbitrum for a fixed period of time.
We hope everyone can take this opportunity to review the changes, leave additional feedback, and hopefully we will be ready to put the proposal up for a vote next Thursday (13th March 2025)
Arbitrum Audit Program - Office Hours - 2025/03/03 12:57 EST - Recording - Google Drive here is the recording of yesterday’s office hours (3rd March). Only 2 delegates attended and there were no questions raised.
Quick heads up that the recording from the call today is restricted.
https://drive.google.com/file/d/1nnBbdk02VTDLFfDy-MMzmgm3rGx6fzrP/view?usp=drive_web
Here is the SimScore Report during the Snapshot Round of forum replies.
The visualization shows how community consensus has evolved from the Forum to Snapshot round:
Here is the SimScore Report during the Snapshot Round of forum replies.
The visualization shows how community consensus has evolved from the Forum to Snapshot round:
Stronger Preference for DAO Governance
Consistent Support for Audit Program Concept
Historical Context Recognition
The snapshot position approaches what appears to be a higher-value point on the curve - maintaining support for the program while showing stronger preference for DAO governance rather than Foundation control."
Top 10 Responses
Top 1 voting Against on the current offchain vote because I don’t agree with internalizing into the Arbitrum Foundation, a job that the DAO was previously doing. Even when the service providers doing that job for the DAO were taking too long, wasting resources, denying audit subsidies to worthy projects, porting the whole program to competing ecosystems, etc. I don’t condone the way the ADPC acted in their past 2 terms, but I also don’t think internalizing this job into the Foundation is the right approach. What I think we need is an Arbitrum DAO run, dedicated Audit Subsidy program, that would run continuously and would report their actions to the DAO with the utmost transparency possible. And executed by new and fresh service providers that are exclusive to Arbitrum. @paulofonseca
Top 2 The DAO currently lacks an active audit program, and launching this initiative at the earliest could be highly beneficial for the ecosystem. Based on our daily interactions with builders, audit support is one of the most frequently requested forms of assistance. The first iteration of the ADPC’s audit program was highly successful, and this new proposal builds on that foundation while addressing previous gaps. @Saurabh
Top 3 I think the Arbitrum Audit Program has a lot of potential and addresses an important need. Smart contract audits are essential, especially for early-stage projects that might not have the resources to afford them. Helping these teams launch securely not only protects users but also strengthens the entire Arbitrum ecosystem. I also appreciate the idea of offering subsidies as investments in some cases, which could help align projects with Arbitrum over the long term. @TodayInDeFi
Top 4 Overall, we believe that key, high-impact projects within the Arbitrum ecosystem should have the opportunity to be part of this initiative. This would allow the Audit Program not only to support the growth of new participants but also to strengthen the projects that currently contribute the most on-chain value. @Camelot
Top 5 Voted For: Controversy about this proposal comes from how this was handled and not the content of the proposal itself. From my understanding, the audit program at the moment doesn’t exist, which is a bad thing. For many new projects (especially DeFi), audits are a crucial and most expensive task to do before launch. To be a welcoming chain, it would be awesome to help high-end projects with this. This is the reason I voted and support this proposal. @Tekr0x.eth
Top 6 I think Arbitrum Audit Program will help new projects on Arbitrum pay for security audits, which are very expensive but very important. It will make sure smart contracts are safe and protect users’ money. @danielM
Top 7 Given ADPC’s track record, I am uncertain whether the Arbitrum Audit Program will be able to replicate or improve upon these ecosystem-building efforts. While this new program may enhance the technical side of audits, it is unclear if it will achieve the same level of community engagement, exposure, and long-term protocol support that ADPC has demonstrated. @TodayInDeFi
Top 8 Camelot is voting “Abstain” on the Arbitrum Audit Program. @Camelot
Top 9 While I see the potential benefits of this proposal, I remain uncertain about whether it will be a significant improvement over ADPC. The Arbitrum Foundation may have better technical expertise to optimize the audit selection and facilitation process, but ADPC has been exceptionally strong at ecosystem growth, marketing, and building lasting relationships with protocols. Additionally the cost savings is not enough that it’s a major deciding factor for this proposal. @TodayInDeFi
Top 10 I voted FOR the proposal on Snapshot. I’d like to add here that the Arbitrum DAO has recently begun the process of selecting Arbitrum’s strategic objectives (SOS). Eventually this will lead to initiatives that will help launch apps/projects on Arbitrum that align with these objectives. Why do I mention that? I hope Arbitrum Audit Committee will prioritize such projects and dApps. @TempeTechie
SimScore finds the center of collective thinking. The top responses by similarity represent the replies closest to the community's collective mindset.
The visualization above shows how this collective wisdom evolved from the open forum round to the Snapshot forum round.
Hi @KlausBrave,
The issue you bring up is affecting decision quality.
Another approach I have been experimenting with is unbiased aggregation of forum replies.
Here's a spreadsheet that calculates consensus priority of forum replies. In this case, forum replies from the Snapshot round are prioritized. The top 20 responses are displayed along with a relationship graph:
Hi @KlausBrave,
The issue you bring up is affecting decision quality.
Another approach I have been experimenting with is unbiased aggregation of forum replies.
Here's a spreadsheet that calculates consensus priority of forum replies. In this case, forum replies from the Snapshot round are prioritized. The top 20 responses are displayed along with a relationship graph:
https://docs.google.com/spreadsheets/d/10MoTxyT61Qn2beM61jxRaNL738LgXH3rJhXuNW7HyMA/edit?usp=sharing
Unbiased aggregation is considered necessary step of wisdom of crowds technology.
If proposers edited proposals bases on the aggregated forum feedback for each of the open, snapshot and Tally rounds, I feel decision quality would be improved because it would reflect the Delegates Wisdom.
Paul
https://drive.google.com/file/d/1qY81BLCjMTNeXvOrtAt2dxDyoKCFCuFq/view?usp=sharing here is the link to the recording of today's office hours.
https://drive.google.com/file/d/1qY81BLCjMTNeXvOrtAt2dxDyoKCFCuFq/view?usp=sharing here is the link to the recording of today's office hours.
This analysis is based on SimScore-selected responses. SimScore analyzed all 261 forum responses and identified the top 10 most representative perspectives (similarity scores ranging 0.381-0.430). This algorithmic approach ensures we're working with the most relevant community feedback, removing potential bias in response selection.
This analysis is based on SimScore-selected responses. SimScore analyzed all 261 forum responses and identified the top 10 most representative perspectives (similarity scores ranging 0.381-0.430). This algorithmic approach ensures we're working with the most relevant community feedback, removing potential bias in response selection.
Using Vitalik Buterin's concave disposition framework, we visualized governance value distribution. The graph below shows:
| Point A | Point B | Red Dot | Blue Curve |
|---|---|---|---|
| Foundation Control | DAO Control | Current Proposal Position | Value Disposition |
Top 10 responses used in this analysis had similarity scores of:
Top 1
At this time, the DAO has no way of providing a security audit subsidy to projects, given that the previous subsidy fund from the ADPC has run out and there have been no steps to renew it. In our view, it makes sense for the Foundation to administer the security subsidy fund, given its position and proximity to both builders and Arbitrum’s tech.
@krst SimScore 43.0%
Top 2 The foundation has a grant program that can also include audits for what I know. This has been true and known since the very beginning. You can find more info here. Beside, in every ecosystem foundations have internal grant programs to sponsor protocols and builders. I agree tho that more transparency in this sense would be something good for the dao as well. @JoJo SimScore 42.7%
Top 3 One thing we’d like to point out about the proposal itself is that the Foundation will run the subsidy fund on behalf of the DAO using the DAO’s funds. As such, we’ll hold them to the same standard as any and all other contributors and service providers, and we actually expect them to be an example of what a DAO-funded program should look like. @krst SimScore 42.0%
Top 4
Besides, I don’t understand why the Arbitrum Foundation takes money for the program from DAO, and DAO barely participates in it.
@cp0x SimScore 41.5%
Top 5
The Foundation states they have been “stepping in via our grant program to sponsor audits for builders over the past year.” This raises serious governance concerns. The DAO funded the Foundation for specific operational purposes and the ADPC was explicitly voted in to manage audit subsidies. The Foundation’s operational budget was not intended as a shadow grant program. While we appreciate the desire to support builders, this pattern of unilateral actions outside established governance frameworks and apparent repurposing of operational funds demands immediate scrutiny. We request:
@Q12 SimScore 40.7%
Top 6 Considering the history of the DAO and involvement of its participants (delegates and service providers) who have spent 2 years to try to get this experiment right, our strong preference is a continuation of the direct communication we had had with the Foundation until very recently as this shift by the Foundation to internalise a proposal that external contributors had been working on (and that the Foundation were aware of) could have resulted in a more streamlined approach and more seamless transition planning. The current approach is sub-optimal for the DAO, and we believe other delegates and ecosystem participants would tend to agree. The ADPC remains prepared to work with the Foundation on the understanding this can be done with mutual respect and transparency. @adpc SimScore 40.7%
Top 7 I think we could give money for audit projects together with the AVI (Arbitrum Venture Initiative) project. @cp0x SimScore 39.4%
Top 8 I really like this proposal. Audit costs are a significant barrier to entry for early-stage projects, and subsidizing them for valuable teams is a highly effective way to support builders in the Arbitrum ecosystem. Security is critical, especially for new projects, and reducing the financial burden of audits will help ensure that promising teams can launch safely without cutting corners. @bertani SimScore 39.0%
Top 9 Thank you for posting a well-structured proposal. It is very straightforward. Overall, I like the idea of helping projects cover audit costs, especially the projects that have good potential for Arbitrum. I do have some concerns about a few points of the proposal. Tek0x.eth SimScore 39.0%
Top 10 We would also like to emphasize that we see this program as a BD initiative that should first and foremost drive the growth of the Arbitrum ecosystem. Therefore, we expect that whoever the OCL and AF representatives will be in the committee, they will coordinate internally to make sure that the projects selected to receive audit grants are in line with Arbitrum’s long-term growth strategy. @krst SimScore 38.4%
SimScore Worksheets https://docs.google.com/spreadsheets/d/1G4OnDFY93SQ_wVuGnx79_vsPLSng5iYMmEwGsn3QTdI/edit?usp=sharing
Hopefully! L2Beat mentioned on the call that they will be dropping feedback. It might depend on their questions and whether we can get answers for them on time.
The ADPC's post was published 5 minutes before the governance call yesterday and led to a discussion during the governance call. The discussion lasted about ~40 minutes.
The AF acknowledged that Patrick (who authored this proposal) was unaware of the ADPC's plan to run another subsidy program and had been working on the proposal for a few weeks (since mid-January). The AF governance team received the ADPC's proposal 2 days prior to the AF posting their own version and it was not yet reviewed by Patrick / the governance team. Patrick had communicated with some delegates on a call that the AF was working on an audit program and that it was due to be published in the coming days. On hindsight, he should have communicated to the ADPC that the AF was working on a subsidy program.
The ADPC's post was published 5 minutes before the governance call yesterday and led to a discussion during the governance call. The discussion lasted about ~40 minutes.
The AF acknowledged that Patrick (who authored this proposal) was unaware of the ADPC's plan to run another subsidy program and had been working on the proposal for a few weeks (since mid-January). The AF governance team received the ADPC's proposal 2 days prior to the AF posting their own version and it was not yet reviewed by Patrick / the governance team. Patrick had communicated with some delegates on a call that the AF was working on an audit program and that it was due to be published in the coming days. On hindsight, he should have communicated to the ADPC that the AF was working on a subsidy program.
There were also discussions behind why the program had been delayed, but the general conclusion (from our perspective) was that the ADPC might be better suited to focus on topics and procurement that matches their core competencies as this will empower them to run with initiatives without relying on third parties. Topics that are very technical in nature, like this subsidy fund, might be best handled by the AF / OCL / OpCo.
There are two more planned governance calls (on 24th Feb and 3rd Mar) for the auditing program already. The topic could be rehashed, but generally, it is good to focus on the content of this proposal so we can make sure it has the best chance of success.
Before moving forward with the details, I’d love to hear your thoughts on the Subsidy Fund implemented by the ADPC. Do you think it was well executed? What is your opinion on the results? And why do you propose making such a drastic change to that model instead of, for instance, suggesting that this new committee execute the v2?
There are a few reasons why we believe it is better for the AF (or potentially the future OpCo, when it is up and running) to take on the work for the security subsidy fund and allow the procurement committee to pursue other initiatives:
This analysis is based on SimScore-selected responses. SimScore analyzed all 261 forum responses and identified the top 10 most representative perspectives (similarity scores ranging 0.381-0.430). This algorithmic approach ensures we're working with the most relevant community feedback, removing potential bias in response selection.
This analysis is based on SimScore-selected responses. SimScore analyzed all 261 forum responses and identified the top 10 most representative perspectives (similarity scores ranging 0.381-0.430). This algorithmic approach ensures we're working with the most relevant community feedback, removing potential bias in response selection.
Using Vitalik Buterin's concave disposition framework, we visualized governance value distribution. The graph below shows:
| Point A | Point B | Red Dot | Blue Curve |
|---|---|---|---|
| Foundation Control | DAO Control | Current Proposal Position | Value Disposition |
Top 10 responses used in this analysis had similarity scores of:
Top 1
At this time, the DAO has no way of providing a security audit subsidy to projects, given that the previous subsidy fund from the ADPC has run out and there have been no steps to renew it. In our view, it makes sense for the Foundation to administer the security subsidy fund, given its position and proximity to both builders and Arbitrum’s tech.
@krst SimScore 43.0%
Top 2 The foundation has a grant program that can also include audits for what I know. This has been true and known since the very beginning. You can find more info here. Beside, in every ecosystem foundations have internal grant programs to sponsor protocols and builders. I agree tho that more transparency in this sense would be something good for the dao as well. @JoJo SimScore 42.7%
Top 3 One thing we’d like to point out about the proposal itself is that the Foundation will run the subsidy fund on behalf of the DAO using the DAO’s funds. As such, we’ll hold them to the same standard as any and all other contributors and service providers, and we actually expect them to be an example of what a DAO-funded program should look like. @krst SimScore 42.0%
Top 4
Besides, I don’t understand why the Arbitrum Foundation takes money for the program from DAO, and DAO barely participates in it.
@cp0x SimScore 41.5%
Top 5
The Foundation states they have been “stepping in via our grant program to sponsor audits for builders over the past year.” This raises serious governance concerns. The DAO funded the Foundation for specific operational purposes and the ADPC was explicitly voted in to manage audit subsidies. The Foundation’s operational budget was not intended as a shadow grant program. While we appreciate the desire to support builders, this pattern of unilateral actions outside established governance frameworks and apparent repurposing of operational funds demands immediate scrutiny. We request:
@Q12 SimScore 40.7%
Top 6 Considering the history of the DAO and involvement of its participants (delegates and service providers) who have spent 2 years to try to get this experiment right, our strong preference is a continuation of the direct communication we had had with the Foundation until very recently as this shift by the Foundation to internalise a proposal that external contributors had been working on (and that the Foundation were aware of) could have resulted in a more streamlined approach and more seamless transition planning. The current approach is sub-optimal for the DAO, and we believe other delegates and ecosystem participants would tend to agree. The ADPC remains prepared to work with the Foundation on the understanding this can be done with mutual respect and transparency. @adpc SimScore 40.7%
Top 7 I think we could give money for audit projects together with the AVI (Arbitrum Venture Initiative) project. @cp0x SimScore 39.4%
Top 8 I really like this proposal. Audit costs are a significant barrier to entry for early-stage projects, and subsidizing them for valuable teams is a highly effective way to support builders in the Arbitrum ecosystem. Security is critical, especially for new projects, and reducing the financial burden of audits will help ensure that promising teams can launch safely without cutting corners. @bertani SimScore 39.0%
Top 9 Thank you for posting a well-structured proposal. It is very straightforward. Overall, I like the idea of helping projects cover audit costs, especially the projects that have good potential for Arbitrum. I do have some concerns about a few points of the proposal. Tek0x.eth SimScore 39.0%
Top 10 We would also like to emphasize that we see this program as a BD initiative that should first and foremost drive the growth of the Arbitrum ecosystem. Therefore, we expect that whoever the OCL and AF representatives will be in the committee, they will coordinate internally to make sure that the projects selected to receive audit grants are in line with Arbitrum’s long-term growth strategy. @krst SimScore 38.4%
SimScore Worksheets https://docs.google.com/spreadsheets/d/1G4OnDFY93SQ_wVuGnx79_vsPLSng5iYMmEwGsn3QTdI/edit?usp=sharing
Hopefully! L2Beat mentioned on the call that they will be dropping feedback. It might depend on their questions and whether we can get answers for them on time.
The ADPC's post was published 5 minutes before the governance call yesterday and led to a discussion during the governance call. The discussion lasted about ~40 minutes.
The AF acknowledged that Patrick (who authored this proposal) was unaware of the ADPC's plan to run another subsidy program and had been working on the proposal for a few weeks (since mid-January). The AF governance team received the ADPC's proposal 2 days prior to the AF posting their own version and it was not yet reviewed by Patrick / the governance team. Patrick had communicated with some delegates on a call that the AF was working on an audit program and that it was due to be published in the coming days. On hindsight, he should have communicated to the ADPC that the AF was working on a subsidy program.
The ADPC's post was published 5 minutes before the governance call yesterday and led to a discussion during the governance call. The discussion lasted about ~40 minutes.
The AF acknowledged that Patrick (who authored this proposal) was unaware of the ADPC's plan to run another subsidy program and had been working on the proposal for a few weeks (since mid-January). The AF governance team received the ADPC's proposal 2 days prior to the AF posting their own version and it was not yet reviewed by Patrick / the governance team. Patrick had communicated with some delegates on a call that the AF was working on an audit program and that it was due to be published in the coming days. On hindsight, he should have communicated to the ADPC that the AF was working on a subsidy program.
There were also discussions behind why the program had been delayed, but the general conclusion (from our perspective) was that the ADPC might be better suited to focus on topics and procurement that matches their core competencies as this will empower them to run with initiatives without relying on third parties. Topics that are very technical in nature, like this subsidy fund, might be best handled by the AF / OCL / OpCo.
There are two more planned governance calls (on 24th Feb and 3rd Mar) for the auditing program already. The topic could be rehashed, but generally, it is good to focus on the content of this proposal so we can make sure it has the best chance of success.
Before moving forward with the details, I’d love to hear your thoughts on the Subsidy Fund implemented by the ADPC. Do you think it was well executed? What is your opinion on the results? And why do you propose making such a drastic change to that model instead of, for instance, suggesting that this new committee execute the v2?
There are a few reasons why we believe it is better for the AF (or potentially the future OpCo, when it is up and running) to take on the work for the security subsidy fund and allow the procurement committee to pursue other initiatives:
Before moving forward with the details, I’d love to hear your thoughts on the Subsidy Fund implemented by the ADPC. Do you think it was well executed? What is your opinion on the results? And why do you propose making such a drastic change to that model instead of, for instance, suggesting that this new committee execute the v2?
There are a few reasons why we believe it is better for the AF (or potentially the future OpCo, when it is up and running) to take on the work for the security subsidy fund and allow the procurement committee to pursue other initiatives:
It took around ~10 months to stand up and complete the 8 week program. Unfortunately, this meant there was no security subsidy fund by the ArbitrumDAO for most of 2024. Due to this shortcoming, (the AF) have stepped in via our grant program to sponsor audits for builders over the past year. Furthermore, ADPC is now focused on RPC providers until April 2025 and has also included multiple other work packages in its scope for this term. This implies the DAO will not have a subsidy fund for a further few months.
We believe the security subsidy fund is essential for supporting early stage builders and it should be stood up as soon as possible. We (Arbitrum) cannot afford to further delay a fully fledged program that is openly available at any time.
The ADPC’s membership lacks the technical expertise to evaluate applications for a security subsidy program and will need to fund external parties for assistance. We’d recommend the DAO approve programs that match the ADPC’s core competencies so they can have a greater impact without relying on third parties.
We believe this is a very high overhead to pay for running a $10m security subsidy program. At $720k per year, the AF or upcoming OpCo can hire full time staff to run this alongside other programs that we all deem as mission critical for Arbitrum.
Our increased involvement was a sign that it may be better for the ADPC to focus on topics that match their core competencies and not necessarily run an audit subsidy program. Additionally, if we are expected to carry on the continuation of a framework and execute it on behalf of others, then we (AF) should just set it up ourselves.
Are there any lessons from that experience that could be applied?
Yes, some of the lessons we can share:
Funds up front. The ADPC started in February, but only got the funds in July 2025 as there was a requirement to go back to the DAO’s voting process to request the funds. The lesson here is to ensure the DAO allocates funds to new programs and enable it to get started more quickly.
Technical expertise. Evaluating the cost of an audit requires domain expertise and it is not something a general committee is well-suited for handling. This is why we have put forth this proposal as we can request technical members at the AF and OCL to evaluate audit proposals.
Services in kind. Some audit firms prefer to not charge a project for the audit in return for tokens/equity later. We should be explicit on whether this type of behaviour should be allowed as it can be beneficial to early-stage projects, but also potentially unfair for competing audit firms.
Flexibility in scope. After agreements were made between all parties, many projects/auditors also wanted to change the scope of the audits, and requested different terms, accordingly. Flexibility is possible when there is an on-going application process as opposed to the 8-week trial that effectively allocated the entire budget all at once.
Towards fixed rates. All auditors have different costs, but for each auditor, we should work towards a fixed cost of “per auditor week”, so all projects can benefit from discounted rates.
We think this proposal is valuable, though we see some possible issues. The ARDC v1 saw an issue where proposals would come to the security member to audit contracts for new protocols. Similarly, we can see some issue where these protocols receive auditing work, launch on Arbitrum, but then do the bare minimum in ecosystem management and development after launch, while prioritizing other L2s (eg. Base). With this in mind, does it make sense to have this structure for all apps or for only specific applications (i.e., those built with Stylus) and structure the committee differently for other types of applications, or make a priority pathway instead?
We’d avoid overcomplicating the structure of the committee for other type of applications. The motivation to pick team members from AF or OCL is to take advantage of the domain expertise across the organisations. If there is an application that the committee alone cannot evaluate, then they can request assistance from the wider organisation.
On the final point, how to avoid projects getting a grant and then launching on another chain, this is generally the same problem that all grant programs encounter:
However, for the most part, it is more of an art than a science to avoid the above issue.
Furthermore, could we have some elaboration on the option for investment offered by the subsidy? How would this agreement work, what does DAO involvement look like here, etc? We understand that it may be more difficult to lock in apps (and that the auditing program may not be the right place to bundle this), though it is worth noting.
The AF will perform the investment on behalf of the ArbitrumDAO. We decided to include investing as an option in the program to ensure that if an investment makes sense, then we will be able to do it for the community.
Also, on what metrics should we evaluate the success of this program? Projects safely launched on Arbitrum and consistently used?
The metrics should be 1) how many projects that received a subsidy eventually launched on Arbitrum, 2) the growth of each project relative to similar deployments on other chains, 3) the total funds secured and 4) total funds lost due to smart contract vulnerabilities.
Note, it is always worth keeping in mind, audits are not full-proof to avoid bugs, and the main metric is supporting new projects to launch on Arbitrum with some sanity checking by experts and ultimately trying to avoid projects from being forced to ‘test in production.’
Converting 30M ARB to USD immediately is not the play here coz it creates unnecessary sell pressure.
It is a 1 year program and we will not be converting the ARB to USD upfront.
Our goal is to minimize the total ARB that is exchanged and 30m ARB is just a very conservative estimate for the total budget based on the current exchange rate.
How about this solution: can we take obligations from sponsored projects to remain in the Arbitrum ecosystem? And if they want to leave the ecosystem, they will have to return the money spent on the audit and preferably in Arbitrum tokens. I think this would avoid additional risks
We expect to add exclusivity clauses to nearly all agreements for new projects who have not yet launched or existing projects whenever it is reasonably doable.
In the last iteration of the security subsidy funds, there was a committee that made projects compile a rather long (as far as I can read) form, that resulted in some protocols being selected and others not with criteria that were not super clear… How would it work here? Can existing projects already apply?
We will have an application process and example questions/information requested is already outlined in the proposal. This will be used to help us screen the project before performing more due diligence. All projects will be welcome to apply, but we will prioritise early stage projects or projects that really require the financial assistance.
How will the application process work for projects applying? Will communication with the projects and selection decisions be made publicly, similar to how the Questbook DDA and Stylus Sprint rounds were handled, as they have set a good standard for this?
Many early stage projects will still be in stealth mode when they apply for the audit program and will not want to publicly disclose their audit details. Additionally, we expect this program to be very popular, and many projects who apply will not be accepted simply due to volume & grants available. We are expecting the applications to remain private, but the winners to be announced.
Just to clarify, multiple auditors will be chosen, right? We assume that no single audit firm will dominate the program. Will there be a cap on the number of projects any individual auditor can take on to ensure diversity and prevent monopolization?
Yes, the intention is to have auditors compete amongst each other for the project, hopefully leading to better prices for the project. We should avoid caps to ensure the marketplace remains competitive, but will also ensure that there is not a monopoly.
Also, will there be a marketing push to ensure more projects are aware of it? The success of this program also depends on outreach. Visibility could help attract high-quality projects to apply and build on Arbitrum.
The AF will focus significant resources to market this to all projects building on Arbitrum. As you mention, our goal is to get high quality projects, so they need to be aware of this program!
How are teams determined to be eligible for this support? I think its good that its removing that financial barrier from those teams but we should be a tad cautious not to overspend and audit every team.
We put together a list of points that we will evaluate like team background, likelihood of success, etc. There are not enough funds to audit every project. Additionally, we believe it is better to return funds to the DAO than to overspend it / make sure the full budget is exhausted on projects we do not believe will ‘make it’.
You are talking about a long term perspective and setting a budget for only 1 year. In my opinion, this is not a long term perspective and Arbitrum already had a program of audit compensation during the year. How is this program better?
All DAO programs should have an expiry time to ensure the authors have to return to the DAO, show results, and then continue the program. We set the expiry time to 1 year with the option to continue via a snapshot vote if there are still funds available. In regards to ADPC program, we have put an answer at the top of this post :)
I think this budget is greatly overstated. I don’t see 100 projects a year that Arbitrum needs so much that we are ready to give them 30 million ARB. Will we proceed from how much money we have or from what projects we need?
100 projects is an illustration to simply show the number of audit subsidies a $10m budget can cover. However, there are hundreds of projects that will likely apply to this program. The committee’s job is to spot the winners that can move the needle for Arbitrum and ensure they are supported. We do not have a metric to sponsor ‘100 projects in 1 year’ and will only sponsor projects that require the assistance.
Differentiation from ADPC Subsidy Fund: Could you elaborate on how this new program significantly improves upon the revised ADPC Subsidy Fund? What specific shortcomings of the previous program does this address?
There was a simpler question before and we provided an answer earlier in this post.
