code/voting
Watch
4
0
Fork
You've already forked voting
 0
Code Issues 12 Pull requests Projects Releases Packages Wiki Activity

research(governance): DAO and case-study review for hybrid leadership vs holder votes #13

New issue
Open
opened 2026-08-30 02:46:48 +00:00 by PlasticDigits · 11 comments
PlasticDigits commented 2026-08-30 02:46:48 +00:00 (Migrated from gitlab.com)

Summary

Investigate hybrid governance models and published DAO / treasury case studies so CL8Y voting can stay a leadership-led, holder-ratified system instead of either (a) putting every operational decision to a token poll or (b) leaving community funds and risk-tolerance choices with no holder mandate.

This issue is research + a written recommendation. It does not implement a new governor, committee, or proposal type. Product follow-ups (template #10, draft/review #11, and any later “what may be voted”) should cite this note.

Holder themes below are synthesized from a private community discussion (2026-08-29–30). Individual messages, handles, and quotes are not reproduced.

Current codebase

This repo is stage-1 tooling: an impartial offchain snapshot poll for registered Terra Classic CW20 and BSC BEP-20 CL8Y wallets. It does not encode a constitution, vote-scope taxonomy, leadership role, treasury executor, or succession plan.

Area Today
Product Dual-chain register → propose (≥1000 CL8Y on that address’s chain) → for/against/abstain. Weight is a frozen { terra_height, bsc_block } snapshot. Votes are advisory / offchain.
Schema voting.proposals (ledger/migrations/20260825000002_voting.sql): title + freeform HTML, status default 'open', freeze heights at create. No proposal category, no “major vs operational” flag, no committee/oversight tables, no tranche/execution records.
API operator-voting: POST /v1/register, POST /v1/proposals, POST /v1/proposals/:id/votes. GET /v1/proposals/:id returns advisory: true. Blacklist is env (VOTING_BLACKLIST_ADDRESSES), not a governance body.
dApp frontend/: /, /new, /:id (+ /vote* aliases). Copy: “Offchain / advisory.” Legal clickwrap before transactional UI. DEX Terra + Bridge EVM wallets.
Identity One address, one voter. Terra and BSC are never merged.
Related issues (not done) #10 structured sections. #11 draft + comments + feasibility/analysis gate before votes open. Neither defines which decisions belong on a ballot.
Explicit non-goal in tree docs/ARCHITECTURE.md: offchain polls do not move DEX factory wasm admin / fee governance (terra1zlmv2xydxcusurtr6rl78wsvytdc6mfex6hep7). UI must not imply on-chain DAO finality.
Hard rules No new CosmWasm/Solidity voting contracts. No archive node. BSC is core. Least-privilege DB role. No browser VITE_* BSC RPC.

There is no in-repo doctrine for: founder/management recommendation vs open option menus; technical vs risk/reward ballots; staged liquidity / treasury tranches; continuity if a key individual is unavailable; or how an oversight group should check feasibility without becoming a second electorate.

Why this is needed

Stage 1 makes it possible for holders to act. It does not answer what voting is for. Community discussion converged on a hybrid, not on “vote everything” and not on “never vote”:

  1. Technical and day-to-day operational direction should stay with people who understand the system (founder and/or a small management team), so execution stays coherent.
  2. Risk/reward and community-capital choices (how much liquidity to deploy, which assets, token issuance, material risk changes, fundamental governance) have no single “correct” engineering answer. Holders who bear the risk need a mandate and bounds — after being advised, not after being handed a blank strategy contest.
  3. Leadership should propose: evaluate options, pick a recommended path, explain reasoning, then ask holders to approve or reject. Presenting several equal options and asking the community to invent strategy is the failure mode to avoid (competing agendas, stalled progress — the pattern holders associate with LUNC-style on-chain governance).
  4. Oversight, if any, should verify feasibility (is this implementable, legal, funded, scoped?) rather than recast the same vote.
  5. Stage 2 process (how a proposal is researched and written, hierarchy, review) can land after stage 1 is impartial and dual-chain. #10 / #11 are the in-tree process drafts; this issue supplies external evidence so those designs are not invented in a vacuum.
  6. Continuity: the larger the ecosystem, the more the voting system and written process must outlive any one person. Rapid scaling is the current focus; bus-factor still belongs in the research, not as an excuse to delay shipping stage 1.
  7. Phased execution (e.g. a large liquidity target as smaller tranches with review windows and a stop) is a governance pattern, not a ledger feature today. Case studies should say when tranche + kill-switch designs actually worked.

Without this research, later product issues will either over-fit one conversation or copy a famous DAO that violates this repo’s constraints (on-chain governor, archive snapshots, identity merging, executable treasury from this API).

Constraints / guardrails

  1. Do not publish the private conversation. No names, handles, Discord/Telegram quotes, screenshots, or message timestamps in this issue, in MRs, or in the research doc. Synthesize themes only.
  2. No new smart contracts (no CosmWasm governor, no Solidity snapshot/token governor, no on-chain treasury from this repo).
  3. No archive node and no rewriting the registration ledger model.
  4. Votes stay offchain / advisory unless a later issue, after this research, explicitly changes product scope. This research must not quietly rebrand polls as binding DAO finality or as DEX factory governance.
  5. BSC is core. Case studies that are Cosmos-only or Ethereum-only must still be mapped to a dual-chain electorate (Terra terra1… and BSC 0x… separate).
  6. Identity v1 = one address, one voter. Do not recommend silent merge of Terra and EVM wallets.
  7. Least privilege / Legal / wallets unchanged: no ADMIN_TOKEN in the frontend, no seeds, no VITE_* BSC RPC, Legal clickwrap still required for transactional UI.
  8. Do not implement committee allowlists, proposal categories, or tranche engines in this issue. Recommend; open follow-up issues if the note justifies them.
  9. Do not treat #10 / #11 as done. Cite them as in-flight process work. Research may refine their scope; it must not duplicate their implementation checklists.
  10. Primary sources. Prefer official docs, post-mortems, and well-cited analyses. Mark speculation. No copyrighted books/docs pasted verbatim.
  11. Neutral tone. Compare models; do not campaign for a personality. “Leadership” means a documented role (founder, ops team, or named committee), not an informal cult of personality in product copy.
  12. LUNC / Terra Classic is an in-scope negative case (competing agendas, low-information votes, execution stall) — study mechanisms, not personalities.
  13. No legal advice. Flag where a model implies securities, fiduciary, or licensing questions and stop at “needs counsel”; do not invent a legal regime.

Relevant files (read; write only the research deliverable unless a tiny doc cross-link is needed)

Read (current product — do not contradict without a follow-up issue):

  • docs/HANDOFF.md, docs/ARCHITECTURE.md, docs/OPERATOR_VOTING.md, docs/FRONTEND.md, docs/LEDGER_INVARIANTS.md, docs/OPS.md, README.md, AGENTS.md
  • ledger/migrations/20260825000002_voting.sql
  • operator-voting/src/api.rs, payload.rs, blacklist.rs (what the control plane actually enforces)
  • frontend/src/pages/VoteListPage.tsx, VoteNewPage.tsx, VoteDetailPage.tsx (advisory copy, open-on-create UX)
  • Issues #2, #3, #4, #10, #11

Write (this issue):

  • New docs/GOVERNANCE_RESEARCH.md (or equivalent path agreed in the MR) — case studies, vote-scope matrix, recommendations, attack-surface notes, explicit non-goals.
  • Optional one-line pointers from docs/ARCHITECTURE.md / docs/HANDOFF.md / docs/ISSUE_MIGRATION.md only so agents can find the note. No product-behavior change.

Recommended direction

1. Research questions (must all be answered in the doc)

ID Question
Q1 What decisions do comparable projects put to token holders vs leadership/stewards/risk teams vs a feasibility reviewer who cannot vote as a bloc?
Q2 How do successful hybrids implement “leadership proposes, holders ratify” (recommended option + rationale) rather than an open strategy marketplace?
Q3 How is risk/reward (treasury size, LP depth, collateral/assets, issuance) framed so holders choose a point on a spectrum without directing engineering?
Q4 What stage 1 vs stage 2 splits exist (tooling first, constitution later)? What broke when process was skipped or when process arrived too early?
Q5 Continuity / succession: how did projects survive founder absence, key-person risk, or multisig loss? What is the minimum written process this repo should eventually support without implying on-chain control?
Q6 Phased deployment (tranches, review windows, halt): which treasuries/LP programs used this, and what were the halt conditions?
Q7 Negative cases: LUNC-style on-chain governance and at least two other stalled or captured DAOs — mechanisms, not drama.
Q8 What of the above can map onto this stack (advisory snapshots, dual chain, Legal, 1000 CL8Y propose gate, blacklist) vs what would require a new issue / different repo (e.g. actual fund movement)?

2. Suggested case-study set (minimum; add others if they teach a distinct lesson)

Cover at least eight, each with: model type, what is voted, who proposes, who executes, snapshot vs on-chain, known attacks, fit/misfit for CL8Y.

  • Terra Classic / LUNC — on-chain gov, competing agendas, low-information votes, execution stall (negative).
  • MakerDAO / Sky — risk parameter votes vs executive spells; delegated risk teams.
  • Aave — service providers vs token votes; payload review.
  • Uniswap — temperature check / Snapshot vs on-chain; foundation vs DAO.
  • Optimism Collective — bicameral (token vs citizens); grants vs protocol.
  • Arbitrum — constitution, Security Council, proposal process.
  • Lido — dual governance / staker vs token-holder tension.
  • Yearn — yTeams / delegated ops vs token veto (or current equivalent).
  • Snapshot + Safe (generic) — offchain signal, separate execution — closest analog to advisory polls here.
  • ENS or Gitcoin — steward / working-group models.
  • Optional extras if they add a unique failure: Compound (proposal threshold / governor), Curve ve-lock capture, Nouns frequent-vote fatigue, Cosmos Hub param governance.

3. Deliverable shape

docs/GOVERNANCE_RESEARCH.md should contain:

  1. Short product recap (stage 1 = impartial dual-chain advisory snapshots).
  2. Synthesized holder goals (no quotes/names).
  3. Case-study table + one subsection each.
  4. Vote-scope matrix for CL8Y v1 vs later: rows such as protocol engineering, wallet/RPC ops, Legal, LP depth / asset mix, issuance, fundamental governance, day-to-day marketing. Columns: leadership decides; leadership proposes + holder ratifies; holders originate; out of scope for this repo.
  5. Mapping to #10 / #11 (what the template and review gate should emphasize: recommendation + risk spectrum + feasibility check, not a second electorate).
  6. Continuity recommendations that are documentary (runbooks, dual-chain ops, who can rotate blacklist/committee env) — not new keys in git.
  7. Explicit non-recommendations (on-chain governor, merging identities, binding this API to DEX factory admin, copying LUNC deposit/vote UX).
  8. Follow-up issue sketches (titles + one paragraph each) if the research justifies product work beyond #10/#11. Do not file those issues in this task unless a maintainer asks.

4. Out of scope for the MR that closes this issue

  • Schema/API/UI changes to proposals, statuses, committees, AI review, or execution.
  • Changing advisory: true or freeze-at-create (that remains #11 if freeze moves to vote-open).
  • Coolify / Legal admin leftover from #7.

Acceptance criteria

  • docs/GOVERNANCE_RESEARCH.md exists on the default branch (or an MR targeting it) and answers Q1–Q8.
  • At least eight case studies with sources (URLs or citations). LUNC/Terra Classic is included as a negative case.
  • Vote-scope matrix distinguishes technical/operational leadership from holder ratification of major fund/risk/issuance/governance items, and from “open strategy menu” polls.
  • Hybrid recommendation is leadership proposes (with a preferred option and rationale), holders approve or reject for in-scope major items — not “committee votes instead of holders.”
  • Oversight is described as feasibility / completeness review, aligned with #11, not a second token vote.
  • Dual-chain identity, advisory copy, no-new-contracts, no-archive, Legal, and least-privilege constraints are each called out as binding on any future implementation.
  • Continuity / key-person risk has a short section with actions that do not require new contracts.
  • Tranche / halt pattern is covered with at least one real example and a note that execution is not this API.
  • Private community chat is not pasted; no participant identifiers.
  • No production code behavior change required to close, except optional doc cross-links.
  • Follow-up work is listed as issue sketches, not silently implemented.

Test plan (all paths)

Research “paths” = coverage of questions, constraints, and reader roles. Treat the doc as the artifact under test.

  1. Q1–Q8 present: each question has a heading or explicit answer; none left as “TODO.”
  2. Case-study floor: count ≥ 8; each has model, vote-scope, proposer, executor, snapshot vs on-chain, at least one attack or failure mode, CL8Y fit (yes / no / later issue).
  3. Hybrid path: a reader can answer “who decides LP depth vs who decides how to implement a pool” without the private community thread. Expected: holders ratify depth/risk; leadership implements.
  4. Leadership-proposes path: recommended option + rationale + yes/no (or bounded alternatives) — not N unstructured strategies.
  5. Open-marketplace path (reject): doc states why unconstrained competing agendas are out of scope, with LUNC (and at least one other) as evidence.
  6. Stage-1 vs stage-2 path: maps current repo (register/propose/vote, dual chain) to stage 1; maps #10/#11 and written hierarchy to stage 2; does not block shipping stage 1 on a constitution.
  7. Feasibility-reviewer path: reviewer cannot pass/fail the outcome as a voting bloc; they can block a poll that is incomplete, infeasible, or unsafe to describe (align with #11).
  8. Continuity path: founder unavailable — what still works today (signed votes, ledger, ops docs) vs what would break (human blacklist/env, Legal admin, Coolify). No fantasy “the DAO runs itself.”
  9. Tranche path: large target decomposed; review window; halt. Clear that halt is an ops/treasury process, not POST /v1/votes.
  10. Dual-chain path: every recommendation is checked against Terra and BSC holders; no Terra-only electorate.
  11. Constraint path: grep the doc for forbidden pitches (governor.sol, CosmWasm voting contract, archive LCD, merge terra+evm identity, factory multisig control from this app) — each appears only as do not do.
  12. Related-issue path: #10/#11 cited correctly (template + draft gate); this issue does not re-specify their APIs.
  13. Anonymization path: no Discord handles, real names from the source chat, or quoted unique phrases that identify speakers.
  14. Link hygiene: cited URLs fetch or are archived; no secrets, no .env, no admin tokens.
  15. Agent path: AGENTS.md / HANDOFF.md (if linked) send a new agent to the research doc before inventing a governance model.

Test plan — attack, hack & abuse vectors

The research must catalog how comparable systems were abused and state whether CL8Y stage 1 already mitigates, #10/#11 mitigate, or a follow-up is required. Include at least:

  1. Low-information / herd voting — voters sign without understanding (LUNC-style). Mitigation in-tree: #10 sections; this doc must not recommend longer unstructured HTML as the fix.
  2. Agenda flooding / competing proposals — many conflicting polls, no coherent strategy. Mitigation: leadership-proposes + #11 open-gate; doc must not recommend permissionless executable payloads.
  3. Whale / plutocracy capture — large CL8Y balance dominates. Document snapshot+token-weight as explicit (this product is token-weighted). Do not pretend 1w1v. Note vote-buying, last-minute transfers (already documented in LEDGER_INVARIANTS.md: dump-after-freeze vs buy-before-freeze).
  4. Flash-loan / same-block governance (on-chain governors) — N/A to this offchain snapshot if registration+freeze hold; still explain why copying Compound-style on-chain voting would re-introduce it.
  5. Identity merge / sybil — claiming terra1 + 0x are “the same person.” Hard rule: do not merge. Research must not recommend social-graph linking as v1 identity.
  6. Committee / “expert” capture — oversight that votes or silently rewrites outcomes. Required stance: feasibility review ≠ electorate. Allowlists (future, #11) are key-compromise surfaces — document rotation, not on-chain magic.
  7. Social engineering / impersonation — fake “official recommendation.” Doc should say product copy must attribute recommendations to signed addresses or published ops channels, never to a display name alone.
  8. Process theater — polls used to rubber-stamp while implying decentralization. Advisory disclosure must stay; research must not recommend hiding advisory: true.
  9. Scope creep into execution — a passed poll treated as authority to move funds or change factory fees. Architecture already forbids this; research must repeat it.
  10. Continuity attacks — single operator key, GitLab, Coolify, blacklist env, Legal admin. Research lists these as ops bus-factor, pointing at docs/OPS.md, not as a new voting feature.
  11. Phased-deploy griefing — halt used in bad faith, or tranches used to bypass a failed poll. Doc should require that tranche plans are inside the ratified proposal, not informal after-the-fact.
  12. Legal / clickwrap bypass — governance “emergency” that skips terms. Out of scope to weaken Legal; research must say so.
  13. Research-doc supply chain — poisoned or AI-hallucinated case studies. Require URLs; flag unsourced claims.
  14. Privacy leak via this issue/MR — re-paste of the private chat. Reviewer checklist: no names/quotes from the source thread.
  15. Copyright / scraped dumps — no verbatim whitepapers or books.

If a case study’s famous hack has no CL8Y analog, say N/A and why (usually: no executable governor).

Verification criteria

  • Maintainer can read only docs/GOVERNANCE_RESEARCH.md and explain the intended hybrid model in a few sentences without referencing the private chat.
  • A second reviewer (or agent) greps the MR for participant names/handles from the source discussion and finds none.
  • Q1–Q8 and ≥8 case studies checked off.
  • Vote-scope matrix reviewed against hard rules in AGENTS.md (no contracts, no archive, BSC core, identity, Legal, least privilege).
  • Recommendations for #10/#11 are additive (what sections/review should emphasize), not a rewrite of those issues’ acceptance criteria.
  • gitleaks detect --source . --config .gitleaks.toml clean on the MR.
  • No application tests required to close this issue. If optional cross-links were added, existing cargo test --workspace --lib and cd frontend && npm test still pass.
  • Close this issue when the doc is merged; file follow-up implementation issues only from the sketches, with maintainer approval.

Labels

product architecture security enhancement

Priority

P2 — informs #10/#11 and later vote-scope work; does not block stage-1 ops (#7–#9).

Depends on

None. Complements #10 and #11. Do not wait for those MRs to start the research.