Timing and Evaluation: The ADPC has announced that they will be posting the Subsidy Fund Outcome report (ADPC Update Thread (Phase II) - #22 by sid_areta) in the coming days. Wouldn’t it be prudent to wait for this report before proceeding with a similar program / giving final shape to a new one? This would allow us to learn from issues of the previous program, identify areas for improvement and ensure we’re not duplicating efforts unnecessarily.
We (the AF) were heavily involved in the ADPC’s security subsidy program and how the funds were allocated. So, we are aware of several lessons learnt that can be applied to this program. The report will be helpful to the wider DAO and it should be publicly available before we reach the on-chain voting stage.
What is the criteria for the election and for onboarding the auditors? There will be a request for a commitment from the auditors to have “X” hours available? One thing is to be part of a “whitelist” with no real commitment, and a different thing is to be aligned with the DAO and have manpower available.
We do not expect an auditor to participate in the program if they are not able to commit time to audit projects. Additionally, if they do not audit any projects, then they will be removed from the whitelist.
Can you share the expected skills/knowledge for both this elected member and the auditors?
We expect the elected member to have a strong technical background with experience of writing smart contracts and obtaining audits for their own project in the past. In regards to auditors, we plan to only accept reputable firms.
Can you share more details about the threshold between grant/investment? Who will decide that? The Audit Commitee?
It’ll be decided by the Audit committee, but the difference in grant or investment will really come down to the individual project and their subsidy request. We do not believe it is wise to advertise or commit to a threshold in advance.
I would like to echo these questions raised by pedrob, which immediately came to mind while reading this proposal. Introducing this new audit program while barely mentioning the ADPC's security subsidy fund, and the lessons learned from those experiences, seems odd.
Before moving forward with the details, I’d love to hear your thoughts on the Subsidy Fund implemented by the ADPC. Do you think it was well executed? What is your opinion on the results? And why do you propose making such a drastic change to that model instead of, for instance, suggesting that this new committee execute the v2?
Are there any lessons from that experience that could be applied?
While we work through the remaining questions, the updated target Snapshot date is now February 20th.
Thanks for the feedback so far!
- In my opinion, auditing firms are known for their “dynamic” pricing. Prices vary quite a lot depending on the type of project (for example: is the project well-funded by VC? Does it have known teams or partners endorsing the project? etc.). I am afraid we will not get fair pricing since the client here is Arbitrum. How can we make sure that we get fair pricing?
Thanks for the feedback so far!
- In my opinion, auditing firms are known for their “dynamic” pricing. Prices vary quite a lot depending on the type of project (for example: is the project well-funded by VC? Does it have known teams or partners endorsing the project? etc.). I am afraid we will not get fair pricing since the client here is Arbitrum. How can we make sure that we get fair pricing?
It'll be up to the council, and the wider Arbitrum Foundation, to make sure that prices negotiated are fair relative to the skills / offerings of the auditor. We have experience with these types of negotiations already and expect it to go reasonably well.
Additionally, we anticipate the program to be competitive amongst auditors, so we will always seek to matchmake projects with auditors who offer the best value for money (without compromising on quality).
- I suggest inviting multiple auditing firms and run some kind of bidding process for each project. I would suggest the “Sealed bid” method or something similar. What do you think about this idea?
During the matchmaking phase, it is quite common for a project to retrieve quotes from different audit providers. It is "sort of" like a sealed bid auction, since the project shouldn't share the quotes with the competitors.
- Is it realistic for a team of 3 committee members (while 2 of them are not being paid for this) working part-time to vet 100 projects? We are talking about paying up to $100k to audit one project, which is a significant amount. How can we make sure to really support the right projects? Maybe expand to 5 committee members?
Committee members will be responsible for evaluating the projects and ultimately making decisions, but the AF will take on the operational and volume work. We expect 3 committee members to be sufficient for running the program.
- I think with the power and reputation of Arbitrum DAO, we can ask audit firms to be paid in ARB tokens (instead of selling to USD). This would lower the selling pressure. Since the price of ARB tokens is low, they might even hold it for some time or even better; get involved in governance.
Service providers typically quote their services in USD. We can have a combination of USD and ARB for alignment, but we generally can’t force service providers to accept ARB only.
From the pool of relevant auditors, who will be responsible for selecting the final one for each project? Will it be the committee or the project? I’m not entirely clear on who will make the final decision.
All auditors must be pre-approved for the program. This will predominantly be performed by the Arbitrum Foundation with support of the council members. Will clarify this in the proposal.
Also, is there a clear maximum amount per project that will be spent on auditing? The 100K assumption per project seems rather vague. I believe there should be a maximum amount, and even a maximum percentage for the cost subsidy everyone should have skin on the game.
We decided against a maximum cap in favour of offering the option to invest in projects as opposed to simply grants. If there is a subsidy that is larger than normal, it could be issued as an investment, and ultimately help align the project with the Arbitrum ecosystem. In nearly all cases, projects will also be expected to have skin in the game and pay for a portion of the audit.
Will this be converted immediately, or on an ongoing basis as needed? i suggest this is ongoing to reduce selling preassure.
It is a year-long program; so there is no requirement to exchange the funds immediately.
funding projects that then migrate to other ecos => why not make these audits some sort of investment or what sort of mitigation can be put in place?
In the proposal, we are offering the option to also use the subsidy to invest in the project, although we'd prefer if the project made its own in Arbitrum first :)
How are projects selected? there can be a lot of failures with early stage projects => having more structured programs for systematic validation and derisking (like e.g. the Hackathon Continuation Program) could mitigate this risk. Otherwise requiring some sort of traction in a PoC, letters of intent to purchase if B2B, or doing DD on validation… tricky.
In the proposal, it mentions the committee will screen based on scope, likelihood of success, team experience, due diligence of the tech, etc. Behind the scenes, it will form a matrix that will score the project and offer confidence that the project should be eligible to receive a subsidy.
Of course, like any selection process, the final decision will depend on whether the committee believes the project is likely to get product market fit and the team is truly focused on building for the long term.
Before moving forward with the details, I’d love to hear your thoughts on the Subsidy Fund implemented by the ADPC. Do you think it was well executed? What is your opinion on the results? And why do you propose making such a drastic change to that model instead of, for instance, suggesting that this new committee execute the v2?
There are a few reasons why we believe it is better for the AF (or potentially the future OpCo, when it is up and running) to take on the work for the security subsidy fund and allow the procurement committee to pursue other initiatives:
It took around ~10 months to stand up and complete the 8 week program. Unfortunately, this meant there was no security subsidy fund by the ArbitrumDAO for most of 2024. Due to this shortcoming, (the AF) have stepped in via our grant program to sponsor audits for builders over the past year. Furthermore, ADPC is now focused on RPC providers until April 2025 and has also included multiple other work packages in its scope for this term. This implies the DAO will not have a subsidy fund for a further few months.
We believe the security subsidy fund is essential for supporting early stage builders and it should be stood up as soon as possible. We (Arbitrum) cannot afford to further delay a fully fledged program that is openly available at any time.
The ADPC’s membership lacks the technical expertise to evaluate applications for a security subsidy program and will need to fund external parties for assistance. We’d recommend the DAO approve programs that match the ADPC’s core competencies so they can have a greater impact without relying on third parties.
We believe this is a very high overhead to pay for running a $10m security subsidy program. At $720k per year, the AF or upcoming OpCo can hire full time staff to run this alongside other programs that we all deem as mission critical for Arbitrum.
Our increased involvement was a sign that it may be better for the ADPC to focus on topics that match their core competencies and not necessarily run an audit subsidy program. Additionally, if we are expected to carry on the continuation of a framework and execute it on behalf of others, then we (AF) should just set it up ourselves.
Are there any lessons from that experience that could be applied?
Yes, some of the lessons we can share:
Funds up front. The ADPC started in February, but only got the funds in July 2025 as there was a requirement to go back to the DAO’s voting process to request the funds. The lesson here is to ensure the DAO allocates funds to new programs and enable it to get started more quickly.
Technical expertise. Evaluating the cost of an audit requires domain expertise and it is not something a general committee is well-suited for handling. This is why we have put forth this proposal as we can request technical members at the AF and OCL to evaluate audit proposals.
Services in kind. Some audit firms prefer to not charge a project for the audit in return for tokens/equity later. We should be explicit on whether this type of behaviour should be allowed as it can be beneficial to early-stage projects, but also potentially unfair for competing audit firms.
Flexibility in scope. After agreements were made between all parties, many projects/auditors also wanted to change the scope of the audits, and requested different terms, accordingly. Flexibility is possible when there is an on-going application process as opposed to the 8-week trial that effectively allocated the entire budget all at once.
Towards fixed rates. All auditors have different costs, but for each auditor, we should work towards a fixed cost of “per auditor week”, so all projects can benefit from discounted rates.
We think this proposal is valuable, though we see some possible issues. The ARDC v1 saw an issue where proposals would come to the security member to audit contracts for new protocols. Similarly, we can see some issue where these protocols receive auditing work, launch on Arbitrum, but then do the bare minimum in ecosystem management and development after launch, while prioritizing other L2s (eg. Base). With this in mind, does it make sense to have this structure for all apps or for only specific applications (i.e., those built with Stylus) and structure the committee differently for other types of applications, or make a priority pathway instead?
We’d avoid overcomplicating the structure of the committee for other type of applications. The motivation to pick team members from AF or OCL is to take advantage of the domain expertise across the organisations. If there is an application that the committee alone cannot evaluate, then they can request assistance from the wider organisation.
On the final point, how to avoid projects getting a grant and then launching on another chain, this is generally the same problem that all grant programs encounter:
However, for the most part, it is more of an art than a science to avoid the above issue.
Furthermore, could we have some elaboration on the option for investment offered by the subsidy? How would this agreement work, what does DAO involvement look like here, etc? We understand that it may be more difficult to lock in apps (and that the auditing program may not be the right place to bundle this), though it is worth noting.
The AF will perform the investment on behalf of the ArbitrumDAO. We decided to include investing as an option in the program to ensure that if an investment makes sense, then we will be able to do it for the community.
Also, on what metrics should we evaluate the success of this program? Projects safely launched on Arbitrum and consistently used?
The metrics should be 1) how many projects that received a subsidy eventually launched on Arbitrum, 2) the growth of each project relative to similar deployments on other chains, 3) the total funds secured and 4) total funds lost due to smart contract vulnerabilities.
Note, it is always worth keeping in mind, audits are not full-proof to avoid bugs, and the main metric is supporting new projects to launch on Arbitrum with some sanity checking by experts and ultimately trying to avoid projects from being forced to ‘test in production.’
Converting 30M ARB to USD immediately is not the play here coz it creates unnecessary sell pressure.
It is a 1 year program and we will not be converting the ARB to USD upfront.
Our goal is to minimize the total ARB that is exchanged and 30m ARB is just a very conservative estimate for the total budget based on the current exchange rate.
How about this solution: can we take obligations from sponsored projects to remain in the Arbitrum ecosystem? And if they want to leave the ecosystem, they will have to return the money spent on the audit and preferably in Arbitrum tokens. I think this would avoid additional risks
We expect to add exclusivity clauses to nearly all agreements for new projects who have not yet launched or existing projects whenever it is reasonably doable.
In the last iteration of the security subsidy funds, there was a committee that made projects compile a rather long (as far as I can read) form, that resulted in some protocols being selected and others not with criteria that were not super clear… How would it work here? Can existing projects already apply?
We will have an application process and example questions/information requested is already outlined in the proposal. This will be used to help us screen the project before performing more due diligence. All projects will be welcome to apply, but we will prioritise early stage projects or projects that really require the financial assistance.
How will the application process work for projects applying? Will communication with the projects and selection decisions be made publicly, similar to how the Questbook DDA and Stylus Sprint rounds were handled, as they have set a good standard for this?
Many early stage projects will still be in stealth mode when they apply for the audit program and will not want to publicly disclose their audit details. Additionally, we expect this program to be very popular, and many projects who apply will not be accepted simply due to volume & grants available. We are expecting the applications to remain private, but the winners to be announced.
Just to clarify, multiple auditors will be chosen, right? We assume that no single audit firm will dominate the program. Will there be a cap on the number of projects any individual auditor can take on to ensure diversity and prevent monopolization?
Yes, the intention is to have auditors compete amongst each other for the project, hopefully leading to better prices for the project. We should avoid caps to ensure the marketplace remains competitive, but will also ensure that there is not a monopoly.
Also, will there be a marketing push to ensure more projects are aware of it? The success of this program also depends on outreach. Visibility could help attract high-quality projects to apply and build on Arbitrum.
The AF will focus significant resources to market this to all projects building on Arbitrum. As you mention, our goal is to get high quality projects, so they need to be aware of this program!
How are teams determined to be eligible for this support? I think its good that its removing that financial barrier from those teams but we should be a tad cautious not to overspend and audit every team.
We put together a list of points that we will evaluate like team background, likelihood of success, etc. There are not enough funds to audit every project. Additionally, we believe it is better to return funds to the DAO than to overspend it / make sure the full budget is exhausted on projects we do not believe will ‘make it’.
You are talking about a long term perspective and setting a budget for only 1 year. In my opinion, this is not a long term perspective and Arbitrum already had a program of audit compensation during the year. How is this program better?
All DAO programs should have an expiry time to ensure the authors have to return to the DAO, show results, and then continue the program. We set the expiry time to 1 year with the option to continue via a snapshot vote if there are still funds available. In regards to ADPC program, we have put an answer at the top of this post :)
I think this budget is greatly overstated. I don’t see 100 projects a year that Arbitrum needs so much that we are ready to give them 30 million ARB. Will we proceed from how much money we have or from what projects we need?
100 projects is an illustration to simply show the number of audit subsidies a $10m budget can cover. However, there are hundreds of projects that will likely apply to this program. The committee’s job is to spot the winners that can move the needle for Arbitrum and ensure they are supported. We do not have a metric to sponsor ‘100 projects in 1 year’ and will only sponsor projects that require the assistance.
Differentiation from ADPC Subsidy Fund: Could you elaborate on how this new program significantly improves upon the revised ADPC Subsidy Fund? What specific shortcomings of the previous program does this address?
There was a simpler question before and we provided an answer earlier in this post.
Timing and Evaluation: The ADPC has announced that they will be posting the Subsidy Fund Outcome report (ADPC Update Thread (Phase II) - #22 by sid_areta) in the coming days. Wouldn’t it be prudent to wait for this report before proceeding with a similar program / giving final shape to a new one? This would allow us to learn from issues of the previous program, identify areas for improvement and ensure we’re not duplicating efforts unnecessarily.
We (the AF) were heavily involved in the ADPC’s security subsidy program and how the funds were allocated. So, we are aware of several lessons learnt that can be applied to this program. The report will be helpful to the wider DAO and it should be publicly available before we reach the on-chain voting stage.
What is the criteria for the election and for onboarding the auditors? There will be a request for a commitment from the auditors to have “X” hours available? One thing is to be part of a “whitelist” with no real commitment, and a different thing is to be aligned with the DAO and have manpower available.
We do not expect an auditor to participate in the program if they are not able to commit time to audit projects. Additionally, if they do not audit any projects, then they will be removed from the whitelist.
Can you share the expected skills/knowledge for both this elected member and the auditors?
We expect the elected member to have a strong technical background with experience of writing smart contracts and obtaining audits for their own project in the past. In regards to auditors, we plan to only accept reputable firms.
Can you share more details about the threshold between grant/investment? Who will decide that? The Audit Commitee?
It’ll be decided by the Audit committee, but the difference in grant or investment will really come down to the individual project and their subsidy request. We do not believe it is wise to advertise or commit to a threshold in advance.
I would like to echo these questions raised by pedrob, which immediately came to mind while reading this proposal. Introducing this new audit program while barely mentioning the ADPC's security subsidy fund, and the lessons learned from those experiences, seems odd.
Before moving forward with the details, I’d love to hear your thoughts on the Subsidy Fund implemented by the ADPC. Do you think it was well executed? What is your opinion on the results? And why do you propose making such a drastic change to that model instead of, for instance, suggesting that this new committee execute the v2?
Are there any lessons from that experience that could be applied?
While we work through the remaining questions, the updated target Snapshot date is now February 20th.
Thanks for the feedback so far!
- In my opinion, auditing firms are known for their “dynamic” pricing. Prices vary quite a lot depending on the type of project (for example: is the project well-funded by VC? Does it have known teams or partners endorsing the project? etc.). I am afraid we will not get fair pricing since the client here is Arbitrum. How can we make sure that we get fair pricing?
Thanks for the feedback so far!
- In my opinion, auditing firms are known for their “dynamic” pricing. Prices vary quite a lot depending on the type of project (for example: is the project well-funded by VC? Does it have known teams or partners endorsing the project? etc.). I am afraid we will not get fair pricing since the client here is Arbitrum. How can we make sure that we get fair pricing?
It'll be up to the council, and the wider Arbitrum Foundation, to make sure that prices negotiated are fair relative to the skills / offerings of the auditor. We have experience with these types of negotiations already and expect it to go reasonably well.
Additionally, we anticipate the program to be competitive amongst auditors, so we will always seek to matchmake projects with auditors who offer the best value for money (without compromising on quality).
- I suggest inviting multiple auditing firms and run some kind of bidding process for each project. I would suggest the “Sealed bid” method or something similar. What do you think about this idea?
During the matchmaking phase, it is quite common for a project to retrieve quotes from different audit providers. It is "sort of" like a sealed bid auction, since the project shouldn't share the quotes with the competitors.
- Is it realistic for a team of 3 committee members (while 2 of them are not being paid for this) working part-time to vet 100 projects? We are talking about paying up to $100k to audit one project, which is a significant amount. How can we make sure to really support the right projects? Maybe expand to 5 committee members?
Committee members will be responsible for evaluating the projects and ultimately making decisions, but the AF will take on the operational and volume work. We expect 3 committee members to be sufficient for running the program.
- I think with the power and reputation of Arbitrum DAO, we can ask audit firms to be paid in ARB tokens (instead of selling to USD). This would lower the selling pressure. Since the price of ARB tokens is low, they might even hold it for some time or even better; get involved in governance.
Service providers typically quote their services in USD. We can have a combination of USD and ARB for alignment, but we generally can’t force service providers to accept ARB only.
From the pool of relevant auditors, who will be responsible for selecting the final one for each project? Will it be the committee or the project? I’m not entirely clear on who will make the final decision.
All auditors must be pre-approved for the program. This will predominantly be performed by the Arbitrum Foundation with support of the council members. Will clarify this in the proposal.
Also, is there a clear maximum amount per project that will be spent on auditing? The 100K assumption per project seems rather vague. I believe there should be a maximum amount, and even a maximum percentage for the cost subsidy everyone should have skin on the game.
We decided against a maximum cap in favour of offering the option to invest in projects as opposed to simply grants. If there is a subsidy that is larger than normal, it could be issued as an investment, and ultimately help align the project with the Arbitrum ecosystem. In nearly all cases, projects will also be expected to have skin in the game and pay for a portion of the audit.
Will this be converted immediately, or on an ongoing basis as needed? i suggest this is ongoing to reduce selling preassure.
It is a year-long program; so there is no requirement to exchange the funds immediately.
funding projects that then migrate to other ecos => why not make these audits some sort of investment or what sort of mitigation can be put in place?
In the proposal, we are offering the option to also use the subsidy to invest in the project, although we'd prefer if the project made its own in Arbitrum first :)
How are projects selected? there can be a lot of failures with early stage projects => having more structured programs for systematic validation and derisking (like e.g. the Hackathon Continuation Program) could mitigate this risk. Otherwise requiring some sort of traction in a PoC, letters of intent to purchase if B2B, or doing DD on validation… tricky.
In the proposal, it mentions the committee will screen based on scope, likelihood of success, team experience, due diligence of the tech, etc. Behind the scenes, it will form a matrix that will score the project and offer confidence that the project should be eligible to receive a subsidy.
Of course, like any selection process, the final decision will depend on whether the committee believes the project is likely to get product market fit and the team is truly focused on building for the long term.
Initially I voted "Abstain" on Snapshot due to valuing the importance of an audit program, however was a little hesitant to fund the AF for this task. However, upon further discussions and the changes made to the proposal I find the benefit out-weigh the costs. Many of which have been already stated above, but as we saw with other hacks there is reputational risk as well. Not necessarily any base-chains fault, but it can affect the perception for users. An ounce of prevention is worth a pound of cure in this sense.
voting "For" on Tally.
As in @web3citizenxyz representation. Voting FOR. Below the rationale:
I will vote for abstain on Tally.
There are strong reasons to support this proposal, such as its goal of lowering audit costs for early-stage projects, promoting ecosystem growth, and ensuring security through third-party audits. Also, the structured approach—DAO oversight, a technical expert, and transparency reports—demonstrates alignment with OpCo and responsible fund management.
I will vote for abstain on Tally.
There are strong reasons to support this proposal, such as its goal of lowering audit costs for early-stage projects, promoting ecosystem growth, and ensuring security through third-party audits. Also, the structured approach—DAO oversight, a technical expert, and transparency reports—demonstrates alignment with OpCo and responsible fund management.
However, attempting to extract $10M from 30M ARB at the current price of $0.32 raises concerns. The proposal relies on conversions that may not achieve the intended funding amount, potentially impacting both the program’s execution and ARB’s market stability. Selling such a large portion of ARB could have unintended consequences.
After consideration, the @SEEDgov delegation has decided to vote “FOR” on this proposal at the Tally Vote.
Rationale
Although this is our first time joining the discussion, we wanted to share some thoughts on the process this proposal has gone through.
After consideration, the @SEEDgov delegation has decided to vote “FOR” on this proposal at the Tally Vote.
Rationale
Although this is our first time joining the discussion, we wanted to share some thoughts on the process this proposal has gone through.
At the beginning, we must admit there was quite a bit of confusion, as it was evident that there were frictions between the ADPC and the AF. Given how important this proposal is for the ecosystem, we believe this “transition” could have been handled under better conditions.
Having said that, we understand that the AF wants to take on a more active role in the DAO, and we actually welcome this decision, knowing that it’s one of the most Arbitrum-aligned entities that can bring significant value both to various initiatives and to decision-making.
However, it is important to mention that, despite this new approach, the DAO will still need Service Providers and other contributors to help achieve the objectives set through the S.O.S. That is why we emphasize the importance of ensuring that processes like this one are carried out in a structured and orderly manner. Otherwise, not only does it create uncertainty for potential SPs, but it also fosters an environment that can become toxic—not just in terms of governance dynamics but also for conducting business.
Regarding the program itself, we align with @krst’s perspective: the AF should meet the same standards required of any SP, as this is an initiative funded by the DAO. At the same time, we view the adjustments made after the initial feedback phase positively. In this regard, we believe the suggestions from various delegates have been valuable in improving this proposal and giving the DAO greater oversight over its execution.
I'm voting FOR the Arbitrum Audit Program.
Like many other delegates, I feel the tensions between the ADPC and AF could've been navigated with more grace. But let's focus on what matters - this program is worth doing. $10M to help around 100 projects get proper security audits is money incredibly well spent. This creates true value by making our ecosystem safer while supporting early builders who need it most.
I'm voting FOR the Arbitrum Audit Program.
Like many other delegates, I feel the tensions between the ADPC and AF could've been navigated with more grace. But let's focus on what matters - this program is worth doing. $10M to help around 100 projects get proper security audits is money incredibly well spent. This creates true value by making our ecosystem safer while supporting early builders who need it most.
I love and believe we should promote paying out in ARB as much as possible. We need to be thoughtful stewards of our treasury - ARB is trading to low right now, and putting it on the auditors to decide when to sell is a good idea. The smart ones will choose to hodl!
Considerations:
I am sharing my considerations with the intent of being helpful, not judgmental. Everything that benefits our DAO should be pursued and completed.
Considerations:
I am sharing my considerations with the intent of being helpful, not judgmental. Everything that benefits our DAO should be pursued and completed.
The 100K figure might be a rough estimate of the total cost. Similarly, setting a target of 100 projects may not be a highly professional approach. However, the more projects we complete, the better. This approach is honest and alleviates some pressure from those managing the project. I understand the DAO’s response to a similar comment, but I still believe that reducing stress for the members is important. My concern stems from past experiences where project costs were miscalculated.
I also believe that assistance with auditing is necessary, as it could help reduce overall costs. However, before investing resources into auditing, each project should be carefully evaluated. If a project has fundamental issues that are likely to lead to its abandonment, spending money on auditing it would be wasteful. Pushing a problematic project forward only for it to be abandoned later would result in unnecessary expenses.
Pros:
More projects will be completed, hopefully at a lower cost, leading to increased income for the DAO. ADPC, one of our core components, will have another opportunity to provide value to the DAO by ensuring projects reach completion rather than being abandoned. A point that I find noteworthy is that two committee members are waiving their payment. While I do not oppose committee payments in general, I have observed cases where committees charge excessively high fees, which makes me more skeptical about certain proposals. In this case, the fact that members are voluntarily forgoing their compensation reflects a commitment to the DAO’s success rather than personal gain. (In general, I believe that fair compensation aligned with market standards is reasonable. However, when fees are disproportionately high, it raises concerns about whether the primary motivation is the DAO’s well-being or financial gain)
There is much more to discuss regarding this proposal, but I do not wish to repeat arguments that have already been analyzed. Instead, I have focused on the key points that justify my FOR vote.
Voted For: For the same reason as my comment on the Snapshot vote.
For many new projects (especially DeFi), audits are a crucial and most expensive task to do before launch. To be a welcoming chain, it would be awesome to help high-end projects with this. This is the reason I voted and support this proposal.
The following reflects the views of GMX’s Governance Committee, and is based on the combined research, evaluation, consensus, and ideation of various committee members.
The first iteration of the Audit Program was crucial and one of the most successful DAO programs. GMX was also one of its recipients. Audit support is a vital aspect of any project's lifecycle, and when we speak with builders across the Arbitrum ecosystem every day, this is the most requested form of support and we fully support the initiative and would vote in favor of the proposal.
DAOplomats voted FOR this proposal on Tally.
We supported this proposal during the temp check as we are confident that the Foundation and OCL possess the necessary technical expertise to successfully manage the program. The inclusion of a team member from OpCo is also good.
DAOplomats voted FOR this proposal on Tally.
We supported this proposal during the temp check as we are confident that the Foundation and OCL possess the necessary technical expertise to successfully manage the program. The inclusion of a team member from OpCo is also good.
However, we recognize that at least one Foundation member is currently participating in the ongoing election. If elected, we believe it would be preferable to appoint an alternative party to the committee to maintain balance.
Additionally, we appreciate the inclusion of subsidiary payment conditions and transparency reports. The commitment to a structured, quarterly reporting cadence is a valuable addition that enhances accountability.
I'm voting FOR on tally, I think at this time we do need some audit to help grow and also to pick the best of the proposals, as long as all this process, wich is very well explained in this project, is transparent enough, for me is a yes!