## Summary Investigate **hybrid governance models** and published DAO / treasury case studies so CL8Y voting can stay a **leadership-led, holder-ratified** system instead of either (a) putting every operational decision to a token poll or (b) leaving community funds and risk-tolerance choices with no holder mandate. This issue is **research + a written recommendation**. It does **not** implement a new governor, committee, or proposal type. Product follow-ups (template [#10](https://gitlab.com/PlasticDigits/voting/-/issues/10), draft/review [#11](https://gitlab.com/PlasticDigits/voting/-/issues/11), and any later “what may be voted”) should cite this note. Holder themes below are **synthesized** from a private community discussion (2026-08-29–30). Individual messages, handles, and quotes are **not** reproduced. --- ## Current codebase This repo is **stage-1 tooling**: an impartial offchain snapshot poll for registered Terra Classic CW20 and BSC BEP-20 CL8Y wallets. It does not encode a constitution, vote-scope taxonomy, leadership role, treasury executor, or succession plan. | Area | Today | |------|--------| | Product | Dual-chain register → propose (≥1000 CL8Y on **that** address’s chain) → for/against/abstain. Weight is a frozen `{ terra_height, bsc_block }` snapshot. Votes are **advisory / offchain**. | | Schema | `voting.proposals` (`ledger/migrations/20260825000002_voting.sql`): title + freeform HTML, `status` default `'open'`, freeze heights at **create**. No proposal category, no “major vs operational” flag, no committee/oversight tables, no tranche/execution records. | | API | `operator-voting`: `POST /v1/register`, `POST /v1/proposals`, `POST /v1/proposals/:id/votes`. `GET /v1/proposals/:id` returns `advisory: true`. Blacklist is env (`VOTING_BLACKLIST_ADDRESSES`), not a governance body. | | dApp | `frontend/`: `/`, `/new`, `/:id` (+ `/vote*` aliases). Copy: “Offchain / advisory.” Legal clickwrap before transactional UI. DEX Terra + Bridge EVM wallets. | | Identity | One address, one voter. Terra and BSC are never merged. | | Related issues (not done) | [#10](https://gitlab.com/PlasticDigits/voting/-/issues/10) structured sections. [#11](https://gitlab.com/PlasticDigits/voting/-/issues/11) draft + comments + feasibility/analysis gate **before** votes open. Neither defines *which decisions* belong on a ballot. | | Explicit non-goal in tree | `docs/ARCHITECTURE.md`: offchain polls do **not** move DEX factory wasm admin / fee governance (`terra1zlmv2xydxcusurtr6rl78wsvytdc6mfex6hep7`). UI must not imply on-chain DAO finality. | | Hard rules | No new CosmWasm/Solidity voting contracts. No archive node. BSC is core. Least-privilege DB role. No browser `VITE_*` BSC RPC. | There is **no** in-repo doctrine for: founder/management recommendation vs open option menus; technical vs risk/reward ballots; staged liquidity / treasury tranches; continuity if a key individual is unavailable; or how an oversight group should check feasibility without becoming a second electorate. --- ## Why this is needed Stage 1 makes it possible for holders to act. It does not answer **what voting is for**. Community discussion converged on a hybrid, not on “vote everything” and not on “never vote”: 1. **Technical and day-to-day operational direction** should stay with people who understand the system (founder and/or a small management team), so execution stays coherent. 2. **Risk/reward and community-capital choices** (how much liquidity to deploy, which assets, token issuance, material risk changes, fundamental governance) have no single “correct” engineering answer. Holders who bear the risk need a mandate and bounds — after being advised, not after being handed a blank strategy contest. 3. **Leadership should propose**: evaluate options, pick a recommended path, explain reasoning, then ask holders to approve or reject. Presenting several equal options and asking the community to invent strategy is the failure mode to avoid (competing agendas, stalled progress — the pattern holders associate with LUNC-style on-chain governance). 4. **Oversight, if any, should verify feasibility** (is this implementable, legal, funded, scoped?) rather than recast the same vote. 5. **Stage 2 process** (how a proposal is researched and written, hierarchy, review) can land after stage 1 is impartial and dual-chain. [#10](https://gitlab.com/PlasticDigits/voting/-/issues/10) / [#11](https://gitlab.com/PlasticDigits/voting/-/issues/11) are the in-tree process drafts; this issue supplies **external evidence** so those designs are not invented in a vacuum. 6. **Continuity**: the larger the ecosystem, the more the voting system and written process must outlive any one person. Rapid scaling is the current focus; bus-factor still belongs in the research, not as an excuse to delay shipping stage 1. 7. **Phased execution** (e.g. a large liquidity target as smaller tranches with review windows and a stop) is a governance *pattern*, not a ledger feature today. Case studies should say when tranche + kill-switch designs actually worked. Without this research, later product issues will either over-fit one conversation or copy a famous DAO that violates this repo’s constraints (on-chain governor, archive snapshots, identity merging, executable treasury from this API). --- ## Constraints / guardrails 1. **Do not publish the private conversation.** No names, handles, Discord/Telegram quotes, screenshots, or message timestamps in this issue, in MRs, or in the research doc. Synthesize themes only. 2. **No new smart contracts** (no CosmWasm governor, no Solidity snapshot/token governor, no on-chain treasury from this repo). 3. **No archive node** and no rewriting the registration ledger model. 4. **Votes stay offchain / advisory** unless a *later* issue, after this research, explicitly changes product scope. This research must not quietly rebrand polls as binding DAO finality or as DEX factory governance. 5. **BSC is core.** Case studies that are Cosmos-only or Ethereum-only must still be mapped to a **dual-chain** electorate (Terra `terra1…` and BSC `0x…` separate). 6. **Identity v1 = one address, one voter.** Do not recommend silent merge of Terra and EVM wallets. 7. **Least privilege / Legal / wallets** unchanged: no `ADMIN_TOKEN` in the frontend, no seeds, no `VITE_*` BSC RPC, Legal clickwrap still required for transactional UI. 8. **Do not implement** committee allowlists, proposal categories, or tranche engines **in this issue**. Recommend; open follow-up issues if the note justifies them. 9. **Do not treat [#10](https://gitlab.com/PlasticDigits/voting/-/issues/10) / [#11](https://gitlab.com/PlasticDigits/voting/-/issues/11) as done.** Cite them as in-flight process work. Research may refine their scope; it must not duplicate their implementation checklists. 10. **Primary sources.** Prefer official docs, post-mortems, and well-cited analyses. Mark speculation. No copyrighted books/docs pasted verbatim. 11. **Neutral tone.** Compare models; do not campaign for a personality. “Leadership” means a documented role (founder, ops team, or named committee), not an informal cult of personality in product copy. 12. **LUNC / Terra Classic** is an **in-scope negative case** (competing agendas, low-information votes, execution stall) — study mechanisms, not personalities. 13. **No legal advice.** Flag where a model implies securities, fiduciary, or licensing questions and stop at “needs counsel”; do not invent a legal regime. --- ## Relevant files (read; write only the research deliverable unless a tiny doc cross-link is needed) **Read (current product — do not contradict without a follow-up issue):** - `docs/HANDOFF.md`, `docs/ARCHITECTURE.md`, `docs/OPERATOR_VOTING.md`, `docs/FRONTEND.md`, `docs/LEDGER_INVARIANTS.md`, `docs/OPS.md`, `README.md`, `AGENTS.md` - `ledger/migrations/20260825000002_voting.sql` - `operator-voting/src/api.rs`, `payload.rs`, `blacklist.rs` (what the control plane actually enforces) - `frontend/src/pages/VoteListPage.tsx`, `VoteNewPage.tsx`, `VoteDetailPage.tsx` (advisory copy, open-on-create UX) - Issues [#2](https://gitlab.com/PlasticDigits/voting/-/issues/2), [#3](https://gitlab.com/PlasticDigits/voting/-/issues/3), [#4](https://gitlab.com/PlasticDigits/voting/-/issues/4), [#10](https://gitlab.com/PlasticDigits/voting/-/issues/10), [#11](https://gitlab.com/PlasticDigits/voting/-/issues/11) **Write (this issue):** - New `docs/GOVERNANCE_RESEARCH.md` (or equivalent path agreed in the MR) — case studies, vote-scope matrix, recommendations, attack-surface notes, explicit non-goals. - Optional one-line pointers from `docs/ARCHITECTURE.md` / `docs/HANDOFF.md` / `docs/ISSUE_MIGRATION.md` **only** so agents can find the note. No product-behavior change. --- ## Recommended direction ### 1. Research questions (must all be answered in the doc) | ID | Question | |----|----------| | Q1 | What decisions do comparable projects put to token holders vs leadership/stewards/risk teams vs a feasibility reviewer who cannot vote as a bloc? | | Q2 | How do successful hybrids implement **“leadership proposes, holders ratify”** (recommended option + rationale) rather than an open strategy marketplace? | | Q3 | How is **risk/reward** (treasury size, LP depth, collateral/assets, issuance) framed so holders choose a point on a spectrum without directing engineering? | | Q4 | What **stage 1 vs stage 2** splits exist (tooling first, constitution later)? What broke when process was skipped or when process arrived too early? | | Q5 | Continuity / succession: how did projects survive founder absence, key-person risk, or multisig loss? What is the minimum *written* process this repo should eventually support without implying on-chain control? | | Q6 | Phased deployment (tranches, review windows, halt): which treasuries/LP programs used this, and what were the halt conditions? | | Q7 | Negative cases: LUNC-style on-chain governance and at least two other stalled or captured DAOs — mechanisms, not drama. | | Q8 | What of the above can map onto **this** stack (advisory snapshots, dual chain, Legal, 1000 CL8Y propose gate, blacklist) vs what would require a new issue / different repo (e.g. actual fund movement)? | ### 2. Suggested case-study set (minimum; add others if they teach a distinct lesson) Cover **at least eight**, each with: model type, what is voted, who proposes, who executes, snapshot vs on-chain, known attacks, fit/misfit for CL8Y. - **Terra Classic / LUNC** — on-chain gov, competing agendas, low-information votes, execution stall (negative). - **MakerDAO / Sky** — risk parameter votes vs executive spells; delegated risk teams. - **Aave** — service providers vs token votes; payload review. - **Uniswap** — temperature check / Snapshot vs on-chain; foundation vs DAO. - **Optimism Collective** — bicameral (token vs citizens); grants vs protocol. - **Arbitrum** — constitution, Security Council, proposal process. - **Lido** — dual governance / staker vs token-holder tension. - **Yearn** — yTeams / delegated ops vs token veto (or current equivalent). - **Snapshot + Safe** (generic) — offchain signal, separate execution — closest analog to *advisory* polls here. - **ENS** or **Gitcoin** — steward / working-group models. - Optional extras if they add a unique failure: Compound (proposal threshold / governor), Curve ve-lock capture, Nouns frequent-vote fatigue, Cosmos Hub param governance. ### 3. Deliverable shape `docs/GOVERNANCE_RESEARCH.md` should contain: 1. Short product recap (stage 1 = impartial dual-chain advisory snapshots). 2. Synthesized holder goals (no quotes/names). 3. Case-study table + one subsection each. 4. **Vote-scope matrix** for CL8Y v1 vs later: rows such as protocol engineering, wallet/RPC ops, Legal, LP depth / asset mix, issuance, fundamental governance, day-to-day marketing. Columns: leadership decides; leadership proposes + holder ratifies; holders originate; out of scope for this repo. 5. Mapping to [#10](https://gitlab.com/PlasticDigits/voting/-/issues/10) / [#11](https://gitlab.com/PlasticDigits/voting/-/issues/11) (what the template and review gate should emphasize: recommendation + risk spectrum + feasibility check, not a second electorate). 6. Continuity recommendations that are **documentary** (runbooks, dual-chain ops, who can rotate blacklist/committee env) — not new keys in git. 7. **Explicit non-recommendations** (on-chain governor, merging identities, binding this API to DEX factory admin, copying LUNC deposit/vote UX). 8. Follow-up issue sketches (titles + one paragraph each) if the research justifies product work beyond #10/#11. Do not file those issues in this task unless a maintainer asks. ### 4. Out of scope for the MR that closes this issue - Schema/API/UI changes to proposals, statuses, committees, AI review, or execution. - Changing `advisory: true` or freeze-at-create (that remains #11 if freeze moves to vote-open). - Coolify / Legal admin leftover from [#7](https://gitlab.com/PlasticDigits/voting/-/issues/7). --- ## Acceptance criteria - [ ] `docs/GOVERNANCE_RESEARCH.md` exists on the default branch (or an MR targeting it) and answers Q1–Q8. - [ ] At least eight case studies with sources (URLs or citations). LUNC/Terra Classic is included as a negative case. - [ ] Vote-scope matrix distinguishes technical/operational leadership from holder ratification of **major** fund/risk/issuance/governance items, and from “open strategy menu” polls. - [ ] Hybrid recommendation is **leadership proposes (with a preferred option and rationale), holders approve or reject** for in-scope major items — not “committee votes instead of holders.” - [ ] Oversight is described as **feasibility / completeness review**, aligned with [#11](https://gitlab.com/PlasticDigits/voting/-/issues/11), not a second token vote. - [ ] Dual-chain identity, advisory copy, no-new-contracts, no-archive, Legal, and least-privilege constraints are each called out as binding on any future implementation. - [ ] Continuity / key-person risk has a short section with actions that do not require new contracts. - [ ] Tranche / halt pattern is covered with at least one real example and a note that execution is **not** this API. - [ ] Private community chat is **not** pasted; no participant identifiers. - [ ] No production code behavior change required to close, except optional doc cross-links. - [ ] Follow-up work is listed as issue sketches, not silently implemented. --- ## Test plan (all paths) Research “paths” = coverage of questions, constraints, and reader roles. Treat the doc as the artifact under test. 1. **Q1–Q8 present:** each question has a heading or explicit answer; none left as “TODO.” 2. **Case-study floor:** count ≥ 8; each has model, vote-scope, proposer, executor, snapshot vs on-chain, at least one attack or failure mode, CL8Y fit (yes / no / later issue). 3. **Hybrid path:** a reader can answer “who decides LP depth vs who decides how to implement a pool” without the private community thread. Expected: holders ratify depth/risk; leadership implements. 4. **Leadership-proposes path:** recommended option + rationale + yes/no (or bounded alternatives) — not N unstructured strategies. 5. **Open-marketplace path (reject):** doc states why unconstrained competing agendas are out of scope, with LUNC (and at least one other) as evidence. 6. **Stage-1 vs stage-2 path:** maps current repo (register/propose/vote, dual chain) to stage 1; maps #10/#11 and written hierarchy to stage 2; does not block shipping stage 1 on a constitution. 7. **Feasibility-reviewer path:** reviewer cannot pass/fail the *outcome* as a voting bloc; they can block a poll that is incomplete, infeasible, or unsafe to *describe* (align with #11). 8. **Continuity path:** founder unavailable — what still works today (signed votes, ledger, ops docs) vs what would break (human blacklist/env, Legal admin, Coolify). No fantasy “the DAO runs itself.” 9. **Tranche path:** large target decomposed; review window; halt. Clear that halt is an ops/treasury process, not `POST /v1/votes`. 10. **Dual-chain path:** every recommendation is checked against Terra **and** BSC holders; no Terra-only electorate. 11. **Constraint path:** grep the doc for forbidden pitches (`governor.sol`, CosmWasm voting contract, archive LCD, merge terra+evm identity, factory multisig control from this app) — each appears only as **do not do**. 12. **Related-issue path:** #10/#11 cited correctly (template + draft gate); this issue does not re-specify their APIs. 13. **Anonymization path:** no Discord handles, real names from the source chat, or quoted unique phrases that identify speakers. 14. **Link hygiene:** cited URLs fetch or are archived; no secrets, no `.env`, no admin tokens. 15. **Agent path:** `AGENTS.md` / `HANDOFF.md` (if linked) send a new agent to the research doc before inventing a governance model. --- ## Test plan — attack, hack & abuse vectors The research must **catalog** how comparable systems were abused and state whether CL8Y stage 1 already mitigates, #10/#11 mitigate, or a follow-up is required. Include at least: 1. **Low-information / herd voting** — voters sign without understanding (LUNC-style). Mitigation in-tree: #10 sections; this doc must not recommend longer unstructured HTML as the fix. 2. **Agenda flooding / competing proposals** — many conflicting polls, no coherent strategy. Mitigation: leadership-proposes + #11 open-gate; doc must not recommend permissionless executable payloads. 3. **Whale / plutocracy capture** — large CL8Y balance dominates. Document snapshot+token-weight as **explicit** (this product is token-weighted). Do not pretend 1w1v. Note vote-buying, last-minute transfers (already documented in `LEDGER_INVARIANTS.md`: dump-after-freeze vs buy-before-freeze). 4. **Flash-loan / same-block governance** (on-chain governors) — N/A to this offchain snapshot if registration+freeze hold; still explain why copying Compound-style on-chain voting would re-introduce it. 5. **Identity merge / sybil** — claiming `terra1` + `0x` are “the same person.” Hard rule: do not merge. Research must not recommend social-graph linking as v1 identity. 6. **Committee / “expert” capture** — oversight that *votes* or silently rewrites outcomes. Required stance: feasibility review ≠ electorate. Allowlists (future, #11) are key-compromise surfaces — document rotation, not on-chain magic. 7. **Social engineering / impersonation** — fake “official recommendation.” Doc should say product copy must attribute recommendations to signed addresses or published ops channels, never to a display name alone. 8. **Process theater** — polls used to rubber-stamp while implying decentralization. Advisory disclosure must stay; research must not recommend hiding `advisory: true`. 9. **Scope creep into execution** — a passed poll treated as authority to move funds or change factory fees. Architecture already forbids this; research must repeat it. 10. **Continuity attacks** — single operator key, GitLab, Coolify, blacklist env, Legal admin. Research lists these as ops bus-factor, pointing at `docs/OPS.md`, not as a new voting feature. 11. **Phased-deploy griefing** — halt used in bad faith, or tranches used to bypass a failed poll. Doc should require that tranche plans are **inside** the ratified proposal, not informal after-the-fact. 12. **Legal / clickwrap bypass** — governance “emergency” that skips terms. Out of scope to weaken Legal; research must say so. 13. **Research-doc supply chain** — poisoned or AI-hallucinated case studies. Require URLs; flag unsourced claims. 14. **Privacy leak via this issue/MR** — re-paste of the private chat. Reviewer checklist: no names/quotes from the source thread. 15. **Copyright / scraped dumps** — no verbatim whitepapers or books. If a case study’s famous hack has no CL8Y analog, say **N/A** and why (usually: no executable governor). --- ## Verification criteria - [ ] Maintainer can read only `docs/GOVERNANCE_RESEARCH.md` and explain the intended hybrid model in a few sentences without referencing the private chat. - [ ] A second reviewer (or agent) greps the MR for participant names/handles from the source discussion and finds **none**. - [ ] Q1–Q8 and ≥8 case studies checked off. - [ ] Vote-scope matrix reviewed against hard rules in `AGENTS.md` (no contracts, no archive, BSC core, identity, Legal, least privilege). - [ ] Recommendations for #10/#11 are additive (what sections/review should emphasize), not a rewrite of those issues’ acceptance criteria. - [ ] `gitleaks detect --source . --config .gitleaks.toml` clean on the MR. - [ ] No application tests required to *close* this issue. If optional cross-links were added, existing `cargo test --workspace --lib` and `cd frontend && npm test` still pass. - [ ] Close this issue when the doc is merged; file follow-up implementation issues only from the sketches, with maintainer approval. ## Labels `product` `architecture` `security` `enhancement` ## Priority P2 — informs #10/#11 and later vote-scope work; does not block stage-1 ops (#7–#9). ## Depends on None. Complements [#10](https://gitlab.com/PlasticDigits/voting/-/issues/10) and [#11](https://gitlab.com/PlasticDigits/voting/-/issues/11). Do not wait for those MRs to start the research.
PlasticDigits commented 2026-08-30 02:46:49 +00:00 (Migrated from gitlab.com)