We recognize the Arbitrum Audit Program’s intent to bolster ecosystem security and growth by subsidizing audits for early-stage and loyal projects. However, as founders ourselves, we doubt its success due to the mandatory "Arbitrum-first" exclusivity clause. Requiring audited code to remain exclusive to Arbitrum for a fixed period in exchange for a $100K-$300K subsidy could deter promising projects, as it imposes a significant non-competition constraint that limits strategic flexibility—something we’d never accept for our own ventures. An alternative could be a more founder-friendly approach, such as offering a base subsidy for launching on Arbitrum (without exclusivity) and additional incentives (e.g., bonus funding or grants) for meeting ecosystem contribution milestones, like TVL or user growth, over a short priority period. This would align incentives without locking projects in. Given the current proposal’s rigid terms don’t reflect such flexibility, we’ll vote to abstain, as we support the goal but question the execution’s practicality.
I've decided to support this proposal on Tally. During the off-chain vote I voted in favor, asking, however to address some issues that I considered to be important before moving on-chain. I appreciate that feedback was integrated and that this revised version of the proposal is characterized by enhanced transparency and also contains better-defined eligibility criteria.
I believe that supporting projects with audit expenses is essential, and I hope that this proposal will prove to address this effectively.
The following reflects the views of L2BEAT’s governance team, composed of @krst and @Sinkas. It’s based on their combined research, fact-checking, and ideation.
We’re voting FOR the proposal.
The following reflects the views of L2BEAT’s governance team, composed of @krst and @Sinkas. It’s based on their combined research, fact-checking, and ideation.
We’re voting FOR the proposal.
When we supported the proposal during temp-check, we pointed out that we’ll be treating this initiative like all other DAO-lead initiatives and expect the same level of oversight from the DAO to be applied. That’s because even though the Foundation will be administering it, the program was funded by the DAO.
We’re pleased to see the Foundation include a regular reporting cadence in the proposal to address the above point. With that in mind, we look forward to seeing the program set up and ready to accept applications.
We are casting a FOR vote on this proposal on Tally. We believe that the Foundation, in collaboration with the OpCo, has been making meaningful decisions, and now is an opportune moment for it to take a more active role in proposing improvements. Given the transparency outlined in the updated proposal, we do not see this increased involvement as a threat to decentralization. Decentralization remains a core principle of the ecosystem, but accepting input from the Foundation does not undermine it—ultimately, it is the delegates who decide.
Audits are a crucial element in maintaining a secure ecosystem, and we believe the Foundation is taking the right steps by bringing this issue forward.
We vote FOR the proposal on Tally.
We acknowledge that, after showing our general support on Snapshot, the program managers include publishing quarterly transparency reports. We will follow up on a possible permanent audit subsidy program based on the results from them as well as seeing the clear situation the OpCo establishment.
Initially I voted "Abstain" on Snapshot due to valuing the importance of an audit program, however was a little hesitant to fund the AF for this task. However, upon further discussions and the changes made to the proposal I find the benefit out-weigh the costs. Many of which have been already stated above, but as we saw with other hacks there is reputational risk as well. Not necessarily any base-chains fault, but it can affect the perception for users. An ounce of prevention is worth a pound of cure in this sense.
voting "For" on Tally.
As in @web3citizenxyz representation. Voting FOR. Below the rationale:
I will vote for abstain on Tally.
There are strong reasons to support this proposal, such as its goal of lowering audit costs for early-stage projects, promoting ecosystem growth, and ensuring security through third-party audits. Also, the structured approach—DAO oversight, a technical expert, and transparency reports—demonstrates alignment with OpCo and responsible fund management.
I will vote for abstain on Tally.
There are strong reasons to support this proposal, such as its goal of lowering audit costs for early-stage projects, promoting ecosystem growth, and ensuring security through third-party audits. Also, the structured approach—DAO oversight, a technical expert, and transparency reports—demonstrates alignment with OpCo and responsible fund management.
However, attempting to extract $10M from 30M ARB at the current price of $0.32 raises concerns. The proposal relies on conversions that may not achieve the intended funding amount, potentially impacting both the program’s execution and ARB’s market stability. Selling such a large portion of ARB could have unintended consequences.
After consideration, the @SEEDgov delegation has decided to vote “FOR” on this proposal at the Tally Vote.
Rationale
Although this is our first time joining the discussion, we wanted to share some thoughts on the process this proposal has gone through.
After consideration, the @SEEDgov delegation has decided to vote “FOR” on this proposal at the Tally Vote.
Rationale
Although this is our first time joining the discussion, we wanted to share some thoughts on the process this proposal has gone through.
At the beginning, we must admit there was quite a bit of confusion, as it was evident that there were frictions between the ADPC and the AF. Given how important this proposal is for the ecosystem, we believe this “transition” could have been handled under better conditions.
Having said that, we understand that the AF wants to take on a more active role in the DAO, and we actually welcome this decision, knowing that it’s one of the most Arbitrum-aligned entities that can bring significant value both to various initiatives and to decision-making.
However, it is important to mention that, despite this new approach, the DAO will still need Service Providers and other contributors to help achieve the objectives set through the S.O.S. That is why we emphasize the importance of ensuring that processes like this one are carried out in a structured and orderly manner. Otherwise, not only does it create uncertainty for potential SPs, but it also fosters an environment that can become toxic—not just in terms of governance dynamics but also for conducting business.
Regarding the program itself, we align with @krst’s perspective: the AF should meet the same standards required of any SP, as this is an initiative funded by the DAO. At the same time, we view the adjustments made after the initial feedback phase positively. In this regard, we believe the suggestions from various delegates have been valuable in improving this proposal and giving the DAO greater oversight over its execution.
I'm voting FOR the Arbitrum Audit Program.
Like many other delegates, I feel the tensions between the ADPC and AF could've been navigated with more grace. But let's focus on what matters - this program is worth doing. $10M to help around 100 projects get proper security audits is money incredibly well spent. This creates true value by making our ecosystem safer while supporting early builders who need it most.
I'm voting FOR the Arbitrum Audit Program.
Like many other delegates, I feel the tensions between the ADPC and AF could've been navigated with more grace. But let's focus on what matters - this program is worth doing. $10M to help around 100 projects get proper security audits is money incredibly well spent. This creates true value by making our ecosystem safer while supporting early builders who need it most.
I love and believe we should promote paying out in ARB as much as possible. We need to be thoughtful stewards of our treasury - ARB is trading to low right now, and putting it on the auditors to decide when to sell is a good idea. The smart ones will choose to hodl!
Considerations:
I am sharing my considerations with the intent of being helpful, not judgmental. Everything that benefits our DAO should be pursued and completed.
Considerations:
I am sharing my considerations with the intent of being helpful, not judgmental. Everything that benefits our DAO should be pursued and completed.
The 100K figure might be a rough estimate of the total cost. Similarly, setting a target of 100 projects may not be a highly professional approach. However, the more projects we complete, the better. This approach is honest and alleviates some pressure from those managing the project. I understand the DAO’s response to a similar comment, but I still believe that reducing stress for the members is important. My concern stems from past experiences where project costs were miscalculated.
I also believe that assistance with auditing is necessary, as it could help reduce overall costs. However, before investing resources into auditing, each project should be carefully evaluated. If a project has fundamental issues that are likely to lead to its abandonment, spending money on auditing it would be wasteful. Pushing a problematic project forward only for it to be abandoned later would result in unnecessary expenses.
Pros:
More projects will be completed, hopefully at a lower cost, leading to increased income for the DAO. ADPC, one of our core components, will have another opportunity to provide value to the DAO by ensuring projects reach completion rather than being abandoned. A point that I find noteworthy is that two committee members are waiving their payment. While I do not oppose committee payments in general, I have observed cases where committees charge excessively high fees, which makes me more skeptical about certain proposals. In this case, the fact that members are voluntarily forgoing their compensation reflects a commitment to the DAO’s success rather than personal gain. (In general, I believe that fair compensation aligned with market standards is reasonable. However, when fees are disproportionately high, it raises concerns about whether the primary motivation is the DAO’s well-being or financial gain)
There is much more to discuss regarding this proposal, but I do not wish to repeat arguments that have already been analyzed. Instead, I have focused on the key points that justify my FOR vote.
Voted For: For the same reason as my comment on the Snapshot vote.
For many new projects (especially DeFi), audits are a crucial and most expensive task to do before launch. To be a welcoming chain, it would be awesome to help high-end projects with this. This is the reason I voted and support this proposal.
The following reflects the views of GMX’s Governance Committee, and is based on the combined research, evaluation, consensus, and ideation of various committee members.
The first iteration of the Audit Program was crucial and one of the most successful DAO programs. GMX was also one of its recipients. Audit support is a vital aspect of any project's lifecycle, and when we speak with builders across the Arbitrum ecosystem every day, this is the most requested form of support and we fully support the initiative and would vote in favor of the proposal.
DAOplomats voted FOR this proposal on Tally.
We supported this proposal during the temp check as we are confident that the Foundation and OCL possess the necessary technical expertise to successfully manage the program. The inclusion of a team member from OpCo is also good.
DAOplomats voted FOR this proposal on Tally.
We supported this proposal during the temp check as we are confident that the Foundation and OCL possess the necessary technical expertise to successfully manage the program. The inclusion of a team member from OpCo is also good.
However, we recognize that at least one Foundation member is currently participating in the ongoing election. If elected, we believe it would be preferable to appoint an alternative party to the committee to maintain balance.
Additionally, we appreciate the inclusion of subsidiary payment conditions and transparency reports. The commitment to a structured, quarterly reporting cadence is a valuable addition that enhances accountability.
I'm voting FOR on tally, I think at this time we do need some audit to help grow and also to pick the best of the proposals, as long as all this process, wich is very well explained in this project, is transparent enough, for me is a yes!
We recognize the Arbitrum Audit Program’s intent to bolster ecosystem security and growth by subsidizing audits for early-stage and loyal projects. However, as founders ourselves, we doubt its success due to the mandatory "Arbitrum-first" exclusivity clause. Requiring audited code to remain exclusive to Arbitrum for a fixed period in exchange for a $100K-$300K subsidy could deter promising projects, as it imposes a significant non-competition constraint that limits strategic flexibility—something we’d never accept for our own ventures. An alternative could be a more founder-friendly approach, such as offering a base subsidy for launching on Arbitrum (without exclusivity) and additional incentives (e.g., bonus funding or grants) for meeting ecosystem contribution milestones, like TVL or user growth, over a short priority period. This would align incentives without locking projects in. Given the current proposal’s rigid terms don’t reflect such flexibility, we’ll vote to abstain, as we support the goal but question the execution’s practicality.
I've decided to support this proposal on Tally. During the off-chain vote I voted in favor, asking, however to address some issues that I considered to be important before moving on-chain. I appreciate that feedback was integrated and that this revised version of the proposal is characterized by enhanced transparency and also contains better-defined eligibility criteria.
I believe that supporting projects with audit expenses is essential, and I hope that this proposal will prove to address this effectively.
The following reflects the views of L2BEAT’s governance team, composed of @krst and @Sinkas. It’s based on their combined research, fact-checking, and ideation.
We’re voting FOR the proposal.
The following reflects the views of L2BEAT’s governance team, composed of @krst and @Sinkas. It’s based on their combined research, fact-checking, and ideation.
We’re voting FOR the proposal.
When we supported the proposal during temp-check, we pointed out that we’ll be treating this initiative like all other DAO-lead initiatives and expect the same level of oversight from the DAO to be applied. That’s because even though the Foundation will be administering it, the program was funded by the DAO.
We’re pleased to see the Foundation include a regular reporting cadence in the proposal to address the above point. With that in mind, we look forward to seeing the program set up and ready to accept applications.
We are casting a FOR vote on this proposal on Tally. We believe that the Foundation, in collaboration with the OpCo, has been making meaningful decisions, and now is an opportune moment for it to take a more active role in proposing improvements. Given the transparency outlined in the updated proposal, we do not see this increased involvement as a threat to decentralization. Decentralization remains a core principle of the ecosystem, but accepting input from the Foundation does not undermine it—ultimately, it is the delegates who decide.
Audits are a crucial element in maintaining a secure ecosystem, and we believe the Foundation is taking the right steps by bringing this issue forward.
We vote FOR the proposal on Tally.
We acknowledge that, after showing our general support on Snapshot, the program managers include publishing quarterly transparency reports. We will follow up on a possible permanent audit subsidy program based on the results from them as well as seeing the clear situation the OpCo establishment.
Voted For: For the same reason as my comment on the Snapshot vote.
For many new projects (especially DeFi), audits are a crucial and most expensive task to do before launch. To be a welcoming chain, it would be awesome to help high-end projects with this. This is the reason I voted and support this proposal.
Its also great to see my suggestion to push for payment in ARB to auditors in the Tally proposal.
Additionally, we will seek when possible to offer the payment in ARB as opposed to USD, subject to the auditor’s needs.
I will be voting AGAINST on Tally, due to the same concern outlines in my previous off-chain vote as well as the decision to bring it up under the Foundation's wing.
I'm voting FOR this proposal on Tally
I am much more satisfied with the new version of the proposal published after my vote on Snapshot.
Clarity has been added regarding the conditions for teams to participate, as well as the payment terms, thus ensuring the best terms and positioning to negotiate in favor of Arbitrum.
I'm voting FOR this proposal on Tally
I am much more satisfied with the new version of the proposal published after my vote on Snapshot.
Clarity has been added regarding the conditions for teams to participate, as well as the payment terms, thus ensuring the best terms and positioning to negotiate in favor of Arbitrum.
Additionally, a transparency report was introduced, from which we will be able to gain insights and the necessary information so that, in case the foundation decides not to continue with the program, the DAO can pick up where it left off.
Finally, I believe the endorsement of the ADPC for this process is not insignificant.
voting AGAINST on the current onchain vote because I don't agree with internalizing this program into the Arbitrum Foundation.
Voting FOR
Although I have concerns with this proposal, I believe it's a useful mechanism and trust the AF and OCL will be able to make descent enough decisions here.
I voted FOR this proposal. I voted against on Snapshot because there were conflicting messages from the Foundation and the ADPC team regarding the authorship of the proposal. However: Compared to the previous proposal on Snapshot, the Arbitrum Foundation made several concessions, including my comments on the board, to add more members from the DAO, since the DAO is paying. This will have a positive impact on transparency and give more credibility to this program.
In any case, the usefulness of this proposal outweighs the internal debates about governance and ownership of this proposal.
After reviewing the discussion and the updated proposal from the Foundation, we’ve decided to change our vote from Against to For on Tally.
Audit costs are a real challenge for builders with limited budgets, and audits are crucial for establishing confidence and trust between projects and users. We believe this initiative will encourage more high-quality projects to build on Arbitrum, which ultimately benefits the entire ecosystem.
We are voting FOR this proposal on Tally after having abstained in the temperature check. Having heard feedback from delegates, the improved transparency and detailed eligibility requirements, and aligning with the overall goals of the initiative to empower our ecosystem of builders and assist in the securing of expensive audits that often serve as a barrier.
Many of the issues with this proposal remain around the potential impact on $ARB and the role of the Arbitrum Foundation. It is our view that the internalization of this role by the AF is a positive step towards the DAO's maturity. The transparency included in the updated version of the proposal, along with the development of the OpCo for accountability, will bring the AF into tighter relations with the DAO and will further the trust between OCL, AF, and Arbitrum DAO to further effect positive change on the Arbitrum Ecosystem together. The DAO is not able to provide the expertise on the audit vendors and determining which projects are deserving of the services. This proposal and it's support from ADPC highlights an improvement in the position of the AF alongside the DAO and we support such initiatives. We agree with @jameskbh's view with optimism looking ahead to the reduced friction and defined lanes for the entities that drive Arbitrum forward.
I voted FOR, as we need a vehicle to support builders. I trust that the entities running the program are well prepared to do it. I hope we can discuss how to have it run by OpCo down the line so we reduce the friction of having several entities engaged with it.
LobbyFi’s rationale on the price and making the voting power available for sale for this proposal
LobbyFi will follow the same logic for making the auction available and pricing the proposal as for the offchain proposal.
With the current ETH price, the instant buy price will be set at 0.6 ETH.
I vote in favor of this proposal on Tally. I believe ADPC’s track record speaks for itself, as it has been a great support in the development of the ecosystem. I think this audit program could help reduce reliance on a single third party and save us excessive costs for this service. I support it as long as there is transparency in the audits conducted, ensuring they are carried out effectively, as a coding error could cause significant harm. I appreciate the improvements presented and the emphasis on not converting all ARB to stablecoins yet, given the current market conditions, as it would take us a long time to recover.
I voted FOR on Tally. The reason: https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/68?u=danielm
The following reflects the views of the Lampros DAO governance team, composed of Chain_L (@Blueweb), @Euphoria, and Hirangi Pandya (@Nyx), based on our combined research, analysis, and ideation.
We are voting FOR this proposal in Tally voting.
The following reflects the views of the Lampros DAO governance team, composed of Chain_L (@Blueweb), @Euphoria, and Hirangi Pandya (@Nyx), based on our combined research, analysis, and ideation.
We are voting FOR this proposal in Tally voting.
As mentioned in our Snapshot rationale, we support programs that lower barriers for early-stage teams to build confidently on Arbitrum. Audit costs often block promising projects from launching safely, and this initiative directly addresses that issue.
Since the Snapshot vote, we’ve seen meaningful improvements in the proposal. One concern we had earlier was around eligibility criteria - specifically, how the committee would define which projects can apply. That’s now clearly addressed in the updated version, which helps set expectations and filters out applications that don’t meet the intended purpose of the program.
We also appreciate the added clarity around transparency reporting. Having quarterly updates is good to keep the DAO informed.
Overall, the proposal has shaped up well, and we’re aligned with the direction it's taking.
gm, strongly in favor of this program.
Audits are necessary but prohibitively expensive for early builders. This creates the right incentives:
A must-have toolkit to support new and existing builders on Arbitrum.
Thanks
I will ABSTAIN from [NON-CONSTITUTIONAL] Arbitrum Audit Program:
As a builder in the space myself who had to complete security compliance and benefitted from support from DAO initiatives, I can strongly emphasize A. the importance of proper security auditing B. the significance of supporting early ventures in making it happen. The capacity of a new protocol or project to internally fund all security requirements is not a mark of its potential value to the ecosystem. Many projects simply don't have the funds to establish compliance and are left unable to proceed forward. Without supporting these ventures, Arbitrum as an ecosystem would likely lose a tremendous amount of potential value.
I will ABSTAIN from [NON-CONSTITUTIONAL] Arbitrum Audit Program:
As a builder in the space myself who had to complete security compliance and benefitted from support from DAO initiatives, I can strongly emphasize A. the importance of proper security auditing B. the significance of supporting early ventures in making it happen. The capacity of a new protocol or project to internally fund all security requirements is not a mark of its potential value to the ecosystem. Many projects simply don't have the funds to establish compliance and are left unable to proceed forward. Without supporting these ventures, Arbitrum as an ecosystem would likely lose a tremendous amount of potential value.
That said, I am unsure why the conversion of ARB to USDC has to occur immediately and place downward pressure on the value of the ARB token (unless there is an OTC process I am missing). I imagine it may be to keep the total number of potentially supported projects at the rounded 100. However, candidly, 100 seems excessive to begin with, so in the event of downside price action, I’m not sure fewer than 100 would be a tragedy. And, given price action is bi-directional and markets are fairly compressed at present, we may actually see an expansion in token value and room for even more than 100 projects. Ultimately, I believe periodic (ideally OTC) swaps would be preferable. For this reason, I will ABSTAIN from this proposal. Should the community support it broadly, I would happily see it pass. However, should it not pass and need revision the above would be my suggestion.
I’m casting my vote in favor of this proposal on Tally.
Back in my first comment, I was pretty vocal about liking the main idea behind this program—giving early-stage projects a hand with the steep costs of smart contract audits so they can launch on Arbitrum without cutting corners on security. But I did flag three things that had me a bit concerned: how we’d keep projects from jumping ship after getting the subsidy, how this setup stands up against what the ADPC did before, and whether the budget was a bit too hefty. Since then, the proposal has gotten some solid updates, especially with the new sections on who’s eligible, how payments will work, and how they’ll keep us in the loop with transparency reports.
I voted FOR this proposal at the temp check stage. I think the audit support program has been a benefit to Arbitrum in its form as the ADPC, and I'm comfortable moving it under the AF going forward.
DAOplomats voted FOR this proposal on Snapshot.
AF and OCL do have the technical expertise to handle this. Also, addressing the lessons learned from the ADPC, most especially time to action, we are confident this program would be better.
DAOplomats voted FOR this proposal on Snapshot.
AF and OCL do have the technical expertise to handle this. Also, addressing the lessons learned from the ADPC, most especially time to action, we are confident this program would be better.
Over time, however, we would love to see the DAO take more ownership of this and eventually full ownership, and materializing a framework for this cause just as @pedrob suggested would be great.
I voted FOR to this proposal. I support the Arbitrum Foundation and Offchain Labs to execute this program well, and considering that the ADPC team gave the Foundation its endorsement, I am supportive. Commitment is needed to achieve the same level of transparency as other teams, like ADPC.
LobbyFi voted abstain on the Audit Program proposal since neither the "for" nor the "against" pool in the community auction has reached the needed threshold (10% of the instant buy we have set).
Gauntlet supports the Arbitrum Audit Program. Clearer eligibility requirements and transparency reports are welcome additions. We do believe this is something that OpCo can help further decentralize and hold the Arbitrum Foundation accountable for (if needed, although we don't expect this to be the case) in the future.
Voted For: For the same reason as my comment on the Snapshot vote.
For many new projects (especially DeFi), audits are a crucial and most expensive task to do before launch. To be a welcoming chain, it would be awesome to help high-end projects with this. This is the reason I voted and support this proposal.
Its also great to see my suggestion to push for payment in ARB to auditors in the Tally proposal.
Additionally, we will seek when possible to offer the payment in ARB as opposed to USD, subject to the auditor’s needs.
I will be voting AGAINST on Tally, due to the same concern outlines in my previous off-chain vote as well as the decision to bring it up under the Foundation's wing.
I'm voting FOR this proposal on Tally
I am much more satisfied with the new version of the proposal published after my vote on Snapshot.
Clarity has been added regarding the conditions for teams to participate, as well as the payment terms, thus ensuring the best terms and positioning to negotiate in favor of Arbitrum.
I'm voting FOR this proposal on Tally
I am much more satisfied with the new version of the proposal published after my vote on Snapshot.
Clarity has been added regarding the conditions for teams to participate, as well as the payment terms, thus ensuring the best terms and positioning to negotiate in favor of Arbitrum.
Additionally, a transparency report was introduced, from which we will be able to gain insights and the necessary information so that, in case the foundation decides not to continue with the program, the DAO can pick up where it left off.
Finally, I believe the endorsement of the ADPC for this process is not insignificant.
voting AGAINST on the current onchain vote because I don't agree with internalizing this program into the Arbitrum Foundation.
Voting FOR
Although I have concerns with this proposal, I believe it's a useful mechanism and trust the AF and OCL will be able to make descent enough decisions here.
I voted FOR this proposal. I voted against on Snapshot because there were conflicting messages from the Foundation and the ADPC team regarding the authorship of the proposal. However: Compared to the previous proposal on Snapshot, the Arbitrum Foundation made several concessions, including my comments on the board, to add more members from the DAO, since the DAO is paying. This will have a positive impact on transparency and give more credibility to this program.
In any case, the usefulness of this proposal outweighs the internal debates about governance and ownership of this proposal.
After reviewing the discussion and the updated proposal from the Foundation, we’ve decided to change our vote from Against to For on Tally.
Audit costs are a real challenge for builders with limited budgets, and audits are crucial for establishing confidence and trust between projects and users. We believe this initiative will encourage more high-quality projects to build on Arbitrum, which ultimately benefits the entire ecosystem.
We are voting FOR this proposal on Tally after having abstained in the temperature check. Having heard feedback from delegates, the improved transparency and detailed eligibility requirements, and aligning with the overall goals of the initiative to empower our ecosystem of builders and assist in the securing of expensive audits that often serve as a barrier.
Many of the issues with this proposal remain around the potential impact on $ARB and the role of the Arbitrum Foundation. It is our view that the internalization of this role by the AF is a positive step towards the DAO's maturity. The transparency included in the updated version of the proposal, along with the development of the OpCo for accountability, will bring the AF into tighter relations with the DAO and will further the trust between OCL, AF, and Arbitrum DAO to further effect positive change on the Arbitrum Ecosystem together. The DAO is not able to provide the expertise on the audit vendors and determining which projects are deserving of the services. This proposal and it's support from ADPC highlights an improvement in the position of the AF alongside the DAO and we support such initiatives. We agree with @jameskbh's view with optimism looking ahead to the reduced friction and defined lanes for the entities that drive Arbitrum forward.
I voted FOR, as we need a vehicle to support builders. I trust that the entities running the program are well prepared to do it. I hope we can discuss how to have it run by OpCo down the line so we reduce the friction of having several entities engaged with it.
LobbyFi’s rationale on the price and making the voting power available for sale for this proposal
LobbyFi will follow the same logic for making the auction available and pricing the proposal as for the offchain proposal.
With the current ETH price, the instant buy price will be set at 0.6 ETH.
I vote in favor of this proposal on Tally. I believe ADPC’s track record speaks for itself, as it has been a great support in the development of the ecosystem. I think this audit program could help reduce reliance on a single third party and save us excessive costs for this service. I support it as long as there is transparency in the audits conducted, ensuring they are carried out effectively, as a coding error could cause significant harm. I appreciate the improvements presented and the emphasis on not converting all ARB to stablecoins yet, given the current market conditions, as it would take us a long time to recover.
I voted FOR on Tally. The reason: https://forum.arbitrum.foundation/t/arbitrum-audit-program/28368/68?u=danielm
The following reflects the views of the Lampros DAO governance team, composed of Chain_L (@Blueweb), @Euphoria, and Hirangi Pandya (@Nyx), based on our combined research, analysis, and ideation.
We are voting FOR this proposal in Tally voting.
The following reflects the views of the Lampros DAO governance team, composed of Chain_L (@Blueweb), @Euphoria, and Hirangi Pandya (@Nyx), based on our combined research, analysis, and ideation.
We are voting FOR this proposal in Tally voting.
As mentioned in our Snapshot rationale, we support programs that lower barriers for early-stage teams to build confidently on Arbitrum. Audit costs often block promising projects from launching safely, and this initiative directly addresses that issue.
Since the Snapshot vote, we’ve seen meaningful improvements in the proposal. One concern we had earlier was around eligibility criteria - specifically, how the committee would define which projects can apply. That’s now clearly addressed in the updated version, which helps set expectations and filters out applications that don’t meet the intended purpose of the program.
We also appreciate the added clarity around transparency reporting. Having quarterly updates is good to keep the DAO informed.
Overall, the proposal has shaped up well, and we’re aligned with the direction it's taking.
gm, strongly in favor of this program.
Audits are necessary but prohibitively expensive for early builders. This creates the right incentives:
A must-have toolkit to support new and existing builders on Arbitrum.