marked as related to #10

marked as related to #10
PlasticDigits commented 2026-08-30 02:46:50 +00:00 (Migrated from gitlab.com)

marked as related to #11

marked as related to #11
PlasticDigits commented 2026-08-30 02:47:06 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
PlasticDigits commented 2026-08-30 05:37:16 +00:00 (Migrated from gitlab.com)

Research first pass + second pass complete. Deliverable is docs/GOVERNANCE_RESEARCH.md (local tree; not merged yet) with one-line pointers from AGENTS.md, docs/HANDOFF.md, docs/ARCHITECTURE.md, docs/ISSUE_MIGRATION.md. No schema/API/UI change. Private community chat is not quoted. gitleaks clean.

Summary

Intended hybrid (few sentences): Leadership decides how to implement (engineering, wallets, RPC, Legal wiring, marketing). For major fund, risk, issuance, and governance-rule items, leadership publishes one recommended option plus rationale; registered Terra and BSC holders approve or reject. A feasibility reviewer (#11) can refuse to open an incomplete or infeasible poll; they cannot vote as a bloc. Polls stay advisory: true. This API does not execute and does not move DEX factory admin.

Closest analog: Snapshot temperature check + separate Safe/ops execution (Uniswap labeled temp check). Not LUNC x/gov, not Compound governor.sol, not Snapshot-sum of two chains into one person.

#10/#11 (additive): Template should force recommended option + risk spectrum + tranche/halt in the text. Review gate = completeness/feasibility, not a second electorate. Do not rewrite those issues’ APIs.

Do not: CosmWasm voting contract, governor.sol, archive LCD electorate, merge terra1+0x, bind this app to factory multisig, hide advisory: true, skip Legal for an “emergency.”

Tradeoffs: Token-weight is plutocracy (explicit; Curve/UNI prove pretending 1w1v is theater). Leadership-proposes can fail a plurality “winner” (honest). Tranches preserve unspent capital but halt can be griefed if not inside the ratified plan. Committee allowlists are key-compromise surfaces (rotate; don’t on-chain-magic). Process too early (Nouns: vote every grant) vs skipped (Arbitrum AIP-1 theater; LUNC marketplace).

Further study: (1) how to attribute “official recommendation” in UI without a new table; (2) optional decision-class enum after #10; (3) OPS rotation for blacklist / future committee / Legal admin; (4) counsel on treasury/issuance votes — flagged only, not a regime.

Follow-up sketches are in the doc §12; not filed.

Raw research (evidence)

GitLab API

Live API (2026-08-30)

Terra Classic LCD https://terra-classic-lcd.publicnode.com/cosmos/gov/v1/params/voting|deposit|tallying:

  • min_deposit 5000000000000uluna, max_deposit_period 1209600s, voting_period 604800s
  • quorum 0.40, threshold 0.50, veto_threshold 0.334, burn_vote_veto true
  • expedited_voting_period 86400s, expedited_threshold 0.667

Proposal 12223 (passed) https://terra-classic-lcd.publicnode.com/cosmos/gov/v1/proposals/12223 — “Set the On-Chain Tax Rate to 1.5%”:

  • yes 231876673886989204 (~32.4% of all)
  • abstain 274758471623727508 (~38.4% — largest bucket)
  • no 90327057449449583
  • no_with_veto 118327059186321346
  • yes / (yes+no+veto) ≈ 52.6% → passes threshold because abstain is excluded. Low-information / herd path.

Recent mix (LCD reverse sample): 12225 voting (IBC relaying fund), 12224 rejected (community pool ceilings), 12223 tax, 12222 Hyperlane funding, 12221/12218 upgrades, 12219 signal USTC staking. Open marketplace of types.

Snapshot GraphQL https://hub.snapshot.org/graphql space uniswapgovernance.eth:

  • strategy uni token 0x1f9840a85d5aF5bf1D1762F925BDADdC4201F984 network 1
  • voting.period 432000 (5 days), quorum 10_000_000 — matches UF temp-check docs.

Simulations (/tmp/gov-research/sim_governance.py, sim_12223_tally.py)

  • Token-weight: 80k whale beats 100×100 small; 1w1v would reverse.
  • Dual-chain: merge-max vs sum changes who wins vs Bob 1500; do not merge.
  • Open menu: plurality can “win” while yes/no on that option fails (45–55). LP-coalition framing can pass 70–30 — framing belongs in the write-up.
  • Tranche+halt: halt after t3 spends 7.5M of 10M.
  • Flash vs freeze: live-balance governor flash wins; unregistered CL8Y flash = 0; registered buy-before-freeze = L9.
  • Feasibility: incomplete draft cannot open; committee bloc of 0 cannot flip 70–30 (if they voted they could).

Primary sources (fetched)

Topic URL
LUNC lifecycle / execution gap https://docs.terra-classic.money/governance/proposal-lifecycle/
Maker MIP16 polls ≠ params https://github.com/makerdao/mips/blob/master/MIP16/mip16.md
Sky executive (params + DDM breaker) https://raw.githubusercontent.com/sky-ecosystem/community/master/governance/votes/Executive%20vote%20-%20October%2004%2C%202024.md
Maker ESM https://docs.makerdao.com/smart-contract-modules/shutdown/emergency-shutdown-module.md
Aave process v1 https://governance.aave.com/t/aave-governance-process-document-v1/18577
ACI Skyward https://governance.aave.com/t/introducing-skyward-a-free-service-for-aave-dao-by-aave-chan-initiative/13173
Uniswap Foundation phases https://uniswapfoundation.org/governance
Uniswap OP LM phases RFC https://gov.uniswap.org/t/rfc-the-optimism-uniswap-protocol-liquidity-mining-program/17820
Snapshot strategies (sum) https://docs.snapshot.box/user-guides/voting-strategies
Snapshot blockTag freeze https://docs.snapshot.box/developer-guides/voting-strategy
Optimism houses https://gov.optimism.io/t/about-the-optimism-collective/6118
Optimism DAB + veto https://gov.optimism.io/t/introducing-improvements-to-the-protocol-upgrade-process/10284
Arbitrum constitution / SC 9/12 https://docs.arbitrum.foundation/dao-constitution
AIP-1 (ratify after transfer) https://forum.arbitrum.foundation/t/aip-1-arbitrum-improvement-proposal-framework/30
The Block on AIP-1 split https://www.theblock.co/post/224459/arbitrum-proposal-backlash-response
Lido Dual Gov https://blog.lido.fi/dual-governance-101-explainer/
Yearn constrained delegation https://docs.yearn.fi/contributing/governance/governance-and-operations
ENS WG rules https://docs.ens.domains/dao/wg/rules
Cosmos Hub signaling (unenforceable) https://docs.cosmos.network/hub/latest/governance/proposal-types/text-prop
Beanstalk flash ~$182M https://veridise.com/blog/audit-insights/flash_loan_governance_vulnerability_beanstalk_182m/
Nouns V3 fatigue/fork https://nouns.wtf/vote/356
Gitcoin steward confusion https://gov.gitcoin.co/t/enhancing-our-stewardship-towards-a-more-unified-and-impactful-governance-approach/17099
Gitcoin council retro https://gov.gitcoin.co/t/gitcoin-governance-council-first-term-retro/21773
veToken bribes (arxiv) https://arxiv.org/pdf/2311.17589
Compound Governor Bravo https://github.com/compound-finance/compound-protocol/blob/master/contracts/Governance/GovernorBravoDelegate.sol

Second-pass discoveries (deepened)

  1. 12223 is a live, numeric demonstration of LUNC low-information passage (abstain plurality, param still passed).
  2. Arbitrum AIP-1 is the process-theater twin of hiding advisory: true.
  3. Aave Skyward + Certora is the feasibility-reviewer pattern (#11), with an explicit “does not guarantee YAE.”
  4. Maker poll vs executive is the cleanest “leadership proposes numbers, holders ratify one spell.”
  5. Snapshot strategy sum is how dual-chain merge would sneak in — forbidden.
  6. Uniswap OP LM RFC is a real tranche+review program (50k → 100k → 650k OP options).
  7. Lido Dual Gov is not a Terra+BSC identity analog (staker vs token); keep separate voices, don’t merge wallets.
  8. Gitcoin shows untitled stewards become neither feasibility nor electorate — write #11 rights down.
  9. Compound 62 (secondary): executable governor + timelock delays fixes; not a reason to add a governor here.

Close #13 when the doc is merged. File follow-ups only from §12 with maintainer approval.

Research first pass + second pass complete. Deliverable is `docs/GOVERNANCE_RESEARCH.md` (local tree; not merged yet) with one-line pointers from `AGENTS.md`, `docs/HANDOFF.md`, `docs/ARCHITECTURE.md`, `docs/ISSUE_MIGRATION.md`. No schema/API/UI change. Private community chat is not quoted. `gitleaks` clean. ## Summary **Intended hybrid (few sentences):** Leadership decides how to implement (engineering, wallets, RPC, Legal wiring, marketing). For major fund, risk, issuance, and governance-rule items, leadership publishes **one recommended option plus rationale**; registered Terra **and** BSC holders **approve or reject**. A feasibility reviewer (#11) can refuse to *open* an incomplete or infeasible poll; they cannot vote as a bloc. Polls stay `advisory: true`. This API does not execute and does not move DEX factory admin. **Closest analog:** Snapshot temperature check + separate Safe/ops execution (Uniswap labeled temp check). Not LUNC `x/gov`, not Compound `governor.sol`, not Snapshot-sum of two chains into one person. **#10/#11 (additive):** Template should force recommended option + risk spectrum + tranche/halt *in the text*. Review gate = completeness/feasibility, not a second electorate. Do not rewrite those issues’ APIs. **Do not:** CosmWasm voting contract, `governor.sol`, archive LCD electorate, merge `terra1`+`0x`, bind this app to factory multisig, hide `advisory: true`, skip Legal for an “emergency.” **Tradeoffs:** Token-weight is plutocracy (explicit; Curve/UNI prove pretending 1w1v is theater). Leadership-proposes can fail a plurality “winner” (honest). Tranches preserve unspent capital but halt can be griefed if not inside the ratified plan. Committee allowlists are key-compromise surfaces (rotate; don’t on-chain-magic). Process too early (Nouns: vote every grant) vs skipped (Arbitrum AIP-1 theater; LUNC marketplace). **Further study:** (1) how to attribute “official recommendation” in UI without a new table; (2) optional decision-class enum after #10; (3) OPS rotation for blacklist / future committee / Legal admin; (4) counsel on treasury/issuance votes — flagged only, not a regime. Follow-up sketches are in the doc §12; not filed. --- ## Raw research (evidence) ### GitLab API - Issue: https://gitlab.com/PlasticDigits/voting/-/issues/13 (API iid 13, labels architecture/enhancement/product/security, related #10 and #11, notes are system-only). - Q1–Q8 and ≥8 case studies answered in `docs/GOVERNANCE_RESEARCH.md`. ### Live API (2026-08-30) **Terra Classic LCD** `https://terra-classic-lcd.publicnode.com/cosmos/gov/v1/params/voting|deposit|tallying`: - `min_deposit` `5000000000000uluna`, `max_deposit_period` `1209600s`, `voting_period` `604800s` - `quorum` 0.40, `threshold` 0.50, `veto_threshold` 0.334, `burn_vote_veto` true - `expedited_voting_period` 86400s, `expedited_threshold` 0.667 **Proposal 12223** (passed) `https://terra-classic-lcd.publicnode.com/cosmos/gov/v1/proposals/12223` — “Set the On-Chain Tax Rate to 1.5%”: - yes `231876673886989204` (~32.4% of all) - **abstain `274758471623727508` (~38.4% — largest bucket)** - no `90327057449449583` - no_with_veto `118327059186321346` - yes / (yes+no+veto) ≈ **52.6%** → passes threshold because abstain is excluded. Low-information / herd path. Recent mix (LCD reverse sample): 12225 voting (IBC relaying fund), 12224 rejected (community pool ceilings), 12223 tax, 12222 Hyperlane funding, 12221/12218 upgrades, 12219 **signal** USTC staking. Open marketplace of types. **Snapshot GraphQL** `https://hub.snapshot.org/graphql` space `uniswapgovernance.eth`: - strategy `uni` token `0x1f9840a85d5aF5bf1D1762F925BDADdC4201F984` network `1` - `voting.period` 432000 (5 days), `quorum` 10_000_000 — matches UF temp-check docs. ### Simulations (`/tmp/gov-research/sim_governance.py`, `sim_12223_tally.py`) - Token-weight: 80k whale beats 100×100 small; 1w1v would reverse. - Dual-chain: merge-max vs sum changes who wins vs Bob 1500; **do not merge**. - Open menu: plurality can “win” while yes/no on that option **fails** (45–55). LP-coalition framing can pass 70–30 — framing belongs in the write-up. - Tranche+halt: halt after t3 spends 7.5M of 10M. - Flash vs freeze: live-balance governor flash wins; unregistered CL8Y flash = 0; registered buy-before-freeze = L9. - Feasibility: incomplete draft cannot open; committee bloc of 0 cannot flip 70–30 (if they voted they could). ### Primary sources (fetched) | Topic | URL | |-------|-----| | LUNC lifecycle / execution gap | https://docs.terra-classic.money/governance/proposal-lifecycle/ | | Maker MIP16 polls ≠ params | https://github.com/makerdao/mips/blob/master/MIP16/mip16.md | | Sky executive (params + DDM breaker) | https://raw.githubusercontent.com/sky-ecosystem/community/master/governance/votes/Executive%20vote%20-%20October%2004%2C%202024.md | | Maker ESM | https://docs.makerdao.com/smart-contract-modules/shutdown/emergency-shutdown-module.md | | Aave process v1 | https://governance.aave.com/t/aave-governance-process-document-v1/18577 | | ACI Skyward | https://governance.aave.com/t/introducing-skyward-a-free-service-for-aave-dao-by-aave-chan-initiative/13173 | | Uniswap Foundation phases | https://uniswapfoundation.org/governance | | Uniswap OP LM phases RFC | https://gov.uniswap.org/t/rfc-the-optimism-uniswap-protocol-liquidity-mining-program/17820 | | Snapshot strategies (sum) | https://docs.snapshot.box/user-guides/voting-strategies | | Snapshot `blockTag` freeze | https://docs.snapshot.box/developer-guides/voting-strategy | | Optimism houses | https://gov.optimism.io/t/about-the-optimism-collective/6118 | | Optimism DAB + veto | https://gov.optimism.io/t/introducing-improvements-to-the-protocol-upgrade-process/10284 | | Arbitrum constitution / SC 9/12 | https://docs.arbitrum.foundation/dao-constitution | | AIP-1 (ratify after transfer) | https://forum.arbitrum.foundation/t/aip-1-arbitrum-improvement-proposal-framework/30 | | The Block on AIP-1 split | https://www.theblock.co/post/224459/arbitrum-proposal-backlash-response | | Lido Dual Gov | https://blog.lido.fi/dual-governance-101-explainer/ | | Yearn constrained delegation | https://docs.yearn.fi/contributing/governance/governance-and-operations | | ENS WG rules | https://docs.ens.domains/dao/wg/rules | | Cosmos Hub signaling (unenforceable) | https://docs.cosmos.network/hub/latest/governance/proposal-types/text-prop | | Beanstalk flash ~$182M | https://veridise.com/blog/audit-insights/flash_loan_governance_vulnerability_beanstalk_182m/ | | Nouns V3 fatigue/fork | https://nouns.wtf/vote/356 | | Gitcoin steward confusion | https://gov.gitcoin.co/t/enhancing-our-stewardship-towards-a-more-unified-and-impactful-governance-approach/17099 | | Gitcoin council retro | https://gov.gitcoin.co/t/gitcoin-governance-council-first-term-retro/21773 | | veToken bribes (arxiv) | https://arxiv.org/pdf/2311.17589 | | Compound Governor Bravo | https://github.com/compound-finance/compound-protocol/blob/master/contracts/Governance/GovernorBravoDelegate.sol | ### Second-pass discoveries (deepened) 1. **12223** is a live, numeric demonstration of LUNC low-information passage (abstain plurality, param still passed). 2. **Arbitrum AIP-1** is the process-theater twin of hiding `advisory: true`. 3. **Aave Skyward + Certora** is the feasibility-reviewer pattern (#11), with an explicit “does not guarantee YAE.” 4. **Maker poll vs executive** is the cleanest “leadership proposes numbers, holders ratify one spell.” 5. **Snapshot strategy sum** is how dual-chain merge would sneak in — forbidden. 6. **Uniswap OP LM RFC** is a real tranche+review program (50k → 100k → 650k OP options). 7. **Lido Dual Gov** is *not* a Terra+BSC identity analog (staker vs token); keep separate voices, don’t merge wallets. 8. **Gitcoin** shows untitled stewards become neither feasibility nor electorate — write #11 rights down. 9. **Compound 62** (secondary): executable governor + timelock delays *fixes*; not a reason to add a governor here. Close #13 when the doc is merged. File follow-ups only from §12 with maintainer approval.
PlasticDigits commented 2026-08-30 05:40:17 +00:00 (Migrated from gitlab.com)