Thanks
I will ABSTAIN from [NON-CONSTITUTIONAL] Arbitrum Audit Program:
As a builder in the space myself who had to complete security compliance and benefitted from support from DAO initiatives, I can strongly emphasize A. the importance of proper security auditing B. the significance of supporting early ventures in making it happen. The capacity of a new protocol or project to internally fund all security requirements is not a mark of its potential value to the ecosystem. Many projects simply don't have the funds to establish compliance and are left unable to proceed forward. Without supporting these ventures, Arbitrum as an ecosystem would likely lose a tremendous amount of potential value.
I will ABSTAIN from [NON-CONSTITUTIONAL] Arbitrum Audit Program:
As a builder in the space myself who had to complete security compliance and benefitted from support from DAO initiatives, I can strongly emphasize A. the importance of proper security auditing B. the significance of supporting early ventures in making it happen. The capacity of a new protocol or project to internally fund all security requirements is not a mark of its potential value to the ecosystem. Many projects simply don't have the funds to establish compliance and are left unable to proceed forward. Without supporting these ventures, Arbitrum as an ecosystem would likely lose a tremendous amount of potential value.
That said, I am unsure why the conversion of ARB to USDC has to occur immediately and place downward pressure on the value of the ARB token (unless there is an OTC process I am missing). I imagine it may be to keep the total number of potentially supported projects at the rounded 100. However, candidly, 100 seems excessive to begin with, so in the event of downside price action, I’m not sure fewer than 100 would be a tragedy. And, given price action is bi-directional and markets are fairly compressed at present, we may actually see an expansion in token value and room for even more than 100 projects. Ultimately, I believe periodic (ideally OTC) swaps would be preferable. For this reason, I will ABSTAIN from this proposal. Should the community support it broadly, I would happily see it pass. However, should it not pass and need revision the above would be my suggestion.
I’m casting my vote in favor of this proposal on Tally.
Back in my first comment, I was pretty vocal about liking the main idea behind this program—giving early-stage projects a hand with the steep costs of smart contract audits so they can launch on Arbitrum without cutting corners on security. But I did flag three things that had me a bit concerned: how we’d keep projects from jumping ship after getting the subsidy, how this setup stands up against what the ADPC did before, and whether the budget was a bit too hefty. Since then, the proposal has gotten some solid updates, especially with the new sections on who’s eligible, how payments will work, and how they’ll keep us in the loop with transparency reports.
I voted FOR this proposal at the temp check stage. I think the audit support program has been a benefit to Arbitrum in its form as the ADPC, and I'm comfortable moving it under the AF going forward.
DAOplomats voted FOR this proposal on Snapshot.
AF and OCL do have the technical expertise to handle this. Also, addressing the lessons learned from the ADPC, most especially time to action, we are confident this program would be better.
DAOplomats voted FOR this proposal on Snapshot.
AF and OCL do have the technical expertise to handle this. Also, addressing the lessons learned from the ADPC, most especially time to action, we are confident this program would be better.
Over time, however, we would love to see the DAO take more ownership of this and eventually full ownership, and materializing a framework for this cause just as @pedrob suggested would be great.
I voted FOR to this proposal. I support the Arbitrum Foundation and Offchain Labs to execute this program well, and considering that the ADPC team gave the Foundation its endorsement, I am supportive. Commitment is needed to achieve the same level of transparency as other teams, like ADPC.
LobbyFi voted abstain on the Audit Program proposal since neither the "for" nor the "against" pool in the community auction has reached the needed threshold (10% of the instant buy we have set).
Gauntlet supports the Arbitrum Audit Program. Clearer eligibility requirements and transparency reports are welcome additions. We do believe this is something that OpCo can help further decentralize and hold the Arbitrum Foundation accountable for (if needed, although we don't expect this to be the case) in the future.
I’m casting my vote in favor of this proposal on Tally.
Back in my first comment, I was pretty vocal about liking the main idea behind this program—giving early-stage projects a hand with the steep costs of smart contract audits so they can launch on Arbitrum without cutting corners on security. But I did flag three things that had me a bit concerned: how we’d keep projects from jumping ship after getting the subsidy, how this setup stands up against what the ADPC did before, and whether the budget was a bit too hefty. Since then, the proposal has gotten some solid updates, especially with the new sections on who’s eligible, how payments will work, and how they’ll keep us in the loop with transparency reports.
The updated proposal now explicitly states that audited code must remain exclusive to Arbitrum for a fixed period, with legal agreements enforcing this. Breaching exclusivity requires repaying the full subsidy to the DAO via the Arbitrum Foundation, with potential legal recourse or a DAO ban from future initiatives. This is a strong step toward ensuring commitment, though I still believe we could go further.
What if we added a rule where projects that abandon Arbitrum exclusivity within, say, 6 months after the exclusivity period ends have to pay back part of the subsidy in ARB tokens? The amount they’d owe could depend on how soon they leave—like, if they bail just 3 months after the exclusivity period, they’d repay 50% of the subsidy. I think this would give projects a real reason to stay committed to Arbitrum for the long haul, especially for those who might see the exclusivity period as just a box to check rather than a true commitment. Plus, it means the DAO gets some ARB back, which could grow in value over time and help the ecosystem even more.
Several good improvements that i see here:
any code audited will need to remain exclusive to our ecosystem for a fixed period of time.
Several good improvements that i see here:
any code audited will need to remain exclusive to our ecosystem for a fixed period of time.
We are targeting relatively early stage projects, projects that have demonstrated product market fit on Arbitrum, and finally projects that have remained loyal to our ecosystem with an upcoming launch or upgrade that has the potential to help grow the ecosystem.
I like all of these addition which address most of what was proposed by several delegates. I also like adding one member of the opco because the sheer amount of work could potentially be important, and having more members involved in the DAO can be beneficial even just for comms and to keep context.
Im voting YES. Audits are simply a crucial part to create a safe environment for user and developer. It helps a brand getting stronger and getting a good reputation. Simply said, there is no downside.
I want to name the observation of an anti-pattern which I don't think is a good habit, and not serving of the DAO. It is evident in the current Audit proposal.
Observation: Overuse of Yes & Abstain at tempcheck stage hoping issues will be addressed doesn't work.
I have noticed a technique of delegates saying on the Forum I hope... I begrudgingly vote FOR at tempcheck but want to see x, y, z issues addressed before it goes to onchain voting (Tally).
Looking at history those issues are in the majority of time not addressed, the author gets a pass and the proposal sails through Tally stage because people don’t read, it's too much effort, no mechanism to force accountability.
This technique doesn’t work and delegates should not expect it to work, and imo should make use of the No in tempcheck more frequently.
I think that's more honouring of how the forum to tempcheck feedback loop should work, not expecting: snapshot pass + and all feedback is incorporated in the transition to Tally, history doesn’t reflect this "hope" being the case.
I'd invite delegates to stop doing this, use No as a valid step in an iterative feedback loop the DAO uses to converge and require proposal to take onboard feedback before going to onchain voting.
Curious other's thoughts on this dynamic
As in @web3citizenxyz representation. Voting FOR. Below the rationale:
In the end, I didn't get it.
I'm voting FOR this initiative. This is one of those proposals that empower startup apps that need those audits to start operating and polishing their code bases from vulnerabilities. However, I propose two changes to the current proposal:
First, while I understand the necessity of exchanging Arbitrum for USD to pay for auditing services, exchanging the $10 million in one swoop seems excessive. It can be done in three or four tranches whenever necessary, avoiding putting more selling pressure on the market.
I'm voting FOR this initiative. This is one of those proposals that empower startup apps that need those audits to start operating and polishing their code bases from vulnerabilities. However, I propose two changes to the current proposal:
First, while I understand the necessity of exchanging Arbitrum for USD to pay for auditing services, exchanging the $10 million in one swoop seems excessive. It can be done in three or four tranches whenever necessary, avoiding putting more selling pressure on the market.
Also, I suggest contacting already-known auditors from large firms for this task and negotiating a price for bulk operations.
If done correctly, this could help several projects to get their first leg up in defi, expediting processes that could take a considerable amount of time when done via individual proposals.
We agree with what the proposal is trying to achieve and believe that this subsidy scheme provided is a great initiative that would greatly help development on Arbitrum. While the miscommunication was unfortunate, the audit program and providing this form of support would still be a great way to help out in development of high quality projects on Arbitrum. At the very least it has been stated that the final goal between the Foundation and ADPC are aligned. However, just something that we would like to see be further touched up on are the evaluation metrics. We think that seeing how many projects launch on Arbitrum are a good start but TVL growth and measuring stuff like transaction volume on each of these audited projects and user activity should be considered too to truly understand how effective the program is in promoting growth.
Voting in favour of this. I think this will perform well under the AF. A DAO iniaitive has gone under the AF for efficiency purposes as far as i understand.
This is a plus in my eyes. They're supporting the dao. take it as a win
Blockworks Advisory will be voting Abstain on this proposal at the temperature check stage.
Similar to others, we have faith in OCL and AF to properly manage this program. The foundation likely has better expertise in this area, which position it better for selecting auditing services. We still are concerned about lock-in for protocols and would sincerely like this to be addressed. Otherwise it is very similar to just a grant, and thus the investment angle should be explored much further. We would especially like this to be elaborated on prior to any onchain vote.
Blockworks Advisory will be voting Abstain on this proposal at the temperature check stage.
Similar to others, we have faith in OCL and AF to properly manage this program. The foundation likely has better expertise in this area, which position it better for selecting auditing services. We still are concerned about lock-in for protocols and would sincerely like this to be addressed. Otherwise it is very similar to just a grant, and thus the investment angle should be explored much further. We would especially like this to be elaborated on prior to any onchain vote.
Furthermore, like both @WintermuteGovernance and @GFXLabs have said, the budget seems rather large both in general and in relation to other existing programs. There's also the matter that there is still some details that we would like to see, disclosures, additional clarity for protocols eligibility, outcome reporting, etc. As @krst stated, should this proposal pass we will expect the same level of transparency as we would from the ADPC team/other DAO teams.
We plan to vote Abstain on this proposal.
Overall, we agree that setting up an audit program would be valuable, as lowering one of the most prohibitive costs that early-stage teams face can be a great way to attract more projects to the ecosystem and help them reach mainnet faster/safer. We also appreciate the Foundation’s plan to include exclusivity clauses so that funded projects are committed to keep building on Arbitrum.
We plan to vote Abstain on this proposal.
Overall, we agree that setting up an audit program would be valuable, as lowering one of the most prohibitive costs that early-stage teams face can be a great way to attract more projects to the ecosystem and help them reach mainnet faster/safer. We also appreciate the Foundation’s plan to include exclusivity clauses so that funded projects are committed to keep building on Arbitrum.
That said, while we understand that audits can be costly, the $10M budget seems high compared to similar programs. We’re also not fully convinced that negotiating with auditors on a one-off basis for each approved project is the best approach in terms of both price and scheduling.
Have you considered purchasing bulk audit packages with select auditors upfront? Based on our experience running similar programs, these pre-negotiated deals often come with significant discounts (10–30% below standard rates) and let you reserve audit slots months in advance. This can be especially useful given that audit firms typically have lengthy wait times, which can stall project launches.
Voting "Abstain" for the moment. Broadly, I support the idea as I think both audits are important to the security of the network and audits can be a roadblock to prospective builders. However, I'm still a little torn on the execution, and would like to see how continued refinement with a Tally proposal goes. I'm generally not a huge fan of the AF asking the DAO for funds, but I acknowledge there is also an element of 'filling a void' here as there hasn't really been a DAO led / third-party funded solution to this that has gained much traction. A lot of discussion around this - look forward to seeing the final interation w'/ tally
We are supportive of this proposal.
We have full faith in OCL & the AF to execute a well-managed program on behalf of the DAO. Ultimately, this proposal continues to add to Arbitrum's attractiveness for builders while promoting a safer ecosystem.
Some concerns we have:
We are supportive of this proposal.
We have full faith in OCL & the AF to execute a well-managed program on behalf of the DAO. Ultimately, this proposal continues to add to Arbitrum's attractiveness for builders while promoting a safer ecosystem.
Some concerns we have:
Im going to ABSTAIN mi vote on this one, even though I do think it is importan to have a an audition before launching a new project, it is not clear enough why do we need to improve the audit selection and facilitation process. I’m trusting that the Arbitrum Foundation has well qualify expertise on selecting wich projects should be executed.
Camelot is voting “Abstain” on the Arbitrum Audit Program. We believe the initiative is well-intended and necessary. We also welcome the formation of an evaluation committee in which the Foundation and Offchain Labs play a predominant role, as they are uniquely positioned to properly assess the value a protocol can bring to our ecosystem.
That said, several aspects remain unclear, such as the disclosure mechanism for information. Most importantly, there should be clarification on whether this program is exclusively for newly launched protocols or if it also includes existing ones. In the former case, we believe the initiative is overbudgeted. In the latter case, there should be clear guidelines on which projects are eligible to participate.
I voted ABSTAIN in Snapshot because, while the motivations of the proposal are valid and it would provide crucial opportunities for emerging projects that, due to limited budgets, are unable to start their audits, the existence of a previous project with the same objective complicated my decision.
This previous project has already been approved, so why should we accept a new proposal with the same goals? This is not to detract from the current AF proposal, as I fully support its cause and recognize the importance of auditing and supporting initial projects.
I voted ABSTAIN in Snapshot because, while the motivations of the proposal are valid and it would provide crucial opportunities for emerging projects that, due to limited budgets, are unable to start their audits, the existence of a previous project with the same objective complicated my decision.
This previous project has already been approved, so why should we accept a new proposal with the same goals? This is not to detract from the current AF proposal, as I fully support its cause and recognize the importance of auditing and supporting initial projects.
However, my uncertainty appears from the fact that investment has already been made in a previous initiative. Why do we need to approve another similar proposal when a project with the same goals is still underway? This could involve double the effort and resources, which is not justified. With the current information and the existence of ongoing discussions about the two initiatives, I prefered to abstain.
voting Against on the current offchain vote because I don't agree with internalizing into the Arbitrum Foundation, a job that the DAO was previously doing. Even when the service providers doing that job for the DAO were taking too long, wasting resources, denying audit subsidies to worthy projects, porting the whole program to competing ecosystems, etc. I don't condone the way the ADPC acted in their past 2 terms, but I also don't think internalizing this job into the Foundation is the right approach. What I think we need is an Arbitrum DAO run, dedicated Audit Subsidy program, that would run continuously and would report their actions to the DAO with the utmost transparency possible. And executed by new and fresh service providers that are exclusive to Arbitrum.
The following reflects the views of the Lampros DAO governance team, composed of Chain_L (@Blueweb), @Euphoria, and Hirangi Pandya (@Nyx), based on our combined research, analysis, and ideation.
We are voting FOR this proposal in the Snapshot voting.
The following reflects the views of the Lampros DAO governance team, composed of Chain_L (@Blueweb), @Euphoria, and Hirangi Pandya (@Nyx), based on our combined research, analysis, and ideation.
We are voting FOR this proposal in the Snapshot voting.
We attended both office hours for this proposal and, after reviewing the details, we believe this initiative is worth funding. We support initiatives that remove financial barriers for new projects. Many early-stage teams struggle to secure funding, and audits are one of the most expensive yet essential steps before launching.
Looking at the ADPC’s Security Subsidy Fund Report, we see strong demand for such programs. In just 8 weeks of the program, ADPC received a competitive number of applications from teams. Extending this support for a full year makes sense given the clear demand and potential impact on ecosystem growth.
the nature of protocols who could apply. Understanding that this proposal has a growth nature, we need to clarify if current protocols in arbitrum can apply, if protocols migrating/expanding from other chains can apply. And the answer likely can’t just be a single “yes” otherwise everybody who has to do an audit in arbitrum will come here making life of the committee miserable, there has to be some sort of wording on whom can apply
We also agree with @JoJo’s point that clear eligibility criteria should be outlined for protocols. It is important to define which protocols can apply to prevent the committee from being overwhelmed with applications. We would like to see these details clarified before the Tally vote.
And regarding the miscommunication between ADPC and the AF, we believe a structured communication channel between AF and DAO could help with which initiatives they are working on or planning for the future. Whether through monthly Governance Reporting Calls (GRCs) or forum updates, the DAO should be kept informed about ongoing initiatives. This will help avoid such overlapping efforts and improve coordination in the future.
Voted For: Controversy about this proposal comes from how this was handled and not the content of the proposal itself. From my understanding, the audit program at the moment doesn't exist, which is a bad thing. For many new projects (especially DeFi), audits are a crucial and most expensive task to do before launch. To be a welcoming chain, it would be awesome to help high-end projects with this. This is the reason I voted and support this proposal.
I do believe there is some room for improvement based on my feedback, like how we can make sure to get fair pricing. I suggested the "Sealed bid" method or any other to make sure we use all mechanisms to get a fair price. Also, I would love to see a push for collecting bids (offers) in ARB tokens, not in USD, so we would lower the ARB selling pressure.
I vote abstain because while I believe audit expenses can eat up/exceed available funds, funding audits in this way is basically handing out a grant with a purpose.
While I know that having a more holistic approach to grant disbursement (aka less silos, more of a one stop shop for small, medium, large grants and audit grants as separate entity) is utopian, I believe we can do a better job at making sure that the $ we spend is well invested/ incentives are aligned.
I vote abstain because while I believe audit expenses can eat up/exceed available funds, funding audits in this way is basically handing out a grant with a purpose.
While I know that having a more holistic approach to grant disbursement (aka less silos, more of a one stop shop for small, medium, large grants and audit grants as separate entity) is utopian, I believe we can do a better job at making sure that the $ we spend is well invested/ incentives are aligned.
Some ideas have already been mentioned but maybe we should include clauses that projects cannot deploy on other chains within x months? Or if further funds/support is needed (after the audit) put them in contact with relevant teams (disclaimer: I do not know if this is already being done)?
This being said I do believe it makes sense to have the AF is heavily involved/partially runs this program. Excited to see a V2 of this proposal, or having it go to Tally with some adjustments.
We vote FOR the proposal on Snapshot.
After reviewing the proposal, Foundation clarifications, delegate feedback, and recent calls, we support running the program under the new organization led by the Foundation and a technical expert, with OpCo participation in the future. This setup better accommodates the audit program's unique requirements, including a strong business development perspective and the need for projects to remain as stealth as possible.
We vote FOR the proposal on Snapshot.
After reviewing the proposal, Foundation clarifications, delegate feedback, and recent calls, we support running the program under the new organization led by the Foundation and a technical expert, with OpCo participation in the future. This setup better accommodates the audit program's unique requirements, including a strong business development perspective and the need for projects to remain as stealth as possible.
While it's unfortunate that miscommunications happened between the program authors and ADPC, we believe the DAO can look forward to more streamlined communication and collaboration moving forward. Both parties share a common goal, and the outputs from the ADPC program will be effectively leveraged to achieve a successful outcome.
If we assume, conservatively, that each project will receive a $100k subsidy, then with a $10m budget, we can subsidize around 100 projects to build on Arbitrum which is approximately 1.9 projects per week for 1 year.
One concern that we have is that a team of a few might struggle to manage about 1.9 projects per week. Considering that audit subsidy needs are ongoing and permanent, the program could evolve from a one-year initiative into a continuous support model. The allocated budget in this proposal could be reviewed after an initial six-month phase and then reused as needed.
I’m casting my vote in favor of this proposal on Tally.
Back in my first comment, I was pretty vocal about liking the main idea behind this program—giving early-stage projects a hand with the steep costs of smart contract audits so they can launch on Arbitrum without cutting corners on security. But I did flag three things that had me a bit concerned: how we’d keep projects from jumping ship after getting the subsidy, how this setup stands up against what the ADPC did before, and whether the budget was a bit too hefty. Since then, the proposal has gotten some solid updates, especially with the new sections on who’s eligible, how payments will work, and how they’ll keep us in the loop with transparency reports.
The updated proposal now explicitly states that audited code must remain exclusive to Arbitrum for a fixed period, with legal agreements enforcing this. Breaching exclusivity requires repaying the full subsidy to the DAO via the Arbitrum Foundation, with potential legal recourse or a DAO ban from future initiatives. This is a strong step toward ensuring commitment, though I still believe we could go further.
What if we added a rule where projects that abandon Arbitrum exclusivity within, say, 6 months after the exclusivity period ends have to pay back part of the subsidy in ARB tokens? The amount they’d owe could depend on how soon they leave—like, if they bail just 3 months after the exclusivity period, they’d repay 50% of the subsidy. I think this would give projects a real reason to stay committed to Arbitrum for the long haul, especially for those who might see the exclusivity period as just a box to check rather than a true commitment. Plus, it means the DAO gets some ARB back, which could grow in value over time and help the ecosystem even more.
Several good improvements that i see here:
any code audited will need to remain exclusive to our ecosystem for a fixed period of time.
Several good improvements that i see here:
any code audited will need to remain exclusive to our ecosystem for a fixed period of time.
We are targeting relatively early stage projects, projects that have demonstrated product market fit on Arbitrum, and finally projects that have remained loyal to our ecosystem with an upcoming launch or upgrade that has the potential to help grow the ecosystem.
I like all of these addition which address most of what was proposed by several delegates. I also like adding one member of the opco because the sheer amount of work could potentially be important, and having more members involved in the DAO can be beneficial even just for comms and to keep context.
Im voting YES. Audits are simply a crucial part to create a safe environment for user and developer. It helps a brand getting stronger and getting a good reputation. Simply said, there is no downside.
I want to name the observation of an anti-pattern which I don't think is a good habit, and not serving of the DAO. It is evident in the current Audit proposal.
Observation: Overuse of Yes & Abstain at tempcheck stage hoping issues will be addressed doesn't work.
I have noticed a technique of delegates saying on the Forum I hope... I begrudgingly vote FOR at tempcheck but want to see x, y, z issues addressed before it goes to onchain voting (Tally).
Looking at history those issues are in the majority of time not addressed, the author gets a pass and the proposal sails through Tally stage because people don’t read, it's too much effort, no mechanism to force accountability.
This technique doesn’t work and delegates should not expect it to work, and imo should make use of the No in tempcheck more frequently.
I think that's more honouring of how the forum to tempcheck feedback loop should work, not expecting: snapshot pass + and all feedback is incorporated in the transition to Tally, history doesn’t reflect this "hope" being the case.
I'd invite delegates to stop doing this, use No as a valid step in an iterative feedback loop the DAO uses to converge and require proposal to take onboard feedback before going to onchain voting.
Curious other's thoughts on this dynamic
As in @web3citizenxyz representation. Voting FOR. Below the rationale:
In the end, I didn't get it.
I'm voting FOR this initiative. This is one of those proposals that empower startup apps that need those audits to start operating and polishing their code bases from vulnerabilities. However, I propose two changes to the current proposal:
First, while I understand the necessity of exchanging Arbitrum for USD to pay for auditing services, exchanging the $10 million in one swoop seems excessive. It can be done in three or four tranches whenever necessary, avoiding putting more selling pressure on the market.
I'm voting FOR this initiative. This is one of those proposals that empower startup apps that need those audits to start operating and polishing their code bases from vulnerabilities. However, I propose two changes to the current proposal:
First, while I understand the necessity of exchanging Arbitrum for USD to pay for auditing services, exchanging the $10 million in one swoop seems excessive. It can be done in three or four tranches whenever necessary, avoiding putting more selling pressure on the market.
Also, I suggest contacting already-known auditors from large firms for this task and negotiating a price for bulk operations.
If done correctly, this could help several projects to get their first leg up in defi, expediting processes that could take a considerable amount of time when done via individual proposals.
We agree with what the proposal is trying to achieve and believe that this subsidy scheme provided is a great initiative that would greatly help development on Arbitrum. While the miscommunication was unfortunate, the audit program and providing this form of support would still be a great way to help out in development of high quality projects on Arbitrum. At the very least it has been stated that the final goal between the Foundation and ADPC are aligned. However, just something that we would like to see be further touched up on are the evaluation metrics. We think that seeing how many projects launch on Arbitrum are a good start but TVL growth and measuring stuff like transaction volume on each of these audited projects and user activity should be considered too to truly understand how effective the program is in promoting growth.
Voting in favour of this. I think this will perform well under the AF. A DAO iniaitive has gone under the AF for efficiency purposes as far as i understand.
This is a plus in my eyes. They're supporting the dao. take it as a win
Blockworks Advisory will be voting Abstain on this proposal at the temperature check stage.
Similar to others, we have faith in OCL and AF to properly manage this program. The foundation likely has better expertise in this area, which position it better for selecting auditing services. We still are concerned about lock-in for protocols and would sincerely like this to be addressed. Otherwise it is very similar to just a grant, and thus the investment angle should be explored much further. We would especially like this to be elaborated on prior to any onchain vote.
Blockworks Advisory will be voting Abstain on this proposal at the temperature check stage.
Similar to others, we have faith in OCL and AF to properly manage this program. The foundation likely has better expertise in this area, which position it better for selecting auditing services. We still are concerned about lock-in for protocols and would sincerely like this to be addressed. Otherwise it is very similar to just a grant, and thus the investment angle should be explored much further. We would especially like this to be elaborated on prior to any onchain vote.
Furthermore, like both @WintermuteGovernance and @GFXLabs have said, the budget seems rather large both in general and in relation to other existing programs. There's also the matter that there is still some details that we would like to see, disclosures, additional clarity for protocols eligibility, outcome reporting, etc. As @krst stated, should this proposal pass we will expect the same level of transparency as we would from the ADPC team/other DAO teams.
We plan to vote Abstain on this proposal.
Overall, we agree that setting up an audit program would be valuable, as lowering one of the most prohibitive costs that early-stage teams face can be a great way to attract more projects to the ecosystem and help them reach mainnet faster/safer. We also appreciate the Foundation’s plan to include exclusivity clauses so that funded projects are committed to keep building on Arbitrum.
We plan to vote Abstain on this proposal.
Overall, we agree that setting up an audit program would be valuable, as lowering one of the most prohibitive costs that early-stage teams face can be a great way to attract more projects to the ecosystem and help them reach mainnet faster/safer. We also appreciate the Foundation’s plan to include exclusivity clauses so that funded projects are committed to keep building on Arbitrum.
That said, while we understand that audits can be costly, the $10M budget seems high compared to similar programs. We’re also not fully convinced that negotiating with auditors on a one-off basis for each approved project is the best approach in terms of both price and scheduling.
Have you considered purchasing bulk audit packages with select auditors upfront? Based on our experience running similar programs, these pre-negotiated deals often come with significant discounts (10–30% below standard rates) and let you reserve audit slots months in advance. This can be especially useful given that audit firms typically have lengthy wait times, which can stall project launches.
Voting "Abstain" for the moment. Broadly, I support the idea as I think both audits are important to the security of the network and audits can be a roadblock to prospective builders. However, I'm still a little torn on the execution, and would like to see how continued refinement with a Tally proposal goes. I'm generally not a huge fan of the AF asking the DAO for funds, but I acknowledge there is also an element of 'filling a void' here as there hasn't really been a DAO led / third-party funded solution to this that has gained much traction. A lot of discussion around this - look forward to seeing the final interation w'/ tally
We are supportive of this proposal.
We have full faith in OCL & the AF to execute a well-managed program on behalf of the DAO. Ultimately, this proposal continues to add to Arbitrum's attractiveness for builders while promoting a safer ecosystem.
Some concerns we have:
We are supportive of this proposal.
We have full faith in OCL & the AF to execute a well-managed program on behalf of the DAO. Ultimately, this proposal continues to add to Arbitrum's attractiveness for builders while promoting a safer ecosystem.
Some concerns we have:
Im going to ABSTAIN mi vote on this one, even though I do think it is importan to have a an audition before launching a new project, it is not clear enough why do we need to improve the audit selection and facilitation process. I’m trusting that the Arbitrum Foundation has well qualify expertise on selecting wich projects should be executed.
Camelot is voting “Abstain” on the Arbitrum Audit Program. We believe the initiative is well-intended and necessary. We also welcome the formation of an evaluation committee in which the Foundation and Offchain Labs play a predominant role, as they are uniquely positioned to properly assess the value a protocol can bring to our ecosystem.
That said, several aspects remain unclear, such as the disclosure mechanism for information. Most importantly, there should be clarification on whether this program is exclusively for newly launched protocols or if it also includes existing ones. In the former case, we believe the initiative is overbudgeted. In the latter case, there should be clear guidelines on which projects are eligible to participate.
I voted ABSTAIN in Snapshot because, while the motivations of the proposal are valid and it would provide crucial opportunities for emerging projects that, due to limited budgets, are unable to start their audits, the existence of a previous project with the same objective complicated my decision.
This previous project has already been approved, so why should we accept a new proposal with the same goals? This is not to detract from the current AF proposal, as I fully support its cause and recognize the importance of auditing and supporting initial projects.
I voted ABSTAIN in Snapshot because, while the motivations of the proposal are valid and it would provide crucial opportunities for emerging projects that, due to limited budgets, are unable to start their audits, the existence of a previous project with the same objective complicated my decision.
This previous project has already been approved, so why should we accept a new proposal with the same goals? This is not to detract from the current AF proposal, as I fully support its cause and recognize the importance of auditing and supporting initial projects.
However, my uncertainty appears from the fact that investment has already been made in a previous initiative. Why do we need to approve another similar proposal when a project with the same goals is still underway? This could involve double the effort and resources, which is not justified. With the current information and the existence of ongoing discussions about the two initiatives, I prefered to abstain.
voting Against on the current offchain vote because I don't agree with internalizing into the Arbitrum Foundation, a job that the DAO was previously doing. Even when the service providers doing that job for the DAO were taking too long, wasting resources, denying audit subsidies to worthy projects, porting the whole program to competing ecosystems, etc. I don't condone the way the ADPC acted in their past 2 terms, but I also don't think internalizing this job into the Foundation is the right approach. What I think we need is an Arbitrum DAO run, dedicated Audit Subsidy program, that would run continuously and would report their actions to the DAO with the utmost transparency possible. And executed by new and fresh service providers that are exclusive to Arbitrum.
The following reflects the views of the Lampros DAO governance team, composed of Chain_L (@Blueweb), @Euphoria, and Hirangi Pandya (@Nyx), based on our combined research, analysis, and ideation.
We are voting FOR this proposal in the Snapshot voting.
The following reflects the views of the Lampros DAO governance team, composed of Chain_L (@Blueweb), @Euphoria, and Hirangi Pandya (@Nyx), based on our combined research, analysis, and ideation.
We are voting FOR this proposal in the Snapshot voting.
We attended both office hours for this proposal and, after reviewing the details, we believe this initiative is worth funding. We support initiatives that remove financial barriers for new projects. Many early-stage teams struggle to secure funding, and audits are one of the most expensive yet essential steps before launching.
Looking at the ADPC’s Security Subsidy Fund Report, we see strong demand for such programs. In just 8 weeks of the program, ADPC received a competitive number of applications from teams. Extending this support for a full year makes sense given the clear demand and potential impact on ecosystem growth.
the nature of protocols who could apply. Understanding that this proposal has a growth nature, we need to clarify if current protocols in arbitrum can apply, if protocols migrating/expanding from other chains can apply. And the answer likely can’t just be a single “yes” otherwise everybody who has to do an audit in arbitrum will come here making life of the committee miserable, there has to be some sort of wording on whom can apply
We also agree with @JoJo’s point that clear eligibility criteria should be outlined for protocols. It is important to define which protocols can apply to prevent the committee from being overwhelmed with applications. We would like to see these details clarified before the Tally vote.
And regarding the miscommunication between ADPC and the AF, we believe a structured communication channel between AF and DAO could help with which initiatives they are working on or planning for the future. Whether through monthly Governance Reporting Calls (GRCs) or forum updates, the DAO should be kept informed about ongoing initiatives. This will help avoid such overlapping efforts and improve coordination in the future.
Voted For: Controversy about this proposal comes from how this was handled and not the content of the proposal itself. From my understanding, the audit program at the moment doesn't exist, which is a bad thing. For many new projects (especially DeFi), audits are a crucial and most expensive task to do before launch. To be a welcoming chain, it would be awesome to help high-end projects with this. This is the reason I voted and support this proposal.
I do believe there is some room for improvement based on my feedback, like how we can make sure to get fair pricing. I suggested the "Sealed bid" method or any other to make sure we use all mechanisms to get a fair price. Also, I would love to see a push for collecting bids (offers) in ARB tokens, not in USD, so we would lower the ARB selling pressure.
I vote abstain because while I believe audit expenses can eat up/exceed available funds, funding audits in this way is basically handing out a grant with a purpose.
While I know that having a more holistic approach to grant disbursement (aka less silos, more of a one stop shop for small, medium, large grants and audit grants as separate entity) is utopian, I believe we can do a better job at making sure that the $ we spend is well invested/ incentives are aligned.
I vote abstain because while I believe audit expenses can eat up/exceed available funds, funding audits in this way is basically handing out a grant with a purpose.
While I know that having a more holistic approach to grant disbursement (aka less silos, more of a one stop shop for small, medium, large grants and audit grants as separate entity) is utopian, I believe we can do a better job at making sure that the $ we spend is well invested/ incentives are aligned.
Some ideas have already been mentioned but maybe we should include clauses that projects cannot deploy on other chains within x months? Or if further funds/support is needed (after the audit) put them in contact with relevant teams (disclaimer: I do not know if this is already being done)?
This being said I do believe it makes sense to have the AF is heavily involved/partially runs this program. Excited to see a V2 of this proposal, or having it go to Tally with some adjustments.
We vote FOR the proposal on Snapshot.
After reviewing the proposal, Foundation clarifications, delegate feedback, and recent calls, we support running the program under the new organization led by the Foundation and a technical expert, with OpCo participation in the future. This setup better accommodates the audit program's unique requirements, including a strong business development perspective and the need for projects to remain as stealth as possible.
We vote FOR the proposal on Snapshot.
After reviewing the proposal, Foundation clarifications, delegate feedback, and recent calls, we support running the program under the new organization led by the Foundation and a technical expert, with OpCo participation in the future. This setup better accommodates the audit program's unique requirements, including a strong business development perspective and the need for projects to remain as stealth as possible.
While it's unfortunate that miscommunications happened between the program authors and ADPC, we believe the DAO can look forward to more streamlined communication and collaboration moving forward. Both parties share a common goal, and the outputs from the ADPC program will be effectively leveraged to achieve a successful outcome.
If we assume, conservatively, that each project will receive a $100k subsidy, then with a $10m budget, we can subsidize around 100 projects to build on Arbitrum which is approximately 1.9 projects per week for 1 year.
One concern that we have is that a team of a few might struggle to manage about 1.9 projects per week. Considering that audit subsidy needs are ongoing and permanent, the program could evolve from a one-year initiative into a continuous support model. The allocated budget in this proposal could be reviewed after an initial six-month phase and then reused as needed.
Camelot is voting “Abstain” on the Arbitrum Audit Program. We believe the initiative is well-intended and necessary. We also welcome the formation of an evaluation committee in which the Foundation and Offchain Labs play a predominant role, as they are uniquely positioned to properly assess the value a protocol can bring to our ecosystem.
That said, several aspects remain unclear, such as the disclosure mechanism for information. Most importantly, there should be clarification on whether this program is exclusively for newly launched protocols or if it also includes existing ones. In the former case, we believe the initiative is overbudgeted. In the latter case, there should be clear guidelines on which projects are eligible to participate.
Overall, we believe that key, high-impact projects within the Arbitrum ecosystem should have the opportunity to be part of this initiative. This would allow the Audit Program not only to support the growth of new participants but also to strengthen the projects that currently contribute the most on-chain value.
We expect to add exclusivity clauses to nearly all agreements for new projects who have not yet launched or existing projects whenever it is reasonably doable.
We expect to add exclusivity clauses to nearly all agreements for new projects who have not yet launched or existing projects whenever it is reasonably doable.
We will prioritise projects who are leveraging Arbitrum’s core technology stack, like a smart contract for stylus or deploying their own chain.
Since you have reassured me about my fear that projects will use the audit money and then move on to other solutions: Voted For
I think Arbitrum Audit Program will help new projects on Arbitrum pay for security audits, which are very expensive but very important. It will make sure smart contracts are safe and protect users’ money.
I believe that the safety of users who use Arbitrum should come first. Everything is simple here. It's like a bank. The more reliable the bank, the more clients it has. It follows from this that the more reliable the projects on Arbitrum, the more users trust us with their funds. It turns out that the higher the security, the more people use Arbitrum!
I’ve decided to vote in favor of this proposal at the temp-check stage, as I agree with the need for an efficient and consistently available audit support system for projects. However, I believe some aspects require further elaboration before proceeding to the tally stage.
Even though the proposal shows consideration of lessons learned from the previous ADPC program (among which the involvement of an expert), I have concerns about the potential for this program to become a misallocation of resources (especially given the budget that is being requested). Echoing @pedrob ’s sentiment, I’d like to see more concrete measures to ensure this program doesn’t go in that direction with also vendors potentially taking advantage of it.
I did a bit of a dive into this but as I am currently at ETHDenver and need more time to dive deep into this one, so I will abstain for now, and save my vote for Tally if it get there. I hope (and trust) that the Arbitrum Foundation collaborates closely with the ADPC to refine the program, ensuring it complements existing initiatives without redundancy.
We vote against the proposal because, despite its good intentions, the process has been rushed without addressing key concerns. The recent unrecorded governance call, as highlighted by @KlausBrave, has left many without crucial context, and bypassing the established ADPC framework, as noted by @CastleCapital, consolidates too much power in the Foundation. Until these transparency and integration issues are resolved through a more inclusive, recorded, and deliberative process, we cannot support the proposal.
I abstained from voting because while security audits are crucial, this proposal lacks sufficient justification for creating a new program instead of improving the existing ADPC Security Subsidy Fund. Also, I’d like to see a stronger commitment to treasury management (keeping funds in ARB) and clearer accountability mechanisms. Until these concerns are addressed, I prefer not to take a stance.
The following reflects the views of GMX’s Governance Committee and is based on the combined research, evaluation, consensus, and ideation of various committee members.
The Arbitrum Audit Committee is an initiative led by the Arbitrum Foundation (AF) and Offchain Labs (OCL). The committee will consist of members from AF, OCL, one member elected by the DAO, and one member from the OpCo (once operational). The program is planned to run for one year.
The following reflects the views of GMX’s Governance Committee and is based on the combined research, evaluation, consensus, and ideation of various committee members.
The Arbitrum Audit Committee is an initiative led by the Arbitrum Foundation (AF) and Offchain Labs (OCL). The committee will consist of members from AF, OCL, one member elected by the DAO, and one member from the OpCo (once operational). The program is planned to run for one year.
◦ The Foundation had initially planned to run this program before the ADPC (Arbitrum DAO Procurement Committee). CoinFlip, one of the contributors, was actively involved in discussions with the Foundation. However, the ADPC implemented a similar program first, which was highly successful and well-managed. GMX was one of the recipients of this successful program. ◦ The proposal addresses a critical need in the ecosystem by subsidizing audit costs for projects, which is a significant barrier for many builders. ◦ It outlines a well-defined process for project selection, auditor approval, and fund allocation. The inclusion of a committee with technical expertise ensures rigorous evaluation of projects—a gap that existed in the ADPC program. ◦ The commitment to publish quarterly updates ensures accountability and allows the DAO to track the program’s progress and impact. ◦ The ADPC, in its second iteration, did not include the audit program in its scope of work. Even if they were to implement it, the process would take considerable time. Therefore, the Foundation leading this initiative is logical and timely. ◦ Implement a competitive bidding process for auditors to ensure fair pricing and prevent monopolization. Consider capping the number of projects per auditor to promote diversity. ◦ The handling of this proposal could have been more professional between the Foundation and the ADPC. Future proposals should be developed in consultation with key stakeholders to avoid duplication of efforts and foster a cooperative ecosystem. ◦ Will the application be on a rolling basis? How much will these audits be capped and how much % of the audit does the committee plan to cover? ADPC created their own tooling infrastructure for the program will the foundation utilise it or create their own? how do you decide who gets audits approved? what is the strategy?
The DAO currently lacks an active audit program, and launching this initiative at the earliest could be highly beneficial for the ecosystem. Based on our daily interactions with builders, audit support is one of the most frequently requested forms of assistance. The first iteration of the ADPC’s audit program was highly successful, and this new proposal builds on that foundation while addressing previous gaps.
I think this proposal makes a lot of sense. Audits are costly, and allocating $10M from the Arbitrum DAO to cover part of these costs can significantly alleviate this burden. As previously mentioned in some of my comments, investing in and boosting the Arbitrum ecosystem is essential with the L2 competition going on, and this proposal is a step in the right direction.
Two key considerations:
I think this proposal makes a lot of sense. Audits are costly, and allocating $10M from the Arbitrum DAO to cover part of these costs can significantly alleviate this burden. As previously mentioned in some of my comments, investing in and boosting the Arbitrum ecosystem is essential with the L2 competition going on, and this proposal is a step in the right direction.
Two key considerations:
Implementing such a program can give Arbitrum a competitive edge in attracting builders and value in the Layer 2 landscape. I find the proposal well-designed and the overall cost related to the committee to be small and very competitive.
While I strongly support this proposal, I will vote 'Abstain' to help reach the quorum and avoid any potential COI. As mentionned I work for Kleros, which is building its V2 natively on Arbitrum (more information here), and we could potentially benefit from this program in the future.
Currently voting in favor as support, with few things to address in tally that have been mentioned in the calls but are not clear enough in the proposal:
This is a really big budget. The comparable program at Optimism tends to be running at ~2m OP per year. 30m ARB seems hard to deploy in a meaningful way over 12 months.
Reflecting most comments made, I do support it for the current stage but it needs to address concerns made by several people like Klaus. Voting yes.
I will be voting AGAINST this proposal on Snapshot. While the overall sentiment and goals behind a separate Audit Program are more than justified, I think there is some clear overlap between it and what should ultimately be part of the ADPC's mission.
Reading @adpc's response it's obvious this proposal was born out of dissatisfaction with the ADPC's results or its failure to be deployed quickly, but there was miscommunication between both parties and we should really be asking ourselves if that alone warrants shelling out an extra $10M on a different program.
I will be voting AGAINST this proposal on Snapshot. While the overall sentiment and goals behind a separate Audit Program are more than justified, I think there is some clear overlap between it and what should ultimately be part of the ADPC's mission.
Reading @adpc's response it's obvious this proposal was born out of dissatisfaction with the ADPC's results or its failure to be deployed quickly, but there was miscommunication between both parties and we should really be asking ourselves if that alone warrants shelling out an extra $10M on a different program.
Procurement of proper auditors should be the number one concern for any audit program, and I think this could/should be achieved with involvement from both actors, if the audit program were to be passed.
Would it be worth considering giving the ADPC a seat at the committee in a revised version of this proposal?
I appreciate adding a seat for an OpCo representative, and have no objections towards the budget and structure, save for the immediate need to request the 30M ARB, in spite of not knowing how much will actually be spent and thus possibly adding a bit of unneeded selling pressure (even if unused funds are returned in USDC and ARB).
Recapping, I don't think this proposal should move forward without establishing a better integration of it within the ADPC's goals or its role within the proposed Audit Program.
We voted Against the proposal on Snapshot.
Although we support the overall goal of the proposed program, we believe the Arbitrum Foundation (AF) has moved forward without adequately addressing existing concerns, particularly those raised by delegates around why the ADPC framework wasn’t fully utilized. These should have been addressed before the proposal goes to Snapshot. We believe these points should first be resolved in a way that satisfies everyone involved, as suggested by @KlausBrave:
While it is true that some projects within the Arbitrum ecosystem have delayed launches due to insufficient audit funding, this proposal still has notable shortcomings:
I voted FOR the proposal on Snapshot. I'd like to add here that the Arbitrum DAO has recently begun the process of selecting Arbitrum's strategic objectives (SOS). Eventually this will lead to initiatives that will help launch apps/projects on Arbitrum that align with these objectives. Why do I mention that? I hope Arbitrum Audit Committee will prioritize such projects and dApps.
I think the Arbitrum Audit Program has a lot of potential and addresses an important need. Smart contract audits are essential, especially for early-stage projects that might not have the resources to afford them. Helping these teams launch securely not only protects users but also strengthens the entire Arbitrum ecosystem. I also appreciate the idea of offering subsidies as investments in some cases, which could help align projects with Arbitrum over the long term.
That said, I have some reservations about whether this program will be more effective than the ADPC Security Subsidy Fund, which has already demonstrated strong results.
After reviewing the proposal, forum discussions, and the last calls, I've found several practical considerations worth sharing.
Regarding the audit costs, I was not aware of the barrier this represents for projects building on Arbitrum. Considering what @stonecoldpat mentioned in the meeting about audit costing “anything between like $50k $100k or $200k depending on the size of your code”, I understand the hurdles teams face in early-stage funding. It is important to make these subsidies readily available for the growth of the ecosystem.
I voted FOR, as I believe this is something the DAO can provide for the builders of the ecosystem.
However, I still hope that the text is amended to clarify the item regarding turning the grant into an investment. That was lost in the conversation, and should be addressed before going to Tally vote.
LobbyFi’s rationale on the price and making the voting power available for sale for this proposal
We regard this proposal as one profiting the broader community, with (potentially) 100 projects on Arbitrum to undergo a security audit. Therefore, we will obviously make the auction model available for this proposal.
LobbyFi’s rationale on the price and making the voting power available for sale for this proposal
We regard this proposal as one profiting the broader community, with (potentially) 100 projects on Arbitrum to undergo a security audit. Therefore, we will obviously make the auction model available for this proposal.
Since the most of the asked amount is going toward paing for audits directly, the price of the instant buy will be a 2% of the "technical expert's" compensations that is to be appointed internally ($60k * 2% ≈ 0.45 ETH).
I am voting in favor of this proposal. It is the type of proposal that allows for the growth of the ecosystem, and we need it. The only thing I would suggest (besides maybe waiting another week, as looking at the comments might make it seem rushed, but now is on snapshot so doesn't matter) is a commitment to more clarity in the selection process before moving to Tally. In the last ADPC, for example, we had excellent documentation, but there was no mention of the projects that applied and were rejected, or the reasons behind it. I understand this could stem from data and privacy concerns, but overall, I believe the benefits of disclosing the full selection process outweigh keeping it gated.
Entropy has posted this proposal to Snapshot on behalf of the Arbitrum Foundation. It is now live for voting.
Camelot is voting “Abstain” on the Arbitrum Audit Program. We believe the initiative is well-intended and necessary. We also welcome the formation of an evaluation committee in which the Foundation and Offchain Labs play a predominant role, as they are uniquely positioned to properly assess the value a protocol can bring to our ecosystem.
That said, several aspects remain unclear, such as the disclosure mechanism for information. Most importantly, there should be clarification on whether this program is exclusively for newly launched protocols or if it also includes existing ones. In the former case, we believe the initiative is overbudgeted. In the latter case, there should be clear guidelines on which projects are eligible to participate.
Overall, we believe that key, high-impact projects within the Arbitrum ecosystem should have the opportunity to be part of this initiative. This would allow the Audit Program not only to support the growth of new participants but also to strengthen the projects that currently contribute the most on-chain value.
We expect to add exclusivity clauses to nearly all agreements for new projects who have not yet launched or existing projects whenever it is reasonably doable.
We expect to add exclusivity clauses to nearly all agreements for new projects who have not yet launched or existing projects whenever it is reasonably doable.
We will prioritise projects who are leveraging Arbitrum’s core technology stack, like a smart contract for stylus or deploying their own chain.
Since you have reassured me about my fear that projects will use the audit money and then move on to other solutions: Voted For
I think Arbitrum Audit Program will help new projects on Arbitrum pay for security audits, which are very expensive but very important. It will make sure smart contracts are safe and protect users’ money.
I believe that the safety of users who use Arbitrum should come first. Everything is simple here. It's like a bank. The more reliable the bank, the more clients it has. It follows from this that the more reliable the projects on Arbitrum, the more users trust us with their funds. It turns out that the higher the security, the more people use Arbitrum!
I’ve decided to vote in favor of this proposal at the temp-check stage, as I agree with the need for an efficient and consistently available audit support system for projects. However, I believe some aspects require further elaboration before proceeding to the tally stage.
Even though the proposal shows consideration of lessons learned from the previous ADPC program (among which the involvement of an expert), I have concerns about the potential for this program to become a misallocation of resources (especially given the budget that is being requested). Echoing @pedrob ’s sentiment, I’d like to see more concrete measures to ensure this program doesn’t go in that direction with also vendors potentially taking advantage of it.
I did a bit of a dive into this but as I am currently at ETHDenver and need more time to dive deep into this one, so I will abstain for now, and save my vote for Tally if it get there. I hope (and trust) that the Arbitrum Foundation collaborates closely with the ADPC to refine the program, ensuring it complements existing initiatives without redundancy.
We vote against the proposal because, despite its good intentions, the process has been rushed without addressing key concerns. The recent unrecorded governance call, as highlighted by @KlausBrave, has left many without crucial context, and bypassing the established ADPC framework, as noted by @CastleCapital, consolidates too much power in the Foundation. Until these transparency and integration issues are resolved through a more inclusive, recorded, and deliberative process, we cannot support the proposal.
I abstained from voting because while security audits are crucial, this proposal lacks sufficient justification for creating a new program instead of improving the existing ADPC Security Subsidy Fund. Also, I’d like to see a stronger commitment to treasury management (keeping funds in ARB) and clearer accountability mechanisms. Until these concerns are addressed, I prefer not to take a stance.
The following reflects the views of GMX’s Governance Committee and is based on the combined research, evaluation, consensus, and ideation of various committee members.
The Arbitrum Audit Committee is an initiative led by the Arbitrum Foundation (AF) and Offchain Labs (OCL). The committee will consist of members from AF, OCL, one member elected by the DAO, and one member from the OpCo (once operational). The program is planned to run for one year.
The following reflects the views of GMX’s Governance Committee and is based on the combined research, evaluation, consensus, and ideation of various committee members.
The Arbitrum Audit Committee is an initiative led by the Arbitrum Foundation (AF) and Offchain Labs (OCL). The committee will consist of members from AF, OCL, one member elected by the DAO, and one member from the OpCo (once operational). The program is planned to run for one year.
◦ The Foundation had initially planned to run this program before the ADPC (Arbitrum DAO Procurement Committee). CoinFlip, one of the contributors, was actively involved in discussions with the Foundation. However, the ADPC implemented a similar program first, which was highly successful and well-managed. GMX was one of the recipients of this successful program. ◦ The proposal addresses a critical need in the ecosystem by subsidizing audit costs for projects, which is a significant barrier for many builders. ◦ It outlines a well-defined process for project selection, auditor approval, and fund allocation. The inclusion of a committee with technical expertise ensures rigorous evaluation of projects—a gap that existed in the ADPC program. ◦ The commitment to publish quarterly updates ensures accountability and allows the DAO to track the program’s progress and impact. ◦ The ADPC, in its second iteration, did not include the audit program in its scope of work. Even if they were to implement it, the process would take considerable time. Therefore, the Foundation leading this initiative is logical and timely. ◦ Implement a competitive bidding process for auditors to ensure fair pricing and prevent monopolization. Consider capping the number of projects per auditor to promote diversity. ◦ The handling of this proposal could have been more professional between the Foundation and the ADPC. Future proposals should be developed in consultation with key stakeholders to avoid duplication of efforts and foster a cooperative ecosystem. ◦ Will the application be on a rolling basis? How much will these audits be capped and how much % of the audit does the committee plan to cover? ADPC created their own tooling infrastructure for the program will the foundation utilise it or create their own? how do you decide who gets audits approved? what is the strategy?
The DAO currently lacks an active audit program, and launching this initiative at the earliest could be highly beneficial for the ecosystem. Based on our daily interactions with builders, audit support is one of the most frequently requested forms of assistance. The first iteration of the ADPC’s audit program was highly successful, and this new proposal builds on that foundation while addressing previous gaps.
I think this proposal makes a lot of sense. Audits are costly, and allocating $10M from the Arbitrum DAO to cover part of these costs can significantly alleviate this burden. As previously mentioned in some of my comments, investing in and boosting the Arbitrum ecosystem is essential with the L2 competition going on, and this proposal is a step in the right direction.
Two key considerations:
I think this proposal makes a lot of sense. Audits are costly, and allocating $10M from the Arbitrum DAO to cover part of these costs can significantly alleviate this burden. As previously mentioned in some of my comments, investing in and boosting the Arbitrum ecosystem is essential with the L2 competition going on, and this proposal is a step in the right direction.
Two key considerations:
Implementing such a program can give Arbitrum a competitive edge in attracting builders and value in the Layer 2 landscape. I find the proposal well-designed and the overall cost related to the committee to be small and very competitive.
While I strongly support this proposal, I will vote 'Abstain' to help reach the quorum and avoid any potential COI. As mentionned I work for Kleros, which is building its V2 natively on Arbitrum (more information here), and we could potentially benefit from this program in the future.
Currently voting in favor as support, with few things to address in tally that have been mentioned in the calls but are not clear enough in the proposal:
This is a really big budget. The comparable program at Optimism tends to be running at ~2m OP per year. 30m ARB seems hard to deploy in a meaningful way over 12 months.
Reflecting most comments made, I do support it for the current stage but it needs to address concerns made by several people like Klaus. Voting yes.
I will be voting AGAINST this proposal on Snapshot. While the overall sentiment and goals behind a separate Audit Program are more than justified, I think there is some clear overlap between it and what should ultimately be part of the ADPC's mission.
Reading @adpc's response it's obvious this proposal was born out of dissatisfaction with the ADPC's results or its failure to be deployed quickly, but there was miscommunication between both parties and we should really be asking ourselves if that alone warrants shelling out an extra $10M on a different program.