Second-pass fold-in from parallel case-study reviews. Hybrid recommendation unchanged. New evidence now in docs/GOVERNANCE_RESEARCH.md §14:

  • Tribe/Fei 2022: Snapshot majority then treated as non-binding (process theater twin of AIP-1).
  • Balancer sums BAL across chains — forbidden here (independent CW20 + BEP-20 supplies).
  • Aave steward envelope (caps ±50%/5d) and Uniswap UAC (ops, not strategy).
  • Lido GOOSE + Easy Track; Yearn YIP-41 sunset drift; ENS Meta-Gov runbook as rotation pattern.
  • Gitcoin 2025: votes as instruction to a Safe, not execution.
  • BitDAO 60% sponsor allocation; Optimism grant milestone halt; UNI 2020 LM endTime.
  • Do not confuse L2Beat rollup stages with this issue’s stage 1/2.

No product-behavior change. Still not filed: follow-up sketches in §12.

Second-pass fold-in from parallel case-study reviews. Hybrid recommendation unchanged. New evidence now in `docs/GOVERNANCE_RESEARCH.md` §14: - Tribe/Fei 2022: Snapshot majority then treated as non-binding (process theater twin of AIP-1). - Balancer sums BAL across chains — forbidden here (independent CW20 + BEP-20 supplies). - Aave steward envelope (caps ±50%/5d) and Uniswap UAC (ops, not strategy). - Lido GOOSE + Easy Track; Yearn YIP-41 sunset drift; ENS Meta-Gov runbook as rotation pattern. - Gitcoin 2025: votes as **instruction** to a Safe, not execution. - BitDAO 60% sponsor allocation; Optimism grant milestone halt; UNI 2020 LM `endTime`. - Do not confuse L2Beat rollup stages with this issue’s stage 1/2. No product-behavior change. Still not filed: follow-up sketches in §12.
PlasticDigits commented 2026-08-30 05:46:25 +00:00 (Migrated from gitlab.com)

mentioned in merge request !22

mentioned in merge request !22
PlasticDigits commented 2026-08-30 05:47:16 +00:00 (Migrated from gitlab.com)

mentioned in merge request !23

mentioned in merge request !23
PlasticDigits commented 2026-08-30 06:04:50 +00:00 (Migrated from gitlab.com)

mentioned in commit 524a3ee79e

mentioned in commit 524a3ee79e3672796d8f8f8046bc4245a05687a9
PlasticDigits commented 2026-08-30 06:22:07 +00:00 (Migrated from gitlab.com)

Research note is on main as docs/GOVERNANCE_RESEARCH.md. Agents are pointed at it from AGENTS.md / HANDOFF.md. Freeze timing in that doc now matches #11 (freeze at vote-open, not draft create). This issue stays research-only — no schema/API/UI from #10/#11 should be treated as closing it.

Research note is on `main` as [`docs/GOVERNANCE_RESEARCH.md`](https://gitlab.com/PlasticDigits/voting/-/blob/main/docs/GOVERNANCE_RESEARCH.md). Agents are pointed at it from `AGENTS.md` / `HANDOFF.md`. Freeze timing in that doc now matches #11 (freeze at vote-open, not draft create). This issue stays research-only — no schema/API/UI from #10/#11 should be treated as closing it.
PlasticDigits commented 2026-08-30 10:26:38 +00:00 (Migrated from gitlab.com)

Follow-up research (stale weight, turnout, secrecy, curves, veto). Folded into docs/GOVERNANCE_RESEARCH.md §15 locally; not merged yet. No schema/API/UI change. Private community chat is not quoted. gitleaks clean on that doc.

Hybrid recommendation from the first note is unchanged: leadership proposes one option; registered Terra and BSC holders ratify; #11 is a feasibility open-gate, not a second electorate; polls stay advisory: true.

Summary

Community follow-up asked: what to do when a large registered holder never votes (herding fear or discount-trading bots), whether to count only cast ballots, whether to dampen weight above a cap, whether to hide who voted, what “30% turnout” means if bots hold supply, and whether a veto should be a token share or a role.

There is a third way. Do not pick only-cast or a weight curve.

  1. Keep 1:1 token weight at freeze. A concave/exponential curve without unique identity is theater (Snapshot QV docs; Circle Research arXiv:2605.18990). Splitting wallets restores linear power. Dual-chain already gives two addresses. Wallet exemptions to preserve a ~50% veto are a special role, in the worst form.

  2. If a later issue ever labels a poll “passed,” quorum denominator = frozen registered set, not circulating supply. LP, bridge, CEX, and fee-tier bots are why registration exists. Arbitrum is moving quorum onto delegated/registered power for the same reason (votable supply grew, participation did not).

  3. Silence is not a vote. Abstain is explicit and should count toward quorum. Only-cast with no floor is an empty-ballot attack (sim: 5 of 100 “pass” 100% yes). Uniswap temp-check “Four for V4” is the opposite failure: ~unanimous For, 5.35M vs 10M quorum — did not meet the floor.

  4. Keep the rolls live: 90-day re-register or prune after N missed open polls. That is how you avoid “never meet quorum because of lost interest / dormant bots.” Cheap attack: re-sign before freeze. Pair with existing Legal clickwrap and a cooldown after prune. Do not auto-count silence as against.

  5. Bots and “30% of circulating”: assume discount-traders mostly never register (Legal + signature). Measure turnout of rolls. If they do register and go dormant, TTL/prune. Do not wait for circulating turnout that includes LP.

  6. Herding / intimidation ≠ true secret ballot. Snapshot/Shutter hides choices until close, then reveals. Aave’s 2023 trial: unique voters 32.6k → 14.2k (did not raise turnout). MACI / permanent privacy needs contracts — forbidden here. This API stores plaintext choice; GET /v1/proposals/:id/votes/:addr is unauthenticated. Fit: hide running tally until close; keep draft comments and #11 analysis attributed; disclose that ops can read the DB.

  7. Veto is a role, not 50% of supply. A silent whale cannot token-veto. Cosmos NoWithVeto requires showing up (share of participating power). Yearn yChad Guardian: nullify, cannot propose. Distinct from #11 committee (open/refuse poll) and blacklist. Because polls are advisory, ops can already refuse to execute; naming the role is honesty and rotation.

Do not implement any of this in #13. Stage 1 stays dual-chain advisory snapshots. Sketches in the doc §12 items 6–8; not filed.

Tradeoffs: 1:1 is plutocracy (explicit). Registered quorum is honest but dies if rolls go stale. Only-cast is live but capture-prone. Shielded-until-close reduces herding and last-minute swings you wanted to see. Permanent anonymity kills audit. A veto role is key-person (rotate; write the rights).