I will be voting AGAINST this proposal on Snapshot. While the overall sentiment and goals behind a separate Audit Program are more than justified, I think there is some clear overlap between it and what should ultimately be part of the ADPC's mission.
Reading @adpc's response it's obvious this proposal was born out of dissatisfaction with the ADPC's results or its failure to be deployed quickly, but there was miscommunication between both parties and we should really be asking ourselves if that alone warrants shelling out an extra $10M on a different program.
Procurement of proper auditors should be the number one concern for any audit program, and I think this could/should be achieved with involvement from both actors, if the audit program were to be passed.
Would it be worth considering giving the ADPC a seat at the committee in a revised version of this proposal?
I appreciate adding a seat for an OpCo representative, and have no objections towards the budget and structure, save for the immediate need to request the 30M ARB, in spite of not knowing how much will actually be spent and thus possibly adding a bit of unneeded selling pressure (even if unused funds are returned in USDC and ARB).
Recapping, I don't think this proposal should move forward without establishing a better integration of it within the ADPC's goals or its role within the proposed Audit Program.
We voted Against the proposal on Snapshot.
Although we support the overall goal of the proposed program, we believe the Arbitrum Foundation (AF) has moved forward without adequately addressing existing concerns, particularly those raised by delegates around why the ADPC framework wasn’t fully utilized. These should have been addressed before the proposal goes to Snapshot. We believe these points should first be resolved in a way that satisfies everyone involved, as suggested by @KlausBrave:
While it is true that some projects within the Arbitrum ecosystem have delayed launches due to insufficient audit funding, this proposal still has notable shortcomings:
I voted FOR the proposal on Snapshot. I'd like to add here that the Arbitrum DAO has recently begun the process of selecting Arbitrum's strategic objectives (SOS). Eventually this will lead to initiatives that will help launch apps/projects on Arbitrum that align with these objectives. Why do I mention that? I hope Arbitrum Audit Committee will prioritize such projects and dApps.
I think the Arbitrum Audit Program has a lot of potential and addresses an important need. Smart contract audits are essential, especially for early-stage projects that might not have the resources to afford them. Helping these teams launch securely not only protects users but also strengthens the entire Arbitrum ecosystem. I also appreciate the idea of offering subsidies as investments in some cases, which could help align projects with Arbitrum over the long term.
That said, I have some reservations about whether this program will be more effective than the ADPC Security Subsidy Fund, which has already demonstrated strong results.
After reviewing the proposal, forum discussions, and the last calls, I've found several practical considerations worth sharing.
Regarding the audit costs, I was not aware of the barrier this represents for projects building on Arbitrum. Considering what @stonecoldpat mentioned in the meeting about audit costing “anything between like $50k $100k or $200k depending on the size of your code”, I understand the hurdles teams face in early-stage funding. It is important to make these subsidies readily available for the growth of the ecosystem.
I voted FOR, as I believe this is something the DAO can provide for the builders of the ecosystem.
However, I still hope that the text is amended to clarify the item regarding turning the grant into an investment. That was lost in the conversation, and should be addressed before going to Tally vote.
LobbyFi’s rationale on the price and making the voting power available for sale for this proposal
We regard this proposal as one profiting the broader community, with (potentially) 100 projects on Arbitrum to undergo a security audit. Therefore, we will obviously make the auction model available for this proposal.
LobbyFi’s rationale on the price and making the voting power available for sale for this proposal
We regard this proposal as one profiting the broader community, with (potentially) 100 projects on Arbitrum to undergo a security audit. Therefore, we will obviously make the auction model available for this proposal.
Since the most of the asked amount is going toward paing for audits directly, the price of the instant buy will be a 2% of the "technical expert's" compensations that is to be appointed internally ($60k * 2% ≈ 0.45 ETH).
I am voting in favor of this proposal. It is the type of proposal that allows for the growth of the ecosystem, and we need it. The only thing I would suggest (besides maybe waiting another week, as looking at the comments might make it seem rushed, but now is on snapshot so doesn't matter) is a commitment to more clarity in the selection process before moving to Tally. In the last ADPC, for example, we had excellent documentation, but there was no mention of the projects that applied and were rejected, or the reasons behind it. I understand this could stem from data and privacy concerns, but overall, I believe the benefits of disclosing the full selection process outweigh keeping it gated.
Entropy has posted this proposal to Snapshot on behalf of the Arbitrum Foundation. It is now live for voting.
We voted Against the proposal on Snapshot.
Although we support the overall goal of the proposed program, we believe the Arbitrum Foundation (AF) has moved forward without adequately addressing existing concerns, particularly those raised by delegates around why the ADPC framework wasn’t fully utilized. These should have been addressed before the proposal goes to Snapshot. We believe these points should first be resolved in a way that satisfies everyone involved, as suggested by @KlausBrave:
Quoted from KlausBrave
I would even go so far as to say AF should not proceed to snapshot without and before doing a repeat call, including ADPC/the relevant service providers & it must be recorded so all global DAO participants can access the information as part of decision making.
Right now, the proposal appears to stand apart from the existing ADPC framework and we agree with @PGov that there should be a more streamlined and consistent process to ensure that leverages existing structures:
Quoted from PGov
Since the ADPC has established procurement frameworks and whitelisted security service providers, prolly makes sense to move these existing structures to streamline the implementation of the new program,
In line with what @pedrob and @krst have highlighted, we think it’s essential for the AF to incorporate or at least improve upon already established frameworks rather than proposing an entirely separate approach:
Quoted from pedrob
I want to see those learnings materialized in a framework that is sustainable over time and does not rely on the Foundation stepping into the DAO and taking full ownership of the proposal, as I believe that is not a viable long-term solution.
Quoted from krst
We want to thank the ADPC for all the work they’ve done in setting up the framework and whitelisting security service providers. We hope to see the Foundation use the groundwork the ADPC has done and build on top of it.
While we have no objection to the ultimate aim of this proposal, we oppose the current process of pushing the proposal to Snapshot without first addressing the issues, and the feedback raised left a negative impression. A more inclusive approach would have strengthened the proposal, but seeing as it has moved to snapshot, we would prefer that the proposal be overhauled based on feedback received and have voted AGAINST.
I think the Arbitrum Audit Program has a lot of potential and addresses an important need. Smart contract audits are essential, especially for early-stage projects that might not have the resources to afford them. Helping these teams launch securely not only protects users but also strengthens the entire Arbitrum ecosystem. I also appreciate the idea of offering subsidies as investments in some cases, which could help align projects with Arbitrum over the long term.
That said, I have some reservations about whether this program will be more effective than the ADPC Security Subsidy Fund, which has already demonstrated strong results.
One of the strengths of this proposal is that it is cheaper than ADPC, as it only requires hiring one technical expert at $60K per year, compared to $360K per year under ADPC. However, cost efficiency alone does not necessarily mean better results.
I believe the Arbitrum Foundation has stronger technical expertise, which likely makes it better positioned to select the best auditing service providers and ensure a smooth audit facilitation process. This could help improve the quality and efficiency of audits under the new program.
However, ADPC has proven to be highly effective in other critical areas, particularly in maximizing Arbitrum’s exposure among protocols, building strong relationships, and creating synergies that support protocol growth beyond just audits. The Security Subsidy Fund Outcome Report highlights how ADPC successfully connected with top-tier protocols like GMX, Gamma Strategies, and D2 Finance, ensuring they remained within the Arbitrum ecosystem.
Additionally, ADPC’s marketing strategy was highly effective—they not only actively promoted the subsidy fund to attract top protocols but also leveraged their connections to amplify outreach. By collaborating with selected protocols, ADPC was able to use their marketing resources to further promote both the Security Subsidy Fund and Arbitrum’s ecosystem as a whole.
Given ADPC’s track record, I am uncertain whether the Arbitrum Audit Program will be able to replicate or improve upon these ecosystem-building efforts. While this new program may enhance the technical side of audits, it is unclear if it will achieve the same level of community engagement, exposure, and long-term protocol support that ADPC has demonstrated.
ADPC Security Subsidy Fund Outcome Report
While I see the potential benefits of this proposal, I remain uncertain about whether it will be a significant improvement over ADPC. The Arbitrum Foundation may have better technical expertise to optimize the audit selection and facilitation process, but ADPC has been exceptionally strong at ecosystem growth, marketing, and building lasting relationships with protocols. Additionally the cost savings is not enough that it's a major deciding factor for this proposal.
Until there is more clarity on how this program will build upon ADPC’s successes in those areas, I have decided to abstain from the vote.
I look forward to hearing more perspectives from the community and seeing how this discussion evolves as I am not totally against this proposal but feel it needs to be better constructed for me to support it.
After reviewing the proposal, forum discussions, and the last calls, I've found several practical considerations worth sharing.
Regarding the audit costs, I was not aware of the barrier this represents for projects building on Arbitrum. Considering what @stonecoldpat mentioned in the meeting about audit costing “anything between like $50k $100k or $200k depending on the size of your code”, I understand the hurdles teams face in early-stage funding. It is important to make these subsidies readily available for the growth of the ecosystem.
Accepting applications for only two weeks as previously approached could limit audit support for projects, so I believe that having a continuous application process, as proposed, would eliminate those service gaps. Builders should be allowed to seek support when they need it, not just when a window happens to be open.
The ADPC established a solid framework for the concept to be optimized further and scaled by the AF, additionally I agree with @pedrob’s comment on the need to develop a long-term, sustainable framework. Regarding the increased budget, I think it is fair to say that given the substantial demand shown in the Arbitrum Security Subsidy Fund: Outcome Report (56 applications with 22 selected) and considering a year-round availability of the program, this seems practical and beneficial overall.
A key final takeaway is that this is less about "who should run the program" and more about ensuring the ecosystem has consistent, funded audit support with minimal bureaucratic overhead.
Voting FOR in Snapshot.
I support subsidies for new projects to ensure that outstanding ones can get through the difficult early stages. However, I’ve seen many such proposals in the forum, but I haven’t seen suggestions for providing subsidies to real users. In the new year, 2025, I hope to see such proposals so that everyone can gain tangible benefits from the Arbitrum ecosystem. You have forgotten the users.FOR
I vote in favor of this proposal in the temp-check.
However, I want to clarify something: my signal in the temp-check specifically means that I agree with the motivation behind the proposal and the idea of “quickly” setting up a subsidy fund for audits—something essential to supporting developers in Arbitrum.
I vote in favor of this proposal in the temp-check.
However, I want to clarify something: my signal in the temp-check specifically means that I agree with the motivation behind the proposal and the idea of “quickly” setting up a subsidy fund for audits—something essential to supporting developers in Arbitrum.
That being said, I believe the proposal still needs some modifications for me to maintain this vote on Tally.
I attended the unrecorded call where the ADPC and the Foundation exchanged views on the execution of the subsidy fund and their approach moving forward. I understand there is an intention to collaborate, share ADPC's learnings, and strengthen the program. However, for me, that intention alone is not enough—I want to see those learnings materialized in a framework that is sustainable over time and does not rely on the Foundation stepping into the DAO and taking full ownership of the proposal, as I believe that is not a viable long-term solution.
I believe the process developed by the ADPC did have value, mainly in the criteria outlined for both auditors and projects selection. Maintaining continuity in the process and criteria provides predictability for auditors and projects looking to apply and how to improve for future applications. It also allows the DAO to replace program managers without friction or negatively impacting the program.
In that sense, building a new program from scratch will cause the very delays you are trying to avoid. And of course, this will happen again in the future.
I’m very happy to see you stepping up and getting more directly involved in the DAO. What concerns me, however, is the possibility of you taking ownership of the initiatives and starting from scratch, which could lead to the loss of sustainable frameworks that don’t rely on a single provider or manager (or at least with the intention of reaching that point.). It’s true that you may be the most suitable to execute this work and lead the committee, but I’d prefer that, as a DAO, we can be a bit more inefficient if it means developing frameworks that are sustainable over time for when you decide to step back again.
Additionally, I echo @krst comments and would like to see them explicitly incorporated into the proposal text.
One thing we’d like to point out about the proposal itself is that the Foundation will run the subsidy fund on behalf of the DAO using the DAO’s funds. As such, we’ll hold them to the same standard as any and all other contributors and service providers, and we actually expect them to be an example of what a DAO-funded program should look like.
Some thoughts on this Arbitrum Audit Program:
Some thoughts on this Arbitrum Audit Program:
Overall, our biggest concern points are with relation for ADPC and how the audit program can best interact between them.
I agree with @CastleCapital and @paulofonseca.
As a matter of policy all calls in Arbitrum should be recorded so all people can access relevant information in the deliberation and decision-making process, either real-time or async according to one's need and style.
I think every call in Arbitrum should be recorded as a policy and be on the record. This needs to be solved.
i.e. its not ok this controversial Audit call from earlier in this week was not recorded, I was not on it and don't have the required information to make a decision on this matter.
That's not good enough in my mind as a way for Arbitrum to operate and as a matter of priority this needs to get solved.
I would even go so far as to say AF should not proceed to snapshot without and before doing a repeat call, including ADPC/the relevant service providers & it must be recorded so all global DAO participants can access the information as part of decision making.
In addition for a controversial proposal I am not in favour of proposals being rushed to snapshot exactly at 7 days if forum dialogue isn't resolving/converging to a state that makes sense to move to Snapshot. I'm seeing more of this behaviour DAO wide and don't think its a good practice. I think proposal authors should take extra time and care if there is strong divergent sentiment to dig deeper and extend the deliberative process.
This proposal isn't only about this proposal it strikes to the heart of settling the expectations and agreements people understand and are experiencing unclarity in the social contract between Arbitrum Foundation and DAO service providers.
@stonecoldpat and those stewarding this from the Foundation, I invite slowing down at this pivotal moment staying with the tension and working through resolving/converging to something encompassing the real feedback of contributors.
Can we pause on taking this to Snapshot today and setup another meeting?
The program afaik is not intended to do investments. So why are you mentioning it? I can agree that, de facto, financing an important audit for a project is an indirect investment in the ecosystem, but is not the main focus here. @danielo above proposed this approach, which I could like, but we currently don’t have the structures/infra/legal to support this and is a bit soon (but also soon we could have the avi, we will have the opco, we will have sos goals that might match this). Anyway, feels like someone asking what time is it, and having as an answer “thursday”.
The program afaik is not intended to do investments. So why are you mentioning it? I can agree that, de facto, financing an important audit for a project is an indirect investment in the ecosystem, but is not the main focus here. @danielo above proposed this approach, which I could like, but we currently don’t have the structures/infra/legal to support this and is a bit soon (but also soon we could have the avi, we will have the opco, we will have sos goals that might match this). Anyway, feels like someone asking what time is it, and having as an answer “thursday”.
we don't have a fully streamlined setup for investments (that's coming) but we do have the ability to make investments and we already broke a lot of ground here with the Hackathon Continuation program. The Foundation has capabilities to sign investment contracts so if they're willing to allocate capacity here, I don't see why this would be a problem. Once a template contract is setup, the responsibility then falls to the team operating the program to negotiate these (which could be a challenge but not necessarily insurmountable).
What I'm understand is that the program proposed here moves us from partial subsidy of Audits to full subsidy, and this creates incentive misalignment (projects can abuse the program by getting crap audited). That seems like a move in the wrong direction and could be rectified by getting projects to bear part of the costs (current system as I understand) or otherwise by making audit subsidies an investment (with the complications mentioned above)
The following reflects the views of L2BEAT’s governance team, composed of @krst and @Sinkas. It’s based on their combined research, fact-checking, and ideation.
We want to thank the ADPC for all the work they’ve done in setting up the framework and whitelisting security service providers. We hope to see the Foundation use the groundwork the ADPC has done and build on top of it.
The following reflects the views of L2BEAT’s governance team, composed of @krst and @Sinkas. It’s based on their combined research, fact-checking, and ideation.
We want to thank the ADPC for all the work they’ve done in setting up the framework and whitelisting security service providers. We hope to see the Foundation use the groundwork the ADPC has done and build on top of it.
In our view, this is an expected pathway for many different initiatives the DAO undertakes; a third-party contributor proposes something and leads the charge, and once the concept is proven, the AF (or in the future, the OpCo) internalizes it and optimizes it to be as efficient as possible, creating value within the DAO structures.
At this time, the DAO has no way of providing a security audit subsidy to projects, given that the previous subsidy fund from the ADPC has run out and there have been no steps to renew it. In our view, it makes sense for the Foundation to administer the security subsidy fund, given its position and proximity to both builders and Arbitrum’s tech.
One thing we’d like to point out about the proposal itself is that the Foundation will run the subsidy fund on behalf of the DAO using the DAO’s funds. As such, we’ll hold them to the same standard as any and all other contributors and service providers, and we actually expect them to be an example of what a DAO-funded program should look like.
We would also like to emphasize that we see this program as a BD initiative that should first and foremost drive the growth of the Arbitrum ecosystem. Therefore, we expect that whoever the OCL and AF representatives will be in the committee, they will coordinate internally to make sure that the projects selected to receive audit grants are in line with Arbitrum's long-term growth strategy.
Hello and welcome @Q12 in the arbitrum forum. Quite a way to enter the arena.
I have no horse in this race but I am quite curious about your approach and several statements, to which I would gladly read some clarification if you would be kind enough to answer my questions.
One of these statements is untrue. Token holders deserve to know which version is accurate before being asked to trust the Foundation with $10M in DAO funds.
Hello and welcome @Q12 in the arbitrum forum. Quite a way to enter the arena.
I have no horse in this race but I am quite curious about your approach and several statements, to which I would gladly read some clarification if you would be kind enough to answer my questions.
One of these statements is untrue. Token holders deserve to know which version is accurate before being asked to trust the Foundation with $10M in DAO funds.
The Foundation proposes to run a $10M program with part-time, unpaid committee members “next to their everyday duties.” This is frankly absurd. You don’t run what you yourself call a “mission-critical” program as a side hobby. The proposed structure screams of inexperience in running professional investment operations.
The Foundation’s claim they will “waive fees” is either naive or deliberately misleading. These costs will simply be absorbed into their DAO-funded operational budget.
The Foundation operates as a neutral steward in order to support the ArbitrumDAO, the continuous innovation of the Arbitrum technology and the development and education of the Arbitrum community.
The Foundation literally has a budget to support the DAO. In the statement above you are trying to highlight in a negative light the equivalent of saying "the sky is blue". IMHO, of course.
The Foundation’s fixation on “technical expertise” demonstrates a basic misunderstanding of what this program requires. What’s needed is deep knowledge of the security services market and audit space - not generic technical knowledge. The ADPC demonstrated this understanding by engaging DeDaub, an established security firm. Why would a random technical person from the Foundation or OCL have more relevant expertise than actual auditing professionals? This misalignment of expertise requirements raises serious concerns about the Foundation’s ability to even properly scope this program.
I honestly think you are putting the cart in front of the horse here. There is a third, paid member, that could be literally dedaub or someone working for an audit firm. In the recent stylus program, we had 2 person from open zeppelin for example. More than saying that foundation has a "fixation", wouldn't it be better to highlight that the third member should be, in your opinion, someone with a deep knowledge of the security market? And so, maybe, only nominated and not elected by the DAO? (and btw i would tend to agree with this). As a final note, slamming ocl/af about technical expertise here feels excessive and uncalled. This is not to simply be a cheerleader: but all of this that we have now, this whole ecosystem, would not exists without these people. Saying that this expertise, paired with a third member that is vertical in security, doesn't count, is being short-sighted at best, ill intended at worst.
This is fundamentally an investment program requiring sophisticated venture capital and private equity experience in evaluating early-stage projects. The Foundation’s emphasis on technical expertise while completely ignoring the need for investment acumen shows a fundamental misunderstanding of what drives successful project selection and portfolio management. Where is the venture capital expertise on their proposed committee? Who has experience managing comparable investment programs?
The Foundation’s operational budget was not intended as a shadow grant program.
The Foundation’s complete failure to coordinate internally is alarming. They were actively working with the ADPC on this exact initiative, received a detailed proposal, and then launched a competing proposal without any communication. This level of organizational dysfunction raises serious questions about their capacity to manage complex programs.
Defining this situation as a complete failure seems a mix of being excessive or slandering. You choose what applies here best. Looking at the answer from the Foundation, there has been indeed miscommunication with both one party (areta/axis/daimon) and internally (people talking with adpc vs people preparing the proposal). This is something that yes, can improve and should improve. Looking at the opening roles for the AF, they are indeed looking for further people for dao relationship, and at the same time we as a dao need to better organize single PoC for verticals. Because I know for a fact that AF gets pinged by tons of individuals for tons of different things, with the people being pinged not necessarily in charge of taking this inbound request. I am digressing a bit here and I am not trying to justify anybody here. There is definitely margin of improvement in comms on all sides.
I don't honestly think this initiative is AF experimenting with dao funds: they want to pay audits for protocols in arbitrum.This is where you fall short. Coming in an anon form, to the dao, criticising at an horizontal level, and then proposing "a single one premier service" without knowing if you might have a conflict in proposing this is where everything that you wrote can just fall in credibility. To be clear: is not that the idea of subsidizing through a third party is necessarily wrong.
Now, you likely lost a decent amount of time in writing the above. I for sure lost at least 40 minutes trying to answer here, so let's try to take out something good for everybody involved in this discussion:
hey @Arbitrum do you intend to publish this proposal for offchain vote on snapshot, tomorrow?
We understand that an Office Hours was recently held but in light of this new information, would be prudent to have another discussion with both parties involved.
We understand that an Office Hours was recently held but in light of this new information, would be prudent to have another discussion with both parties involved.
...and also for the following calls to be recorded, and for those recordings to be shared with the DAO in this thread.
yesterday's call, as far as I'm aware, was not recorded unfortunately.
@Entropy can an Office Hours discussion which includes both members of the Foundation and ADPC be organized?
We feel it's better to thrash the issues being put forth by both @Arbitrum and @adpc prior to a vote on the proposal. We understand that an Office Hours was recently held but in light of this new information, would be prudent to have another discussion with both parties involved.
So another flagship for Arbitrum to attract and retain projects. It will encourage developers to choose Arbitrum which will help grow and expand our ecosystem.
That said, there are some things to consider before approving a $10M proposal. From my experience working with audit firms, $100K per project seems high tbh. Typically, it's around $30K-80K (from essential to premium packages). This even doesn’t include referral fees or discounts for handling 100 projects, so I may be wrong, but just wanted to raise this :)
So another flagship for Arbitrum to attract and retain projects. It will encourage developers to choose Arbitrum which will help grow and expand our ecosystem.
That said, there are some things to consider before approving a $10M proposal. From my experience working with audit firms, $100K per project seems high tbh. Typically, it's around $30K-80K (from essential to premium packages). This even doesn’t include referral fees or discounts for handling 100 projects, so I may be wrong, but just wanted to raise this :)
Like other delegates, I agree that paying in ARB more than USD would help reduce sell pressure for the DAO.
At the end of the day, if the proposal is passed, I hope the program will have a reimbursement process for projects that get audited but don’t perform well.
I don't agree with that. That's what we created the ADPC program for. We're duplicating their work in this proposal. Besides, I don't understand why the Arbitrum Foundation takes money for the program from DAO, and DAO barely participates in it.
See what ADPC writes here above
gm
Thank you very much for your detailed response. I agree with many of the opinions and learnings you've shared.
It took around ~10 months to stand up and complete the 8 week program. Unfortunately, this meant there was no security subsidy fund by the ArbitrumDAO for most of 2024.
gm @Arbitrum,
We appreciate the effort behind this proposal, it’s exactly what early-stage projects need and it helps created a more connected builder ecosystem within Arbitrum. That said, we have a few points we’d love more clarity on:
gm @Arbitrum,
We appreciate the effort behind this proposal, it’s exactly what early-stage projects need and it helps created a more connected builder ecosystem within Arbitrum. That said, we have a few points we’d love more clarity on:
Are there any lessons from that experience that could be applied?
It would help to know what you learned from ADPC and why you’re steering away from it.
Impact of the SOS Initiative With the SOS Initiative kicking off, has there been any thought on how that factors into selecting projects for the subsidy?
Broader Builder-Support Strategy While an audit subsidy is a great start, is there a larger plan for ongoing builder support? We think a more holistic approach—beyond audits—would help strengthen the entire Arbitrum ecosystem.
Overall, we agree on the value of running an audit subsidy program but would love to see a longer-term vision that supports existing and future builders on Arbitrum.
Hello, thanks for your proposal!
I have a few questions:
In fact, nothing will depend on the DAO’s vote and decisions made by the Arbitrum Foundation and Offchain Labs will override the DAO.
In my opinion, no one is better positioned than OCL and AF to evaluate the projects that can have a boost through audit, so I sincerely don't mind them taking the lead as they did already in the stylus program.
@Arbitrum , I appreciate this proposal and agree with the need for funding to support projects with audit expenses, which can be prohibitively expensive for many teams. However, I have some questions and concerns:
Differentiation from ADPC Subsidy Fund: Could you elaborate on how this new program significantly improves upon the revised ADPC Subsidy Fund? What specific shortcomings of the previous program does this address?
Timing and Evaluation: The ADPC has announced that they will be posting the Subsidy Fund Outcome report (https://forum.arbitrum.foundation/t/adpc-update-thread-phase-ii/27298/22) in the coming days. Wouldn't it be prudent to wait for this report before proceeding with a similar program / giving final shape to a new one? This would allow us to learn from issues of the previous program, identify areas for improvement and ensure we're not duplicating efforts unnecessarily.
I really like this proposal. Audit costs are a significant barrier to entry for early-stage projects, and subsidizing them for valuable teams is a highly effective way to support builders in the Arbitrum ecosystem. Security is critical, especially for new projects, and reducing the financial burden of audits will help ensure that promising teams can launch safely without cutting corners.
How are teams determined to be elegible for this support? I think its good that its removing that financial barrier from those teams but we should be a tad cautious not to overspend and audit every team.
Thank you for the offer. Supporting projects with audits is a great way to reduce potential user losses in the Arbitrum ecosystem
However, there are also questions:
We voted Against the proposal on Snapshot.
Although we support the overall goal of the proposed program, we believe the Arbitrum Foundation (AF) has moved forward without adequately addressing existing concerns, particularly those raised by delegates around why the ADPC framework wasn’t fully utilized. These should have been addressed before the proposal goes to Snapshot. We believe these points should first be resolved in a way that satisfies everyone involved, as suggested by @KlausBrave:
Quoted from KlausBrave
I would even go so far as to say AF should not proceed to snapshot without and before doing a repeat call, including ADPC/the relevant service providers & it must be recorded so all global DAO participants can access the information as part of decision making.
Right now, the proposal appears to stand apart from the existing ADPC framework and we agree with @PGov that there should be a more streamlined and consistent process to ensure that leverages existing structures:
Quoted from PGov
Since the ADPC has established procurement frameworks and whitelisted security service providers, prolly makes sense to move these existing structures to streamline the implementation of the new program,
In line with what @pedrob and @krst have highlighted, we think it’s essential for the AF to incorporate or at least improve upon already established frameworks rather than proposing an entirely separate approach:
Quoted from pedrob
I want to see those learnings materialized in a framework that is sustainable over time and does not rely on the Foundation stepping into the DAO and taking full ownership of the proposal, as I believe that is not a viable long-term solution.
Quoted from krst
We want to thank the ADPC for all the work they’ve done in setting up the framework and whitelisting security service providers. We hope to see the Foundation use the groundwork the ADPC has done and build on top of it.
While we have no objection to the ultimate aim of this proposal, we oppose the current process of pushing the proposal to Snapshot without first addressing the issues, and the feedback raised left a negative impression. A more inclusive approach would have strengthened the proposal, but seeing as it has moved to snapshot, we would prefer that the proposal be overhauled based on feedback received and have voted AGAINST.
I think the Arbitrum Audit Program has a lot of potential and addresses an important need. Smart contract audits are essential, especially for early-stage projects that might not have the resources to afford them. Helping these teams launch securely not only protects users but also strengthens the entire Arbitrum ecosystem. I also appreciate the idea of offering subsidies as investments in some cases, which could help align projects with Arbitrum over the long term.
That said, I have some reservations about whether this program will be more effective than the ADPC Security Subsidy Fund, which has already demonstrated strong results.
One of the strengths of this proposal is that it is cheaper than ADPC, as it only requires hiring one technical expert at $60K per year, compared to $360K per year under ADPC. However, cost efficiency alone does not necessarily mean better results.
I believe the Arbitrum Foundation has stronger technical expertise, which likely makes it better positioned to select the best auditing service providers and ensure a smooth audit facilitation process. This could help improve the quality and efficiency of audits under the new program.
However, ADPC has proven to be highly effective in other critical areas, particularly in maximizing Arbitrum’s exposure among protocols, building strong relationships, and creating synergies that support protocol growth beyond just audits. The Security Subsidy Fund Outcome Report highlights how ADPC successfully connected with top-tier protocols like GMX, Gamma Strategies, and D2 Finance, ensuring they remained within the Arbitrum ecosystem.
Additionally, ADPC’s marketing strategy was highly effective—they not only actively promoted the subsidy fund to attract top protocols but also leveraged their connections to amplify outreach. By collaborating with selected protocols, ADPC was able to use their marketing resources to further promote both the Security Subsidy Fund and Arbitrum’s ecosystem as a whole.
Given ADPC’s track record, I am uncertain whether the Arbitrum Audit Program will be able to replicate or improve upon these ecosystem-building efforts. While this new program may enhance the technical side of audits, it is unclear if it will achieve the same level of community engagement, exposure, and long-term protocol support that ADPC has demonstrated.
ADPC Security Subsidy Fund Outcome Report
While I see the potential benefits of this proposal, I remain uncertain about whether it will be a significant improvement over ADPC. The Arbitrum Foundation may have better technical expertise to optimize the audit selection and facilitation process, but ADPC has been exceptionally strong at ecosystem growth, marketing, and building lasting relationships with protocols. Additionally the cost savings is not enough that it's a major deciding factor for this proposal.
Until there is more clarity on how this program will build upon ADPC’s successes in those areas, I have decided to abstain from the vote.
I look forward to hearing more perspectives from the community and seeing how this discussion evolves as I am not totally against this proposal but feel it needs to be better constructed for me to support it.
After reviewing the proposal, forum discussions, and the last calls, I've found several practical considerations worth sharing.
Regarding the audit costs, I was not aware of the barrier this represents for projects building on Arbitrum. Considering what @stonecoldpat mentioned in the meeting about audit costing “anything between like $50k $100k or $200k depending on the size of your code”, I understand the hurdles teams face in early-stage funding. It is important to make these subsidies readily available for the growth of the ecosystem.
Accepting applications for only two weeks as previously approached could limit audit support for projects, so I believe that having a continuous application process, as proposed, would eliminate those service gaps. Builders should be allowed to seek support when they need it, not just when a window happens to be open.
The ADPC established a solid framework for the concept to be optimized further and scaled by the AF, additionally I agree with @pedrob’s comment on the need to develop a long-term, sustainable framework. Regarding the increased budget, I think it is fair to say that given the substantial demand shown in the Arbitrum Security Subsidy Fund: Outcome Report (56 applications with 22 selected) and considering a year-round availability of the program, this seems practical and beneficial overall.
A key final takeaway is that this is less about "who should run the program" and more about ensuring the ecosystem has consistent, funded audit support with minimal bureaucratic overhead.
Voting FOR in Snapshot.
I support subsidies for new projects to ensure that outstanding ones can get through the difficult early stages. However, I’ve seen many such proposals in the forum, but I haven’t seen suggestions for providing subsidies to real users. In the new year, 2025, I hope to see such proposals so that everyone can gain tangible benefits from the Arbitrum ecosystem. You have forgotten the users.FOR
I vote in favor of this proposal in the temp-check.
However, I want to clarify something: my signal in the temp-check specifically means that I agree with the motivation behind the proposal and the idea of “quickly” setting up a subsidy fund for audits—something essential to supporting developers in Arbitrum.
I vote in favor of this proposal in the temp-check.
However, I want to clarify something: my signal in the temp-check specifically means that I agree with the motivation behind the proposal and the idea of “quickly” setting up a subsidy fund for audits—something essential to supporting developers in Arbitrum.
That being said, I believe the proposal still needs some modifications for me to maintain this vote on Tally.
I attended the unrecorded call where the ADPC and the Foundation exchanged views on the execution of the subsidy fund and their approach moving forward. I understand there is an intention to collaborate, share ADPC's learnings, and strengthen the program. However, for me, that intention alone is not enough—I want to see those learnings materialized in a framework that is sustainable over time and does not rely on the Foundation stepping into the DAO and taking full ownership of the proposal, as I believe that is not a viable long-term solution.
I believe the process developed by the ADPC did have value, mainly in the criteria outlined for both auditors and projects selection. Maintaining continuity in the process and criteria provides predictability for auditors and projects looking to apply and how to improve for future applications. It also allows the DAO to replace program managers without friction or negatively impacting the program.
In that sense, building a new program from scratch will cause the very delays you are trying to avoid. And of course, this will happen again in the future.
I’m very happy to see you stepping up and getting more directly involved in the DAO. What concerns me, however, is the possibility of you taking ownership of the initiatives and starting from scratch, which could lead to the loss of sustainable frameworks that don’t rely on a single provider or manager (or at least with the intention of reaching that point.). It’s true that you may be the most suitable to execute this work and lead the committee, but I’d prefer that, as a DAO, we can be a bit more inefficient if it means developing frameworks that are sustainable over time for when you decide to step back again.
Additionally, I echo @krst comments and would like to see them explicitly incorporated into the proposal text.
One thing we’d like to point out about the proposal itself is that the Foundation will run the subsidy fund on behalf of the DAO using the DAO’s funds. As such, we’ll hold them to the same standard as any and all other contributors and service providers, and we actually expect them to be an example of what a DAO-funded program should look like.
Some thoughts on this Arbitrum Audit Program:
Some thoughts on this Arbitrum Audit Program:
Overall, our biggest concern points are with relation for ADPC and how the audit program can best interact between them.
I agree with @CastleCapital and @paulofonseca.
As a matter of policy all calls in Arbitrum should be recorded so all people can access relevant information in the deliberation and decision-making process, either real-time or async according to one's need and style.
I think every call in Arbitrum should be recorded as a policy and be on the record. This needs to be solved.
i.e. its not ok this controversial Audit call from earlier in this week was not recorded, I was not on it and don't have the required information to make a decision on this matter.
That's not good enough in my mind as a way for Arbitrum to operate and as a matter of priority this needs to get solved.
I would even go so far as to say AF should not proceed to snapshot without and before doing a repeat call, including ADPC/the relevant service providers & it must be recorded so all global DAO participants can access the information as part of decision making.
In addition for a controversial proposal I am not in favour of proposals being rushed to snapshot exactly at 7 days if forum dialogue isn't resolving/converging to a state that makes sense to move to Snapshot. I'm seeing more of this behaviour DAO wide and don't think its a good practice. I think proposal authors should take extra time and care if there is strong divergent sentiment to dig deeper and extend the deliberative process.
This proposal isn't only about this proposal it strikes to the heart of settling the expectations and agreements people understand and are experiencing unclarity in the social contract between Arbitrum Foundation and DAO service providers.
@stonecoldpat and those stewarding this from the Foundation, I invite slowing down at this pivotal moment staying with the tension and working through resolving/converging to something encompassing the real feedback of contributors.
Can we pause on taking this to Snapshot today and setup another meeting?
The program afaik is not intended to do investments. So why are you mentioning it? I can agree that, de facto, financing an important audit for a project is an indirect investment in the ecosystem, but is not the main focus here. @danielo above proposed this approach, which I could like, but we currently don’t have the structures/infra/legal to support this and is a bit soon (but also soon we could have the avi, we will have the opco, we will have sos goals that might match this). Anyway, feels like someone asking what time is it, and having as an answer “thursday”.
The program afaik is not intended to do investments. So why are you mentioning it? I can agree that, de facto, financing an important audit for a project is an indirect investment in the ecosystem, but is not the main focus here. @danielo above proposed this approach, which I could like, but we currently don’t have the structures/infra/legal to support this and is a bit soon (but also soon we could have the avi, we will have the opco, we will have sos goals that might match this). Anyway, feels like someone asking what time is it, and having as an answer “thursday”.
we don't have a fully streamlined setup for investments (that's coming) but we do have the ability to make investments and we already broke a lot of ground here with the Hackathon Continuation program. The Foundation has capabilities to sign investment contracts so if they're willing to allocate capacity here, I don't see why this would be a problem. Once a template contract is setup, the responsibility then falls to the team operating the program to negotiate these (which could be a challenge but not necessarily insurmountable).
What I'm understand is that the program proposed here moves us from partial subsidy of Audits to full subsidy, and this creates incentive misalignment (projects can abuse the program by getting crap audited). That seems like a move in the wrong direction and could be rectified by getting projects to bear part of the costs (current system as I understand) or otherwise by making audit subsidies an investment (with the complications mentioned above)
The following reflects the views of L2BEAT’s governance team, composed of @krst and @Sinkas. It’s based on their combined research, fact-checking, and ideation.
We want to thank the ADPC for all the work they’ve done in setting up the framework and whitelisting security service providers. We hope to see the Foundation use the groundwork the ADPC has done and build on top of it.
The following reflects the views of L2BEAT’s governance team, composed of @krst and @Sinkas. It’s based on their combined research, fact-checking, and ideation.
We want to thank the ADPC for all the work they’ve done in setting up the framework and whitelisting security service providers. We hope to see the Foundation use the groundwork the ADPC has done and build on top of it.
In our view, this is an expected pathway for many different initiatives the DAO undertakes; a third-party contributor proposes something and leads the charge, and once the concept is proven, the AF (or in the future, the OpCo) internalizes it and optimizes it to be as efficient as possible, creating value within the DAO structures.
At this time, the DAO has no way of providing a security audit subsidy to projects, given that the previous subsidy fund from the ADPC has run out and there have been no steps to renew it. In our view, it makes sense for the Foundation to administer the security subsidy fund, given its position and proximity to both builders and Arbitrum’s tech.
One thing we’d like to point out about the proposal itself is that the Foundation will run the subsidy fund on behalf of the DAO using the DAO’s funds. As such, we’ll hold them to the same standard as any and all other contributors and service providers, and we actually expect them to be an example of what a DAO-funded program should look like.
We would also like to emphasize that we see this program as a BD initiative that should first and foremost drive the growth of the Arbitrum ecosystem. Therefore, we expect that whoever the OCL and AF representatives will be in the committee, they will coordinate internally to make sure that the projects selected to receive audit grants are in line with Arbitrum's long-term growth strategy.
Hello and welcome @Q12 in the arbitrum forum. Quite a way to enter the arena.
I have no horse in this race but I am quite curious about your approach and several statements, to which I would gladly read some clarification if you would be kind enough to answer my questions.
One of these statements is untrue. Token holders deserve to know which version is accurate before being asked to trust the Foundation with $10M in DAO funds.
Hello and welcome @Q12 in the arbitrum forum. Quite a way to enter the arena.
I have no horse in this race but I am quite curious about your approach and several statements, to which I would gladly read some clarification if you would be kind enough to answer my questions.
One of these statements is untrue. Token holders deserve to know which version is accurate before being asked to trust the Foundation with $10M in DAO funds.
The Foundation proposes to run a $10M program with part-time, unpaid committee members “next to their everyday duties.” This is frankly absurd. You don’t run what you yourself call a “mission-critical” program as a side hobby. The proposed structure screams of inexperience in running professional investment operations.
The Foundation’s claim they will “waive fees” is either naive or deliberately misleading. These costs will simply be absorbed into their DAO-funded operational budget.
The Foundation operates as a neutral steward in order to support the ArbitrumDAO, the continuous innovation of the Arbitrum technology and the development and education of the Arbitrum community.
The Foundation literally has a budget to support the DAO. In the statement above you are trying to highlight in a negative light the equivalent of saying "the sky is blue". IMHO, of course.
The Foundation’s fixation on “technical expertise” demonstrates a basic misunderstanding of what this program requires. What’s needed is deep knowledge of the security services market and audit space - not generic technical knowledge. The ADPC demonstrated this understanding by engaging DeDaub, an established security firm. Why would a random technical person from the Foundation or OCL have more relevant expertise than actual auditing professionals? This misalignment of expertise requirements raises serious concerns about the Foundation’s ability to even properly scope this program.
I honestly think you are putting the cart in front of the horse here. There is a third, paid member, that could be literally dedaub or someone working for an audit firm. In the recent stylus program, we had 2 person from open zeppelin for example. More than saying that foundation has a "fixation", wouldn't it be better to highlight that the third member should be, in your opinion, someone with a deep knowledge of the security market? And so, maybe, only nominated and not elected by the DAO? (and btw i would tend to agree with this). As a final note, slamming ocl/af about technical expertise here feels excessive and uncalled. This is not to simply be a cheerleader: but all of this that we have now, this whole ecosystem, would not exists without these people. Saying that this expertise, paired with a third member that is vertical in security, doesn't count, is being short-sighted at best, ill intended at worst.
This is fundamentally an investment program requiring sophisticated venture capital and private equity experience in evaluating early-stage projects. The Foundation’s emphasis on technical expertise while completely ignoring the need for investment acumen shows a fundamental misunderstanding of what drives successful project selection and portfolio management. Where is the venture capital expertise on their proposed committee? Who has experience managing comparable investment programs?
The Foundation’s operational budget was not intended as a shadow grant program.
The Foundation’s complete failure to coordinate internally is alarming. They were actively working with the ADPC on this exact initiative, received a detailed proposal, and then launched a competing proposal without any communication. This level of organizational dysfunction raises serious questions about their capacity to manage complex programs.
Defining this situation as a complete failure seems a mix of being excessive or slandering. You choose what applies here best. Looking at the answer from the Foundation, there has been indeed miscommunication with both one party (areta/axis/daimon) and internally (people talking with adpc vs people preparing the proposal). This is something that yes, can improve and should improve. Looking at the opening roles for the AF, they are indeed looking for further people for dao relationship, and at the same time we as a dao need to better organize single PoC for verticals. Because I know for a fact that AF gets pinged by tons of individuals for tons of different things, with the people being pinged not necessarily in charge of taking this inbound request. I am digressing a bit here and I am not trying to justify anybody here. There is definitely margin of improvement in comms on all sides.
I don't honestly think this initiative is AF experimenting with dao funds: they want to pay audits for protocols in arbitrum.This is where you fall short. Coming in an anon form, to the dao, criticising at an horizontal level, and then proposing "a single one premier service" without knowing if you might have a conflict in proposing this is where everything that you wrote can just fall in credibility. To be clear: is not that the idea of subsidizing through a third party is necessarily wrong.
Now, you likely lost a decent amount of time in writing the above. I for sure lost at least 40 minutes trying to answer here, so let's try to take out something good for everybody involved in this discussion:
hey @Arbitrum do you intend to publish this proposal for offchain vote on snapshot, tomorrow?
We understand that an Office Hours was recently held but in light of this new information, would be prudent to have another discussion with both parties involved.
We understand that an Office Hours was recently held but in light of this new information, would be prudent to have another discussion with both parties involved.
...and also for the following calls to be recorded, and for those recordings to be shared with the DAO in this thread.
yesterday's call, as far as I'm aware, was not recorded unfortunately.
@Entropy can an Office Hours discussion which includes both members of the Foundation and ADPC be organized?
We feel it's better to thrash the issues being put forth by both @Arbitrum and @adpc prior to a vote on the proposal. We understand that an Office Hours was recently held but in light of this new information, would be prudent to have another discussion with both parties involved.
So another flagship for Arbitrum to attract and retain projects. It will encourage developers to choose Arbitrum which will help grow and expand our ecosystem.
That said, there are some things to consider before approving a $10M proposal. From my experience working with audit firms, $100K per project seems high tbh. Typically, it's around $30K-80K (from essential to premium packages). This even doesn’t include referral fees or discounts for handling 100 projects, so I may be wrong, but just wanted to raise this :)
So another flagship for Arbitrum to attract and retain projects. It will encourage developers to choose Arbitrum which will help grow and expand our ecosystem.
That said, there are some things to consider before approving a $10M proposal. From my experience working with audit firms, $100K per project seems high tbh. Typically, it's around $30K-80K (from essential to premium packages). This even doesn’t include referral fees or discounts for handling 100 projects, so I may be wrong, but just wanted to raise this :)
Like other delegates, I agree that paying in ARB more than USD would help reduce sell pressure for the DAO.
At the end of the day, if the proposal is passed, I hope the program will have a reimbursement process for projects that get audited but don’t perform well.
I don't agree with that. That's what we created the ADPC program for. We're duplicating their work in this proposal. Besides, I don't understand why the Arbitrum Foundation takes money for the program from DAO, and DAO barely participates in it.
See what ADPC writes here above
gm
Thank you very much for your detailed response. I agree with many of the opinions and learnings you've shared.
It took around ~10 months to stand up and complete the 8 week program. Unfortunately, this meant there was no security subsidy fund by the ArbitrumDAO for most of 2024.
gm @Arbitrum,
We appreciate the effort behind this proposal, it’s exactly what early-stage projects need and it helps created a more connected builder ecosystem within Arbitrum. That said, we have a few points we’d love more clarity on:
gm @Arbitrum,
We appreciate the effort behind this proposal, it’s exactly what early-stage projects need and it helps created a more connected builder ecosystem within Arbitrum. That said, we have a few points we’d love more clarity on:
Are there any lessons from that experience that could be applied?
It would help to know what you learned from ADPC and why you’re steering away from it.
Impact of the SOS Initiative With the SOS Initiative kicking off, has there been any thought on how that factors into selecting projects for the subsidy?
Broader Builder-Support Strategy While an audit subsidy is a great start, is there a larger plan for ongoing builder support? We think a more holistic approach—beyond audits—would help strengthen the entire Arbitrum ecosystem.
Overall, we agree on the value of running an audit subsidy program but would love to see a longer-term vision that supports existing and future builders on Arbitrum.
Hello, thanks for your proposal!
I have a few questions:
In fact, nothing will depend on the DAO’s vote and decisions made by the Arbitrum Foundation and Offchain Labs will override the DAO.
In my opinion, no one is better positioned than OCL and AF to evaluate the projects that can have a boost through audit, so I sincerely don't mind them taking the lead as they did already in the stylus program.
@Arbitrum , I appreciate this proposal and agree with the need for funding to support projects with audit expenses, which can be prohibitively expensive for many teams. However, I have some questions and concerns:
Differentiation from ADPC Subsidy Fund: Could you elaborate on how this new program significantly improves upon the revised ADPC Subsidy Fund? What specific shortcomings of the previous program does this address?
Timing and Evaluation: The ADPC has announced that they will be posting the Subsidy Fund Outcome report (https://forum.arbitrum.foundation/t/adpc-update-thread-phase-ii/27298/22) in the coming days. Wouldn't it be prudent to wait for this report before proceeding with a similar program / giving final shape to a new one? This would allow us to learn from issues of the previous program, identify areas for improvement and ensure we're not duplicating efforts unnecessarily.
I really like this proposal. Audit costs are a significant barrier to entry for early-stage projects, and subsidizing them for valuable teams is a highly effective way to support builders in the Arbitrum ecosystem. Security is critical, especially for new projects, and reducing the financial burden of audits will help ensure that promising teams can launch safely without cutting corners.
How are teams determined to be elegible for this support? I think its good that its removing that financial barrier from those teams but we should be a tad cautious not to overspend and audit every team.
Thank you for the offer. Supporting projects with audits is a great way to reduce potential user losses in the Arbitrum ecosystem
However, there are also questions:
gm
Thank you very much for your detailed response. I agree with many of the opinions and learnings you've shared.
It took around ~10 months to stand up and complete the 8 week program. Unfortunately, this meant there was no security subsidy fund by the ArbitrumDAO for most of 2024.
Since you mention that you’ve been very involved in the execution of the Subsidy Fund, why do you think this took so long? The DAO is usually not this inefficient in the administration and execution of its programs.
Technical expertise. One of the anticipated lessons learnt from the security subsidy program run by the ADPC is the need for involvement of technical experts who can evaluate the project that needs an audit and ensure the quote from the auditor is indeed a fair/accurate assessment.
I'm in complete agreement with this. In fact, it was a suggestion I made when the Subsidy Fund was being discussed. However, for some reason, it led to a vote for a new committee rather than incorporating an expert, which was ultimately rejected by the DAO.
Our increased involvement was a sign that it may be better for the ADPC to focus on topics that match their core competencies and not necessarily run an audit subsidy program. Additionally, if we are expected to carry on the continuation of a framework and execute it on behalf of others, then we (AF) should just set it up ourselves.
To be clear, I wasn't suggesting that the ADPC (or at least its current composition) continue managing the Subsidy Fund. In fact, I've shared my concerns about its execution and am still waiting for the final report, which I understand will be published this week.
However, I don’t necessarily agree with your last point about taking over a framework developed by others and the idea that just because it was developed by others (others would be the DAO in this case), it should be discarded, and you should start from scratch with your own framework.
I believe the process developed by the ADPC did have value, mainly in the criteria outlined for both auditors and projects selection. Maintaining continuity in the process and criteria provides predictability for auditors and projects looking to apply and how to improve for future applications. It also allows the DAO to replace program managers without friction or negatively impacting the program.
In that sense, building a new program from scratch will cause the very delays you are trying to avoid. And of course, this will happen again in the future.
I'm very happy to see you stepping up and getting more directly involved in the DAO. What concerns me, however, is the possibility of you taking ownership of the initiatives and starting from scratch, which could lead to the loss of sustainable frameworks that don't rely on a single provider or manager (or at least with the intention of reaching that point.). It's true that you may be the most suitable to execute this work and lead the committee, but I’d prefer that, as a DAO, we can be a bit more inefficient if it means developing frameworks that are sustainable over time for when you decide to step back again.
That’s why, for instance::
The Arbitrum Foundation will take on the role of evaluating auditors who want to apply for this program which includes an interview, reference checks, compliance, and agreement to the terms & conditions of this program. It should be noted that we will conduct an individual negotiation with all approved auditors to take into account potential different rates and offerings from the auditors. Additionally, auditors can apply at any time to join the program.
This aspect seems a bit concerning when considering the continuity of the program in the future. We can certainly trust you AF to manage it, and you will likely do it great. But the day you decide to step away, it will become a problem. That’s precisely why the procurement process was created.
In this same regard:
On the final point, how to avoid projects getting a grant and then launching on another chain, this is generally the same problem that all grant programs encounter:
We will prioritise projects who are leveraging Arbitrum’s core technology stack, like a smart contract for stylus or deploying their own chain.
We may decide to invest in the project over a simple grant as that offers a closer partnership with the project and helps align incentives for all parties involved to remain on Arbitrum.
Depending on subsidy size, there may be clauses that require projects to launch on Arbitrum before other projects.
This is something you can set up and execute, but since it’s not a standardized process, it could eventually be lost (with the criterias applied and the knowledge obtained).
A subsidy will be offered as a grant or an investment in the project depending on size and long-term alignment.
The same goes for the idea of offering investments. It’s very interesting and may be appropriate, but as it's structured, it’s not creating a framework that can be replicated in the future for other PMs.
We propose a committee with a mixture of technical expertise and DAO representation who will have the necessary skills and time to review proposals on an on-going basis.
Chair: Team Member - Arbitrum Foundation (Waiving Payment)
Team Member - Offchain Labs (Waiving Payment)
Technical Expert - Elected by DAO
Team Member - ArbitrumDAO’s OpCo (when operational)
I think this composition of the committee is appropriate. That’s why I believe using the existing framework, with the lessons you’ve pointed out as areas for improvement, can be a great complement to create a kind of v2 program that is sustainable over time, regardless of who makes up the committee.
Hello, thanks for your proposal!
I have a few questions:
Run an election to hire the technical expert by 15th March 2025.
Onboard auditors and open applications for projects by mid April 2025.
What is the criteria for the election and for onboarding the auditors? There will be a request of a commitment from the auditors to have "X" hours available? One thing is to be part of a "whitelist" with no real commitment, and a different thing is to be aligned with the DAO and have manpower available.
Can you share the expected skills/knowledge for both this elected member and the auditors?
We plan to run the subsidy program for 1 year, or until all funds are spent, with an appointed Arbitrum Audit committee. A subsidy will be offered as a grant or an investment in the project depending on size and long-term alignment.
@Arbitrum , I appreciate this proposal and agree with the need for funding to support projects with audit expenses, which can be prohibitively expensive for many teams. However, I have some questions and concerns:
Differentiation from ADPC Subsidy Fund: Could you elaborate on how this new program significantly improves upon the revised ADPC Subsidy Fund? What specific shortcomings of the previous program does this address?
Timing and Evaluation: The ADPC has announced that they will be posting the Subsidy Fund Outcome report (https://forum.arbitrum.foundation/t/adpc-update-thread-phase-ii/27298/22) in the coming days. Wouldn't it be prudent to wait for this report before proceeding with a similar program / giving final shape to a new one? This would allow us to learn from issues of the previous program, identify areas for improvement and ensure we're not duplicating efforts unnecessarily.
I think this should be considered before moving forward with this proposal. Especially in the current state, our efforts should truly add value to the eco and be perfected before publishing, otherwise we risk contributing to a waste of resources.
Thank you for the offer. Supporting projects with audits is a great way to reduce potential user losses in the Arbitrum ecosystem
However, there are also questions:
You are talking about a long term perspective and setting a budget for only 1 year. In my opinion, this is not a long term perspective and Arbitrum already had a program of audit compensation during the year. How is this program better?
I think this budget is greatly overstated. I don't see 100 projects a year that Arbitrum needs so much that we are ready to give them 30 million ARB. Will we proceed from how much money we have or from what projects we need?