Further study: (1) what % of registered freeze-set is a sane quorum floor once real rolls exist; (2) TTL vs missed-vote prune vs both; (3) whether to authz GET .../votes/:addr; (4) counsel if a named veto over treasury-adjacent mandates looks like control — flagged only.

Raw research (evidence)

GitLab / in-tree

  • Issue: https://gitlab.com/PlasticDigits/voting/-/issues/13
  • Doctrine: docs/GOVERNANCE_RESEARCH.md §15 (this follow-up) · §9 attack rows 19–26 · §10 non-recommendations · §12 sketches 6–8
  • Tally today = sum of cast weights, no quorum: operator-voting/src/db.rs tally
  • GET /v1/proposals/:id/votes/:addr returns {choice, weight} with no caller signature: operator-voting/src/api.rs get_vote
  • Comments render wallet_address: frontend/src/pages/VoteDetailPage.tsx
  • UI does not yet render tally (API still returns it on list/detail JSON)
  • Ledger indexes registered wallets only (L2): docs/LEDGER_INVARIANTS.md

Simulations (/tmp/gov-research-13b/sim_stale_turnout.py)

Electorate 100k circulating = 40k LP/bridge + 20k unregistered bots + 20k active registered + 15k stale whale + 5k dormant registered bots. Cast 12k for / 3k against:

  • 15% of circulating → 40% circulating quorum fails
  • 37.5% of registered → 40% registered quorum fails (stale whale + dormant inflate denom)
  • 75% of active registered → would pass
  • only-cast majority 80% passes (and so would a 5-wallet attack)

Curve sketch (1:1 to 5k, then 0.14× extra): 10k in one wallet = 5700; split 2×5k = 10000 (1.75×). sqrt(10k) honest = 100; 10k wallets of 1 = 10000 (100×). Founder 50k vs ten 5k wallets under the piecewise curve → 18% vote share. Prune missed>3: denom 39k → 19k. Silent whale Cosmos-veto share = 0.

Live API (2026-08-30)

Terra Classic LCD https://terra-classic-lcd.publicnode.com/cosmos/gov/v1/params/tallying

  • quorum 0.40, threshold 0.50, veto_threshold 0.334 (of participating, including abstain in the veto denom per cosmos-sdk tally.go)

Proposal 12223 (passed) still: abstain largest bucket; yes/non-abstain ≈ 52.6%.

Snapshot GraphQL https://hub.snapshot.org/graphql space uniswapgovernance.eth:

  • voting.quorum 10_000_000, privacy "" (not Shutter), period 432000s
  • [Temp Check] - Four for V4 id 0x5ae3426216321df66a67eb677874b725f80e51888ad2da72b382b21669c554ee: scores_total 5_349_527.58, quorum 10_000_000, votes 118, scores [5347713.99, 0, 1813.59] — For/Against/Abstain. Failed quorum while essentially unanimous For.
  • Other recent temp checks in the same fetch did clear 10M (e.g. Protocol Fee Expansion: Three More Chains 48.7M / 363 votes).

veyfi.eth / curve.eth / lido-snapshot.eth: privacy empty. ens.eth: privacy "any".

Primary sources (fetched)

Topic URL
Snapshot Shutter (hide until close, then reveal) https://docs.snapshot.box/user-guides/spaces/settings
Snapshot QV + sybil warning https://docs.snapshot.box/proposals/voting-types
Circle Research: concave wallet rules → linear under Sybil https://arxiv.org/html/2605.18990
Compound Bravo quorumVotes = 400000e18 https://github.com/compound-finance/compound-protocol/blob/master/contracts/Governance/GovernorBravoDelegate.sol
Cosmos tally.go (quorum of bonded; veto of participating; abstain in quorum) https://github.com/cosmos/cosmos-sdk/blob/main/x/gov/keeper/tally.go
Arbitrum DVP quorum (registered/delegated denom) https://forum.arbitrum.foundation/t/constitutional-aip-dvp-quorum/30053
Arbitrum 5%→4.5% constitutional quorum (interim; supply-tied bar still rises) https://forum.arbitrum.foundation/t/constitutional-aip-constitutional-quorum-threshold-reduction/29145
Uniswap turnout decline, 40M on-chain / ~6.7% circulating https://gov.uniswap.org/t/rfc-governance-logistics-improvements/25737
Aave Shutter trial (enabled ~May–5 Jul 2023) https://governance.aave.com/t/arfc-private-voting-for-aave-governance-2-month-trial/12730
Aave trial results: 879.9k→119k votes, 32.6k→14.2k unique same thread, page 2 (fig, 18 Jul 2023)
Yearn Guardian: nullify, cannot propose https://docs.yearn.fi/developers/security/multisig
Yearn YIP-81 Guardian formalization https://docs.yearn.fi/contributing/governance/yips/yip-81
Optimism Foundation cancel/manager role https://gov.optimism.io/t/governor-upgrade-proposal-onchain-controls-mvp/10371
MACI (contracts; coordinator SNARKs; not this repo) https://maci.pse.dev/blog/maci-1-0-technical-introduction
EOS vote decay (re-assert or lose relative weight) github.com/EOSIO/eosio.contracts@52fbd4ac7e/contracts/eosio.system/include/eosio.system/eosio.system.hpp
Shutter “permanent” shielded PoC (not CL8Y) https://blog.shutter.network/permanent-shielded-voting-is-coming-to-snapshot/
Snapshot announcement (shielded = until close) https://paragraph.com/@shot/shielded-voting-is-live

Second-pass deepen

  1. Arbitrum DVP is the closest published analog to “quorum on registrations, not circulating.” Their diagnosis: votable supply has no relationship to tokens registered to vote; constitutional proposals started failing; 0.5% cut is only an interim.
  2. Uniswap Four for V4 is a live number for “unanimous still fails if the denom is wrong / the floor is high.” 10M is ~1% of UNI, still missed.
  3. Aave Shutter trial falsifies “secret ballot will fix turnout.” Unique voters dropped; ACI argued delegates need public votes; Paladin argued last-minute whale swings (the herding you might want to see) go dark.
  4. arXiv:2605.18990 is the theorem behind “curve DAO / uni DAO wallet formulas become theater”: any positive concave wallet rule is asymptotically 1:1 under Sybil. Exemptions reintroduce a role.
  5. Yearn Guardian vs Cosmos veto: role-based nullify does not require the vetoer to vote; token-share veto does. CL8Y advisory polls already have an ops gap (don’t execute). Write the role; don’t encode 50% of CL8Y.
  6. This stack cannot do MACI/Shutter cryptography without new contracts or a third-party keyper set. Honest product is hide-until-close in the UI + delay/authz the per-address GET, with an ops-peek disclosure.

Close #13 when the doc (including §15) is merged. File follow-ups only from §12 with maintainer approval.