I think we could give money for audit projects together with the AVI (Arbitrum Venture Initiative) project. On the one hand, we help the project, on the other, if it is successfully deployed, we will receive a profit. This scheme is much more honest than simply throwing money at projects, most of which, according to statistics, will be unsuccessful.
The following reflects the views of the Lampros DAO governance team, composed of Chain_L (@Blueweb), @Euphoria, and Hirangi Pandya (@Nyx), based on our combined research, analysis, and ideation.
Thank you for putting forward this proposal.
The following reflects the views of the Lampros DAO governance team, composed of Chain_L (@Blueweb), @Euphoria, and Hirangi Pandya (@Nyx), based on our combined research, analysis, and ideation.
Thank you for putting forward this proposal.
We’re glad to see the Arbitrum Foundation leading this initiative. Definitely, audits play a critical role in securing on-chain projects, but they are often too expensive for early-stage teams. By offering subsidies, this program removes a major financial barrier, making it easier for developers to launch safely on Arbitrum instead of choosing other chains.
We are generally in favor of the proposal but would appreciate some clarification -
The Arbitrum Audit Subsidy Program invites projects to apply via an open applications track with a standardised form to gather the following information:
How will the application process work for projects applying? Will communication with the projects and selection decisions be made publicly, similar to how the Questbook DDA and Stylus Sprint rounds were handled, as they have set a good standard for this?
An auditor will be picked based on the rate charged, discount offered, availability to begin the audit and other relevant factors such as experience with similar projects and reputation.
Additionally, auditors can apply at any time to join the program.
Just to clarify, multiple auditors will be chosen, right? We assume that no single audit firm will dominate the program. Will there be a cap on the number of projects any individual auditor can take on to ensure diversity and prevent monopolization?
Also, will there be a marketing push to ensure more projects are aware of it? The success of this program also depends on outreach. Visibility could help attract high-quality projects to apply and build on Arbitrum.
Overall, we fully support this initiative and appreciate the effort to strengthen security in the ecosystem.
My main question revolves around criteria of selecting the projects.
In the last iteration of the security subsidy funds, there was a committee that made projects compile a rather long (as far as I can read) form, that resulted in some protocols being selected and others not with criteria that were not super clear... How would it work here? Can existing projects already apply?
Thanks for the proposal!
I think this is a very useful idea. After reading all the above-mentioned comments from other delegates and the answers to them, many questions disappeared by themselves.
As @danielo said, there is concern that projects will take advantage of the grant and then go to other ecosystems.
Thanks for the proposal!
I think this is a very useful idea. After reading all the above-mentioned comments from other delegates and the answers to them, many questions disappeared by themselves.
As @danielo said, there is concern that projects will take advantage of the grant and then go to other ecosystems.
funding projects that then migrate to other ecos => why not make these audits some sort of investment or what sort of mitigation can be put in place?
In the proposal, we are offering the option to also use the subsidy to invest in the project, although we’d prefer if the project made its own in Arbitrum first :slight_smile:
In addition to investing as an opportunity to avoid risks, I have one more suggestion
How about this solution: can we take obligations from sponsored projects to remain in the Arbitrum ecosystem? And if they want to leave the ecosystem, they will have to return the money spent on the audit and preferably in Arbitrum tokens. I think this would avoid additional risks
Good initiative and I’ve got some suggestions about the token mechanics.
Converting 30M ARB to USD immediately is not the play here coz it creates unnecessary sell pressure. Instead, we should:
Good initiative and I’ve got some suggestions about the token mechanics.
Converting 30M ARB to USD immediately is not the play here coz it creates unnecessary sell pressure. Instead, we should:
If we’re bullish on Arbitrum’s (which this proposal shows we are), then keeping funds in ARB aligns everyone’s incentives. Plus, if ARB price goes up, we could end up funding even more audits than the planned ~100 projects.
Think about it - converting everything upfront to USD is like saying “we don’t believe ARB will perform well in the next year.” That’s the opposite message we want to send to builders choosing which L2 to deploy on.
I support the core idea and trust the Foundation’s judgment on project selection, but let’s modify the treasury management approach.
Hi @Arbitrum
We think this proposal is valuable, though we see some possible issues. The ARDC v1 saw an issue where proposals would come to the security member to audit contracts for new protocols. Similarly, we can see some issue where these protocols receive auditing work, launch on Arbitrum, but then do the bare minimum in ecosystem management and development after launch, while prioritizing other L2s (eg. Base). With this in mind, does it make sense to have this structure for all apps or for only specific applications (i.e., those built with Stylus) and structure the committee differently for other types of applications, or make a priority pathway instead?
Hi @Arbitrum
We think this proposal is valuable, though we see some possible issues. The ARDC v1 saw an issue where proposals would come to the security member to audit contracts for new protocols. Similarly, we can see some issue where these protocols receive auditing work, launch on Arbitrum, but then do the bare minimum in ecosystem management and development after launch, while prioritizing other L2s (eg. Base). With this in mind, does it make sense to have this structure for all apps or for only specific applications (i.e., those built with Stylus) and structure the committee differently for other types of applications, or make a priority pathway instead?
Furthermore, could we have some elaboration on the option for investment offered by the subsidy? How would this agreement work, what does DAO involvement look like here, etc? We understand that it may be more difficult to lock in apps (and that the auditing program may not be the right place to bundle this), though it is worth noting.
Also, on what metrics should we evaluate the success of this program? Projects safely launched on Arbitrum and consistently used?
gm
It is industry standard and recommended practice that all projects with on-chain smart contracts undergo at least one third party audit. This is because smart contracts can potentially secure millions, if not billions of dollars, yet a single bug in the code can result in the loss of all funds. In many cases, when the smart contract is deployed, it can be difficult to upgrade after launch, and audits should be completed prior to the project going live.
gm
It is industry standard and recommended practice that all projects with on-chain smart contracts undergo at least one third party audit. This is because smart contracts can potentially secure millions, if not billions of dollars, yet a single bug in the code can result in the loss of all funds. In many cases, when the smart contract is deployed, it can be difficult to upgrade after launch, and audits should be completed prior to the project going live.
Thanks for the proposal; I agree with the rationale.
Before moving forward with the details, I’d love to hear your thoughts on the Subsidy Fund implemented by the ADPC. Do you think it was well executed? What is your opinion on the results? And why do you propose making such a drastic change to that model instead of, for instance, suggesting that this new committee execute the v2?
Are there any lessons from that experience that could be applied?
I see the need and some risks:
I see the need and some risks:
Personally I see a better strategy in having business clusters with a combination of services/support programs that are deeply attuned to each vertical as opposed to generalist programs where the risk of misallocaiton is big.
Thanks for the proposal. I really think it is very well constructed and has goals that can bring great benefits to the chain by helping projects launch in a safer way for users. I believe this is a crucial step for the ecosystem, especially since hacks have caused significant reputational damage.
An auditor will be picked based on the rate charged, discount offered, availability to begin the audit and other relevant factors such as experience with similar projects and reputation. In regards to the payment schedule, we expect the subsidy to be paid when the audit is completed by the auditor, subject to project’s and Foundation’s satisfaction
Thanks for the proposal. I really think it is very well constructed and has goals that can bring great benefits to the chain by helping projects launch in a safer way for users. I believe this is a crucial step for the ecosystem, especially since hacks have caused significant reputational damage.
An auditor will be picked based on the rate charged, discount offered, availability to begin the audit and other relevant factors such as experience with similar projects and reputation. In regards to the payment schedule, we expect the subsidy to be paid when the audit is completed by the auditor, subject to project’s and Foundation’s satisfaction
From the pool of relevant auditors, who will be responsible for selecting the final one for each project? Will it be the committee or the project? I'm not entirely clear on who will make the final decision.
Also, is there a clear maximum amount per project that will be spent on auditing? The 100K assumption per project seems rather vague. I believe there should be a maximum amount, and even a maximum percentage for the cost subsidy everyone should have skin on the game.
Our proposal will:
Whenever the program ends, the remaining funds in USDC and ARB, will be returned to the ArbitrumDAO unless the DAO approves the continuation of the program via an off-chain vote.
Will this be converted immediately, or on an ongoing basis as needed? i suggest this is ongoing to reduce selling preassure.
Thanks
Hello,
Thank you for publishing this proposal.
Hello,
Thank you for publishing this proposal.
We agree with the points mentioned, but it would also be valuable to consider the risks users face when interacting with these projects. Depending on the project, some may involve significantly larger financial movements from users than others. Taking this into account could help ensure that the initiative benefits not only the selected projects but also the community in a more direct and meaningful way.
Thank you for posting a well-structured proposal. It is very straightforward. Overall, I like the idea of helping projects cover audit costs, especially the projects that have good potential for Arbitrum. I do have some concerns about a few points of the proposal.
In my opinion, auditing firms are known for their "dynamic" pricing. Prices vary quite a lot depending on the type of project (for example: is the project well-funded by VC? Does it have known teams or partners endorsing the project? etc.). I am afraid we will not get fair pricing since the client here is Arbitrum. How can we make sure that we get fair pricing?
I suggest inviting multiple auditing firms and run some kind of bidding process for each project. I would suggest the "Sealed bid" method or something similar. What do you think about this idea?
Is it realistic for a team of 3 committee members (while 2 of them are not being paid for this) working part-time to vet 100 projects? We are talking about paying up to $100k to audit one project, which is a significant amount. How can we make sure to really support the right projects? Maybe expand to 5 committee members?
Thank you for posting a well-structured proposal. It is very straightforward. Overall, I like the idea of helping projects cover audit costs, especially the projects that have good potential for Arbitrum. I do have some concerns about a few points of the proposal.
In my opinion, auditing firms are known for their "dynamic" pricing. Prices vary quite a lot depending on the type of project (for example: is the project well-funded by VC? Does it have known teams or partners endorsing the project? etc.). I am afraid we will not get fair pricing since the client here is Arbitrum. How can we make sure that we get fair pricing?
I suggest inviting multiple auditing firms and run some kind of bidding process for each project. I would suggest the "Sealed bid" method or something similar. What do you think about this idea?
Is it realistic for a team of 3 committee members (while 2 of them are not being paid for this) working part-time to vet 100 projects? We are talking about paying up to $100k to audit one project, which is a significant amount. How can we make sure to really support the right projects? Maybe expand to 5 committee members?
I think with the power and reputation of Arbitrum DAO, we can ask audit firms to be paid in ARB tokens (instead of selling to USD). This would lower the selling pressure. Since the price of ARB tokens is low, they might even hold it for some time or even better; get involved in governance. ;)
Thank you for considering my feedback.
gm
Thank you very much for your detailed response. I agree with many of the opinions and learnings you've shared.
It took around ~10 months to stand up and complete the 8 week program. Unfortunately, this meant there was no security subsidy fund by the ArbitrumDAO for most of 2024.
Since you mention that you’ve been very involved in the execution of the Subsidy Fund, why do you think this took so long? The DAO is usually not this inefficient in the administration and execution of its programs.
Technical expertise. One of the anticipated lessons learnt from the security subsidy program run by the ADPC is the need for involvement of technical experts who can evaluate the project that needs an audit and ensure the quote from the auditor is indeed a fair/accurate assessment.
I'm in complete agreement with this. In fact, it was a suggestion I made when the Subsidy Fund was being discussed. However, for some reason, it led to a vote for a new committee rather than incorporating an expert, which was ultimately rejected by the DAO.
Our increased involvement was a sign that it may be better for the ADPC to focus on topics that match their core competencies and not necessarily run an audit subsidy program. Additionally, if we are expected to carry on the continuation of a framework and execute it on behalf of others, then we (AF) should just set it up ourselves.
To be clear, I wasn't suggesting that the ADPC (or at least its current composition) continue managing the Subsidy Fund. In fact, I've shared my concerns about its execution and am still waiting for the final report, which I understand will be published this week.
However, I don’t necessarily agree with your last point about taking over a framework developed by others and the idea that just because it was developed by others (others would be the DAO in this case), it should be discarded, and you should start from scratch with your own framework.
I believe the process developed by the ADPC did have value, mainly in the criteria outlined for both auditors and projects selection. Maintaining continuity in the process and criteria provides predictability for auditors and projects looking to apply and how to improve for future applications. It also allows the DAO to replace program managers without friction or negatively impacting the program.
In that sense, building a new program from scratch will cause the very delays you are trying to avoid. And of course, this will happen again in the future.
I'm very happy to see you stepping up and getting more directly involved in the DAO. What concerns me, however, is the possibility of you taking ownership of the initiatives and starting from scratch, which could lead to the loss of sustainable frameworks that don't rely on a single provider or manager (or at least with the intention of reaching that point.). It's true that you may be the most suitable to execute this work and lead the committee, but I’d prefer that, as a DAO, we can be a bit more inefficient if it means developing frameworks that are sustainable over time for when you decide to step back again.
That’s why, for instance::
The Arbitrum Foundation will take on the role of evaluating auditors who want to apply for this program which includes an interview, reference checks, compliance, and agreement to the terms & conditions of this program. It should be noted that we will conduct an individual negotiation with all approved auditors to take into account potential different rates and offerings from the auditors. Additionally, auditors can apply at any time to join the program.
This aspect seems a bit concerning when considering the continuity of the program in the future. We can certainly trust you AF to manage it, and you will likely do it great. But the day you decide to step away, it will become a problem. That’s precisely why the procurement process was created.
In this same regard:
On the final point, how to avoid projects getting a grant and then launching on another chain, this is generally the same problem that all grant programs encounter:
We will prioritise projects who are leveraging Arbitrum’s core technology stack, like a smart contract for stylus or deploying their own chain.
We may decide to invest in the project over a simple grant as that offers a closer partnership with the project and helps align incentives for all parties involved to remain on Arbitrum.
Depending on subsidy size, there may be clauses that require projects to launch on Arbitrum before other projects.
This is something you can set up and execute, but since it’s not a standardized process, it could eventually be lost (with the criterias applied and the knowledge obtained).
A subsidy will be offered as a grant or an investment in the project depending on size and long-term alignment.
The same goes for the idea of offering investments. It’s very interesting and may be appropriate, but as it's structured, it’s not creating a framework that can be replicated in the future for other PMs.
We propose a committee with a mixture of technical expertise and DAO representation who will have the necessary skills and time to review proposals on an on-going basis.
Chair: Team Member - Arbitrum Foundation (Waiving Payment)
Team Member - Offchain Labs (Waiving Payment)
Technical Expert - Elected by DAO
Team Member - ArbitrumDAO’s OpCo (when operational)
I think this composition of the committee is appropriate. That’s why I believe using the existing framework, with the lessons you’ve pointed out as areas for improvement, can be a great complement to create a kind of v2 program that is sustainable over time, regardless of who makes up the committee.
Hello, thanks for your proposal!
I have a few questions:
Run an election to hire the technical expert by 15th March 2025.
Onboard auditors and open applications for projects by mid April 2025.
What is the criteria for the election and for onboarding the auditors? There will be a request of a commitment from the auditors to have "X" hours available? One thing is to be part of a "whitelist" with no real commitment, and a different thing is to be aligned with the DAO and have manpower available.
Can you share the expected skills/knowledge for both this elected member and the auditors?
We plan to run the subsidy program for 1 year, or until all funds are spent, with an appointed Arbitrum Audit committee. A subsidy will be offered as a grant or an investment in the project depending on size and long-term alignment.
@Arbitrum , I appreciate this proposal and agree with the need for funding to support projects with audit expenses, which can be prohibitively expensive for many teams. However, I have some questions and concerns:
Differentiation from ADPC Subsidy Fund: Could you elaborate on how this new program significantly improves upon the revised ADPC Subsidy Fund? What specific shortcomings of the previous program does this address?
Timing and Evaluation: The ADPC has announced that they will be posting the Subsidy Fund Outcome report (https://forum.arbitrum.foundation/t/adpc-update-thread-phase-ii/27298/22) in the coming days. Wouldn't it be prudent to wait for this report before proceeding with a similar program / giving final shape to a new one? This would allow us to learn from issues of the previous program, identify areas for improvement and ensure we're not duplicating efforts unnecessarily.
I think this should be considered before moving forward with this proposal. Especially in the current state, our efforts should truly add value to the eco and be perfected before publishing, otherwise we risk contributing to a waste of resources.
Thank you for the offer. Supporting projects with audits is a great way to reduce potential user losses in the Arbitrum ecosystem
However, there are also questions:
You are talking about a long term perspective and setting a budget for only 1 year. In my opinion, this is not a long term perspective and Arbitrum already had a program of audit compensation during the year. How is this program better?
I think this budget is greatly overstated. I don't see 100 projects a year that Arbitrum needs so much that we are ready to give them 30 million ARB. Will we proceed from how much money we have or from what projects we need?
I think we could give money for audit projects together with the AVI (Arbitrum Venture Initiative) project. On the one hand, we help the project, on the other, if it is successfully deployed, we will receive a profit. This scheme is much more honest than simply throwing money at projects, most of which, according to statistics, will be unsuccessful.
The following reflects the views of the Lampros DAO governance team, composed of Chain_L (@Blueweb), @Euphoria, and Hirangi Pandya (@Nyx), based on our combined research, analysis, and ideation.
Thank you for putting forward this proposal.
The following reflects the views of the Lampros DAO governance team, composed of Chain_L (@Blueweb), @Euphoria, and Hirangi Pandya (@Nyx), based on our combined research, analysis, and ideation.
Thank you for putting forward this proposal.
We’re glad to see the Arbitrum Foundation leading this initiative. Definitely, audits play a critical role in securing on-chain projects, but they are often too expensive for early-stage teams. By offering subsidies, this program removes a major financial barrier, making it easier for developers to launch safely on Arbitrum instead of choosing other chains.
We are generally in favor of the proposal but would appreciate some clarification -
The Arbitrum Audit Subsidy Program invites projects to apply via an open applications track with a standardised form to gather the following information:
How will the application process work for projects applying? Will communication with the projects and selection decisions be made publicly, similar to how the Questbook DDA and Stylus Sprint rounds were handled, as they have set a good standard for this?
An auditor will be picked based on the rate charged, discount offered, availability to begin the audit and other relevant factors such as experience with similar projects and reputation.
Additionally, auditors can apply at any time to join the program.
Just to clarify, multiple auditors will be chosen, right? We assume that no single audit firm will dominate the program. Will there be a cap on the number of projects any individual auditor can take on to ensure diversity and prevent monopolization?
Also, will there be a marketing push to ensure more projects are aware of it? The success of this program also depends on outreach. Visibility could help attract high-quality projects to apply and build on Arbitrum.
Overall, we fully support this initiative and appreciate the effort to strengthen security in the ecosystem.
My main question revolves around criteria of selecting the projects.
In the last iteration of the security subsidy funds, there was a committee that made projects compile a rather long (as far as I can read) form, that resulted in some protocols being selected and others not with criteria that were not super clear... How would it work here? Can existing projects already apply?
Thanks for the proposal!
I think this is a very useful idea. After reading all the above-mentioned comments from other delegates and the answers to them, many questions disappeared by themselves.
As @danielo said, there is concern that projects will take advantage of the grant and then go to other ecosystems.
Thanks for the proposal!
I think this is a very useful idea. After reading all the above-mentioned comments from other delegates and the answers to them, many questions disappeared by themselves.
As @danielo said, there is concern that projects will take advantage of the grant and then go to other ecosystems.
funding projects that then migrate to other ecos => why not make these audits some sort of investment or what sort of mitigation can be put in place?
In the proposal, we are offering the option to also use the subsidy to invest in the project, although we’d prefer if the project made its own in Arbitrum first :slight_smile:
In addition to investing as an opportunity to avoid risks, I have one more suggestion
How about this solution: can we take obligations from sponsored projects to remain in the Arbitrum ecosystem? And if they want to leave the ecosystem, they will have to return the money spent on the audit and preferably in Arbitrum tokens. I think this would avoid additional risks
Good initiative and I’ve got some suggestions about the token mechanics.
Converting 30M ARB to USD immediately is not the play here coz it creates unnecessary sell pressure. Instead, we should:
Good initiative and I’ve got some suggestions about the token mechanics.
Converting 30M ARB to USD immediately is not the play here coz it creates unnecessary sell pressure. Instead, we should:
If we’re bullish on Arbitrum’s (which this proposal shows we are), then keeping funds in ARB aligns everyone’s incentives. Plus, if ARB price goes up, we could end up funding even more audits than the planned ~100 projects.
Think about it - converting everything upfront to USD is like saying “we don’t believe ARB will perform well in the next year.” That’s the opposite message we want to send to builders choosing which L2 to deploy on.
I support the core idea and trust the Foundation’s judgment on project selection, but let’s modify the treasury management approach.
Hi @Arbitrum
We think this proposal is valuable, though we see some possible issues. The ARDC v1 saw an issue where proposals would come to the security member to audit contracts for new protocols. Similarly, we can see some issue where these protocols receive auditing work, launch on Arbitrum, but then do the bare minimum in ecosystem management and development after launch, while prioritizing other L2s (eg. Base). With this in mind, does it make sense to have this structure for all apps or for only specific applications (i.e., those built with Stylus) and structure the committee differently for other types of applications, or make a priority pathway instead?
Hi @Arbitrum
We think this proposal is valuable, though we see some possible issues. The ARDC v1 saw an issue where proposals would come to the security member to audit contracts for new protocols. Similarly, we can see some issue where these protocols receive auditing work, launch on Arbitrum, but then do the bare minimum in ecosystem management and development after launch, while prioritizing other L2s (eg. Base). With this in mind, does it make sense to have this structure for all apps or for only specific applications (i.e., those built with Stylus) and structure the committee differently for other types of applications, or make a priority pathway instead?
Furthermore, could we have some elaboration on the option for investment offered by the subsidy? How would this agreement work, what does DAO involvement look like here, etc? We understand that it may be more difficult to lock in apps (and that the auditing program may not be the right place to bundle this), though it is worth noting.
Also, on what metrics should we evaluate the success of this program? Projects safely launched on Arbitrum and consistently used?
gm
It is industry standard and recommended practice that all projects with on-chain smart contracts undergo at least one third party audit. This is because smart contracts can potentially secure millions, if not billions of dollars, yet a single bug in the code can result in the loss of all funds. In many cases, when the smart contract is deployed, it can be difficult to upgrade after launch, and audits should be completed prior to the project going live.
gm
It is industry standard and recommended practice that all projects with on-chain smart contracts undergo at least one third party audit. This is because smart contracts can potentially secure millions, if not billions of dollars, yet a single bug in the code can result in the loss of all funds. In many cases, when the smart contract is deployed, it can be difficult to upgrade after launch, and audits should be completed prior to the project going live.
Thanks for the proposal; I agree with the rationale.
Before moving forward with the details, I’d love to hear your thoughts on the Subsidy Fund implemented by the ADPC. Do you think it was well executed? What is your opinion on the results? And why do you propose making such a drastic change to that model instead of, for instance, suggesting that this new committee execute the v2?
Are there any lessons from that experience that could be applied?
I see the need and some risks:
I see the need and some risks:
Personally I see a better strategy in having business clusters with a combination of services/support programs that are deeply attuned to each vertical as opposed to generalist programs where the risk of misallocaiton is big.
Thanks for the proposal. I really think it is very well constructed and has goals that can bring great benefits to the chain by helping projects launch in a safer way for users. I believe this is a crucial step for the ecosystem, especially since hacks have caused significant reputational damage.
An auditor will be picked based on the rate charged, discount offered, availability to begin the audit and other relevant factors such as experience with similar projects and reputation. In regards to the payment schedule, we expect the subsidy to be paid when the audit is completed by the auditor, subject to project’s and Foundation’s satisfaction
Thanks for the proposal. I really think it is very well constructed and has goals that can bring great benefits to the chain by helping projects launch in a safer way for users. I believe this is a crucial step for the ecosystem, especially since hacks have caused significant reputational damage.
An auditor will be picked based on the rate charged, discount offered, availability to begin the audit and other relevant factors such as experience with similar projects and reputation. In regards to the payment schedule, we expect the subsidy to be paid when the audit is completed by the auditor, subject to project’s and Foundation’s satisfaction
From the pool of relevant auditors, who will be responsible for selecting the final one for each project? Will it be the committee or the project? I'm not entirely clear on who will make the final decision.
Also, is there a clear maximum amount per project that will be spent on auditing? The 100K assumption per project seems rather vague. I believe there should be a maximum amount, and even a maximum percentage for the cost subsidy everyone should have skin on the game.
Our proposal will:
Whenever the program ends, the remaining funds in USDC and ARB, will be returned to the ArbitrumDAO unless the DAO approves the continuation of the program via an off-chain vote.
Will this be converted immediately, or on an ongoing basis as needed? i suggest this is ongoing to reduce selling preassure.
Thanks
Hello,
Thank you for publishing this proposal.
Hello,
Thank you for publishing this proposal.
We agree with the points mentioned, but it would also be valuable to consider the risks users face when interacting with these projects. Depending on the project, some may involve significantly larger financial movements from users than others. Taking this into account could help ensure that the initiative benefits not only the selected projects but also the community in a more direct and meaningful way.
Thank you for posting a well-structured proposal. It is very straightforward. Overall, I like the idea of helping projects cover audit costs, especially the projects that have good potential for Arbitrum. I do have some concerns about a few points of the proposal.
In my opinion, auditing firms are known for their "dynamic" pricing. Prices vary quite a lot depending on the type of project (for example: is the project well-funded by VC? Does it have known teams or partners endorsing the project? etc.). I am afraid we will not get fair pricing since the client here is Arbitrum. How can we make sure that we get fair pricing?
I suggest inviting multiple auditing firms and run some kind of bidding process for each project. I would suggest the "Sealed bid" method or something similar. What do you think about this idea?
Is it realistic for a team of 3 committee members (while 2 of them are not being paid for this) working part-time to vet 100 projects? We are talking about paying up to $100k to audit one project, which is a significant amount. How can we make sure to really support the right projects? Maybe expand to 5 committee members?
Thank you for posting a well-structured proposal. It is very straightforward. Overall, I like the idea of helping projects cover audit costs, especially the projects that have good potential for Arbitrum. I do have some concerns about a few points of the proposal.
In my opinion, auditing firms are known for their "dynamic" pricing. Prices vary quite a lot depending on the type of project (for example: is the project well-funded by VC? Does it have known teams or partners endorsing the project? etc.). I am afraid we will not get fair pricing since the client here is Arbitrum. How can we make sure that we get fair pricing?
I suggest inviting multiple auditing firms and run some kind of bidding process for each project. I would suggest the "Sealed bid" method or something similar. What do you think about this idea?
Is it realistic for a team of 3 committee members (while 2 of them are not being paid for this) working part-time to vet 100 projects? We are talking about paying up to $100k to audit one project, which is a significant amount. How can we make sure to really support the right projects? Maybe expand to 5 committee members?
I think with the power and reputation of Arbitrum DAO, we can ask audit firms to be paid in ARB tokens (instead of selling to USD). This would lower the selling pressure. Since the price of ARB tokens is low, they might even hold it for some time or even better; get involved in governance. ;)
Thank you for considering my feedback.