Follow-up research (stale weight, turnout, secrecy, curves, veto). Folded into `docs/GOVERNANCE_RESEARCH.md` §15 locally; not merged yet. No schema/API/UI change. Private community chat is not quoted. `gitleaks` clean on that doc. Hybrid recommendation from the first note is **unchanged:** leadership proposes one option; registered Terra and BSC holders ratify; #11 is a feasibility open-gate, not a second electorate; polls stay `advisory: true`. ## Summary Community follow-up asked: what to do when a large registered holder never votes (herding fear or discount-trading bots), whether to count only cast ballots, whether to dampen weight above a cap, whether to hide who voted, what “30% turnout” means if bots hold supply, and whether a veto should be a token share or a role. **There is a third way. Do not pick only-cast *or* a weight curve.** 1. **Keep 1:1 token weight** at freeze. A concave/exponential curve without unique identity is theater (Snapshot QV docs; Circle Research arXiv:2605.18990). Splitting wallets restores linear power. Dual-chain already gives two addresses. Wallet exemptions to preserve a ~50% veto *are* a special role, in the worst form. 2. **If a later issue ever labels a poll “passed,” quorum denominator = frozen registered set**, not circulating supply. LP, bridge, CEX, and fee-tier bots are why registration exists. Arbitrum is moving quorum onto delegated/registered power for the same reason (votable supply grew, participation did not). 3. **Silence is not a vote.** Abstain is explicit and should count toward quorum. Only-cast with no floor is an empty-ballot attack (sim: 5 of 100 “pass” 100% yes). Uniswap temp-check “Four for V4” is the opposite failure: ~unanimous For, **5.35M vs 10M quorum** — did not meet the floor. 4. **Keep the rolls live:** 90-day re-register *or* prune after N missed *open* polls. That is how you avoid “never meet quorum because of lost interest / dormant bots.” Cheap attack: re-sign before freeze. Pair with existing Legal clickwrap and a cooldown after prune. Do **not** auto-count silence as against. 5. **Bots and “30% of circulating”:** assume discount-traders mostly **never register** (Legal + signature). Measure turnout of *rolls*. If they do register and go dormant, TTL/prune. Do not wait for circulating turnout that includes LP. 6. **Herding / intimidation ≠ true secret ballot.** Snapshot/Shutter hides choices **until close, then reveals**. Aave’s 2023 trial: unique voters 32.6k → 14.2k (did **not** raise turnout). MACI / permanent privacy needs contracts — forbidden here. This API stores plaintext `choice`; `GET /v1/proposals/:id/votes/:addr` is unauthenticated. Fit: hide **running tally** until close; keep draft comments and #11 analysis attributed; disclose that ops can read the DB. 7. **Veto is a role, not 50% of supply.** A silent whale cannot token-veto. Cosmos `NoWithVeto` requires showing up (share of *participating* power). Yearn yChad Guardian: nullify, cannot propose. Distinct from #11 committee (open/refuse poll) and blacklist. Because polls are advisory, ops can already refuse to execute; naming the role is honesty and rotation. **Do not implement any of this in #13.** Stage 1 stays dual-chain advisory snapshots. Sketches in the doc §12 items 6–8; not filed. **Tradeoffs:** 1:1 is plutocracy (explicit). Registered quorum is honest but dies if rolls go stale. Only-cast is live but capture-prone. Shielded-until-close reduces herding and last-minute swings you *wanted* to see. Permanent anonymity kills audit. A veto role is key-person (rotate; write the rights). **Further study:** (1) what % of registered freeze-set is a sane quorum floor once real rolls exist; (2) TTL vs missed-vote prune vs both; (3) whether to authz `GET .../votes/:addr`; (4) counsel if a named veto over treasury-adjacent mandates looks like control — flagged only. --- ## Raw research (evidence) ### GitLab / in-tree - Issue: https://gitlab.com/PlasticDigits/voting/-/issues/13 - Doctrine: `docs/GOVERNANCE_RESEARCH.md` §15 (this follow-up) · §9 attack rows 19–26 · §10 non-recommendations · §12 sketches 6–8 - Tally today = sum of **cast** weights, no quorum: `operator-voting/src/db.rs` `tally` - `GET /v1/proposals/:id/votes/:addr` returns `{choice, weight}` with no caller signature: `operator-voting/src/api.rs` `get_vote` - Comments render `wallet_address`: `frontend/src/pages/VoteDetailPage.tsx` - UI does **not** yet render `tally` (API still returns it on list/detail JSON) - Ledger indexes registered wallets only (L2): `docs/LEDGER_INVARIANTS.md` ### Simulations (`/tmp/gov-research-13b/sim_stale_turnout.py`) Electorate 100k circulating = 40k LP/bridge + 20k unregistered bots + 20k active registered + 15k stale whale + 5k dormant registered bots. Cast 12k for / 3k against: - 15% of circulating → 40% circulating quorum **fails** - 37.5% of registered → 40% registered quorum **fails** (stale whale + dormant inflate denom) - 75% of *active* registered → would pass - only-cast majority 80% **passes** (and so would a 5-wallet attack) Curve sketch (1:1 to 5k, then 0.14× extra): 10k in one wallet = 5700; split 2×5k = 10000 (1.75×). sqrt(10k) honest = 100; 10k wallets of 1 = 10000 (100×). Founder 50k vs ten 5k wallets under the piecewise curve → **18%** vote share. Prune missed>3: denom 39k → 19k. Silent whale Cosmos-veto share = 0. ### Live API (2026-08-30) **Terra Classic LCD** `https://terra-classic-lcd.publicnode.com/cosmos/gov/v1/params/tallying` - quorum 0.40, threshold 0.50, `veto_threshold` 0.334 (of **participating**, including abstain in the veto denom per cosmos-sdk `tally.go`) **Proposal 12223** (passed) still: abstain largest bucket; yes/non-abstain ≈ 52.6%. **Snapshot GraphQL** `https://hub.snapshot.org/graphql` space `uniswapgovernance.eth`: - `voting.quorum` 10_000_000, `privacy` `""` (not Shutter), period 432000s - `[Temp Check] - Four for V4` id `0x5ae3426216321df66a67eb677874b725f80e51888ad2da72b382b21669c554ee`: `scores_total` 5_349_527.58, quorum 10_000_000, votes 118, scores `[5347713.99, 0, 1813.59]` — For/Against/Abstain. **Failed quorum while essentially unanimous For.** - Other recent temp checks in the same fetch did clear 10M (e.g. Protocol Fee Expansion: Three More Chains 48.7M / 363 votes). `veyfi.eth` / `curve.eth` / `lido-snapshot.eth`: `privacy` empty. `ens.eth`: `privacy` `"any"`. ### Primary sources (fetched) | Topic | URL | |-------|-----| | Snapshot Shutter (hide until close, then reveal) | https://docs.snapshot.box/user-guides/spaces/settings | | Snapshot QV + sybil warning | https://docs.snapshot.box/proposals/voting-types | | Circle Research: concave wallet rules → linear under Sybil | https://arxiv.org/html/2605.18990 | | Compound Bravo `quorumVotes = 400000e18` | https://github.com/compound-finance/compound-protocol/blob/master/contracts/Governance/GovernorBravoDelegate.sol | | Cosmos tally.go (quorum of bonded; veto of participating; abstain in quorum) | https://github.com/cosmos/cosmos-sdk/blob/main/x/gov/keeper/tally.go | | Arbitrum DVP quorum (registered/delegated denom) | https://forum.arbitrum.foundation/t/constitutional-aip-dvp-quorum/30053 | | Arbitrum 5%→4.5% constitutional quorum (interim; supply-tied bar still rises) | https://forum.arbitrum.foundation/t/constitutional-aip-constitutional-quorum-threshold-reduction/29145 | | Uniswap turnout decline, 40M on-chain / ~6.7% circulating | https://gov.uniswap.org/t/rfc-governance-logistics-improvements/25737 | | Aave Shutter trial (enabled ~May–5 Jul 2023) | https://governance.aave.com/t/arfc-private-voting-for-aave-governance-2-month-trial/12730 | | Aave trial results: 879.9k→119k votes, 32.6k→14.2k unique | same thread, page 2 (fig, 18 Jul 2023) | | Yearn Guardian: nullify, cannot propose | https://docs.yearn.fi/developers/security/multisig | | Yearn YIP-81 Guardian formalization | https://docs.yearn.fi/contributing/governance/yips/yip-81 | | Optimism Foundation cancel/manager role | https://gov.optimism.io/t/governor-upgrade-proposal-onchain-controls-mvp/10371 | | MACI (contracts; coordinator SNARKs; not this repo) | https://maci.pse.dev/blog/maci-1-0-technical-introduction | | EOS vote decay (re-assert or lose relative weight) | https://github.com/EOSIO/eosio.contracts/blob/52fbd4ac7e6c38c558302c48d00469a4bed35f7c/contracts/eosio.system/include/eosio.system/eosio.system.hpp | | Shutter “permanent” shielded PoC (not CL8Y) | https://blog.shutter.network/permanent-shielded-voting-is-coming-to-snapshot/ | | Snapshot announcement (shielded = until close) | https://paragraph.com/@shot/shielded-voting-is-live | ### Second-pass deepen 1. **Arbitrum DVP** is the closest published analog to “quorum on registrations, not circulating.” Their diagnosis: votable supply has no relationship to tokens registered to vote; constitutional proposals started failing; 0.5% cut is only an interim. 2. **Uniswap Four for V4** is a live number for “unanimous still fails if the denom is wrong / the floor is high.” 10M is ~1% of UNI, still missed. 3. **Aave Shutter trial** falsifies “secret ballot will fix turnout.” Unique voters dropped; ACI argued delegates *need* public votes; Paladin argued last-minute whale swings (the herding you might *want* to see) go dark. 4. **arXiv:2605.18990** is the theorem behind “curve DAO / uni DAO wallet formulas become theater”: any positive concave *wallet* rule is asymptotically 1:1 under Sybil. Exemptions reintroduce a role. 5. **Yearn Guardian vs Cosmos veto:** role-based nullify does not require the vetoer to vote; token-share veto does. CL8Y advisory polls already have an ops gap (don’t execute). Write the role; don’t encode 50% of CL8Y. 6. **This stack cannot do MACI/Shutter cryptography** without new contracts or a third-party keyper set. Honest product is hide-until-close in the UI + delay/authz the per-address GET, with an ops-peek disclosure. Close #13 when the doc (including §15) is merged. File follow-ups only from §12 with maintainer approval.
PlasticDigits commented 2026-08-30 10:30:39 +00:00 (Migrated from gitlab.com)

Second-pass fold-in from parallel case reviews. Hybrid recommendation unchanged (1:1 weight, quorum on registered freeze-set, roll hygiene, hide-until-close ≠ secret ballot, veto as a role). New evidence now in docs/GOVERNANCE_RESEARCH.md §15.8 (local tree; not merged yet). No schema/API/UI. Private chat not quoted.

Still not filed: §12 sketches 6–8.

Second-pass fold-in from parallel case reviews. Hybrid recommendation **unchanged** (1:1 weight, quorum on registered freeze-set, roll hygiene, hide-until-close ≠ secret ballot, veto as a role). New evidence now in `docs/GOVERNANCE_RESEARCH.md` §15.8 (local tree; not merged yet). No schema/API/UI. Private chat not quoted. - **BonkDAO 2026-07-06:** 1% of supply (~$4.4M) bought quorum; 7 wallets; ~$20M treasury moved; 0s hold-up. Empty-room + executable = capture. CL8Y has no handler — keep `advisory: true`. https://www.coindesk.com/markets/2026/07/07/bonk-faces-usd20-million-treasury-drain-after-attacker-spends-usd4-million-to-pass-malicious-proposal - **Build Finance 2022-02:** low threshold takeover, mint keys, ~$470k. https://www.theblock.co/post/134180/build-finance-dao-suffers-hostile-governance-takeover-loses-470000 - **Optimism:** quorum = 30% of **active** votable OP (delegated VP used in the last **6 months**). Better TTL analog than EOS weekly recast. Do not copy Cosmos validator inheritance. https://github.com/ethereum-optimism/OPerating-manual/blob/main/manual.md - **Hive HF25:** governance votes expire after 1 year of inactivity (prune the roll). https://hive.blog/hive/@hiveio/hive-hardfork-25-is-on-the-way-hive-to-reach-equilibrium-on-june-30th-2021 - **30% question, with denominators:** Falk et al. ~**5% of total supply** cast (UNI 4.6%, Aave 3.2%). Feichtinger et al. **~20–40% of delegated VP**. 30% of circulating is unattainable; 30% of the freeze-set is ordinary. https://arxiv.org/html/2407.10945 · https://ar5iv.labs.arxiv.org/html/2302.12125 - **Circulating denom failure modes:** Uniswap Franchiser stuffed 12.5M UNI then recalled it; Balancer cut quorum 50% when Aura stopped voting. - **Shutter is not a secret ballot:** who voted stays visible; choice reveals at close. SSRN 4982940: overall turnout falls; top 5% unaffected. B-Privacy (arXiv 2509.17871): voter list + exact totals often reconstruct a whale ballot. - **Compound Bravo For-only quorum** vs OZ For+Abstain — pick explicitly if a floor is added. Snapshot `anti-whale` docs admit wallet-split farming. Golden Boys 2024: linear weight made the capture *visible*. - **Lido Easy Track** remains an *ops* invert-turnout pattern, not a major-ratify rule. Still not filed: §12 sketches 6–8.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
fix/voting-36-43
No results found.
Labels
Clear labels   
architecture
Architecture

  
backend
API and services

  
deploy
Deploy

  
enhancement
Enhancement

  
frontend
Frontend

  
indexer
Indexer / ledger

  
product
Product

  
security
Security

  
UX
UX

No labels
architecture
backend
deploy
enhancement
frontend
indexer
product
security
UX
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
code/voting#13
No description provided.