Summary
- Today, the Treasury Multisig structure is successful in terms of safety/security/execution.
- However, it does not reflect the Index Coop community we are today.
- Vision - A secure and trusted multisig that represents the broader Index Coop community. Signers are stewards that safeguard the Index Coop Treasury for all Index Coop stakeholders.
- Proposed structure - A 4-of-7 multistakeholder wallet (IC x 3, Set x 2, Non Set/IC x 2)
Introduction
The need to evolve the Index Coop Treasury Multisig structure has existed in the Coop community for some time.
The purpose of this post is to share a vision for how we can evolve the Treasury Multisig (TMG) structure to represent the Index Coop community writ-large, maintain safety and security before/during/after, and do so with reasonable speed.
This post will be successful if:
- It provides a clear, principled, thoughtful vision for how we can transform the TMG to an Index Coop community stakeholder controlled wallet.
- The Index Coop TMG is set up to be a resilient and trustworthy custodian of the Index Coop Treasury today and for years to come.
What is the status today?
Today, the Index Coop Treasury contains ~$10MM and is one of three major Index Coop wallets. Two other major wallets include:
- Operations Account (~$800K, 3-of-11)
- Investment Account (~$2.4MM, 4-of-7)
Today, the TMG is structured as a nested 3-of-4 gnosis multisig staffed by Set Protocol/IC founders and Set employees:
The TMG executes the will of the Index Coop for
- Using & moving Treasury resources
- Vesting contract clawback [if necessary]
- Revenue accrual for some IC products
What Works?
This structure has been successful in what matters most: safely and securely safeguarding the Coop’s resources.
Structure
- High skin-in-the game - known individuals with significant reputation & financial skin-in-the-game.
- High-defection % - 60% of signers (3 of 5) would have to defect to enact malicious behavior
- Safe / Secure
- All signers use Ledgers
Process
- Executes the will of the Index Coop
- Clear Process (1 DRI guiding execution, well-known ritual, many eyes on points where mistakes could happen); IC <> Set coordinating.
- Execution docs used for transparency, coordination, and safety.
How can the TMG improve?
We are aiming to improve the TMG in terms of community representation (reflecting the Index Coop community we are today) and decentralization.
Structure
- Set employees are the only signers.
- Nested MultiSig structure adds unnecessary operational complexity.
Process
- Requests are ad-hoc and can require reactivity in order to execute.
- Set bears the burden of execution (sole point of failure & in a “blocker” position).
Vision
A secure and trusted multisig that represents the broader Index Coop community. Signers are stewards that safeguard the Index Coop Treasury for all Index Coop stakeholders.
Based on research, conversation, and the principles outlined below, this vision is best met by a 4-of-7 simple multisig with 3 stakeholder groups represented:
- IC Core Contributor x 3
- Set x 2
- Non-IC or Set
- IC Investor x 1
- Methodologist x 1
Core Principles
How we update the Treasury Multisig today will set an important precedent for the future. Today, tens of millions of dollars are at stake. In the future, we expect the Coop’s resources to be far greater. The Community expresses deep trust when adding a signer.
As we consider the evolution of the Index Coop Treasury Multi-Sig, here are important principles to bear in mind:
- Expect the best, plan for the worst: We expect TMG signers to act in the best interests of the Coop and behave accordingly. Still, when it comes to the critical function of the Treasury Multi-Sig, it is wise to plan for the worst and set up the institution in a resilient manner.
- Groups > Individuals: A group of people is easier to trust than a single person.
- 3 stakeholders > 2 stakeholders > 1 stakeholder: Signers sourced from 3 different stakeholders is the ideal state. A multi-stakeholder structure increases decentralization, resilience, and skin-in-the-game, and can maintain “fast-enough execution.”
- Skin-in-the-game: Signers should have sufficient reputational and financial skin in the game to incentivize long-term alignment with the Index Coop and dissuade malicious behavior. $[Treasury Balance]/[M signers] provides non-trivial financial incentive to rug.
- Long-term thinking: We do things for the long-term benefit of the Coop, our users, and the community. We strive not to make decisions for short-term benefits.
- Fast-enough execution: The multisig is able to execute actions prescribed by IIPs quickly enough. The signing process is not overly burdensome. This requires excellent coordination and reasonably active signers. [Note: Transactions should nearly-never be urgent. Proper planning and coordination removes urgency in most cases.]
- Long-term alignment: Signers have long-term incentives guiding them to proper behavior.
- Dynamic: The multisig is dynamic. Signers will be added/removed, and the multisig structure can change as the treasury grows & contracts. For example: It doesn’t make sense to have a 8-of-11 for a $500,000 treasury. It doesn’t make sense to have a 2-of-3 for a $100,000,000 treasury.
- Incremental change: We make changes in steps. We layer in changes (risk) incrementally, knowing that safety/security are paramount.
Best Practices
Best practices that TMG signers should follow include but are not limited to:
Tools
- Gnosis [multisig]
- Ledger wallets [signers]
Processes
- Signers - Publicly announced via Twitter; Names/Handles/Address publicly documented
- Signers added via IIP
- Signers removed via IIP
Key Characteristics of Signers
- Skin-in-the game (reputation, financial)
- Publicly known
- Trustworthy
- Honest
- Methodical / Detail Oriented
- Transparent
- High-engagement
- Great coordination / communication
- Proficient with Ledger
- Comfortable using Gnosis UI
How we can reach the vision quickly
There are 4 steps that would need to occur to reach this vision. Assuming optimism, these steps could go quickly.
That said, “incremental change” is top-of-mind given the importance of the TMG’s safety & security.
The dates below are intended to reflect an optimistic approach to execution if this vision were to be pursued.
Step 1: Set updates TMG to 3-of-5 simple multisig by Friday 3-18-22
TMG State
- 3-of-5 Set
- Dylan - DRI
- Nic [replaces Punia]
- Greg
- Felix
- Alex
Step 2: IC Signers Sourced / Added by Friday 3-18-22
IC sources and IIPs two Index Coop Core Contributor as signers
- Set builds process to onboard IC signers & install proper communication/coordination APIs
- Operational responsibilities moved from Set to Index Coop (IC now is DRI for queuing, coordinating, execution docs, final execution)
TMG State
- 3-of-5 IC <> Set
- Nic - DRI [Dylan replaced]
- Felix
- Alex
- IC # 1
- IC # 2
Step 3: IC prepares for final 4-of-7 state by Friday 3-25-22
IC sources and IIPs additional signers
- 1 more IC Core Contrib.
- 1 Methodologist signer
- 1 VC signer
IIP passed to add the 3-above and remove 1 Set signer.
TMG State [no from previous state yet]
- 3-of-5
- Nic - DRI
- Felix
- Alex
- IC #1
- IC #2
Step 4: Execute to reach final state by Friday 4-1-22
Execute transactions to update multisig to 4-of-7
- Remove 1 Set signer
- Add 3 additional signers (IC, Methodologist, VC)
TMG State
- IC Core Contributor x 3
- Set x 2
- Non-Set / IC Core Contributor
- IC Investor x 1
- Methodologist x 1
Alternative(s) Considered
Other end-state structures were considered throughout the drafting of this post.
Specifically, for example, a 4-of-N that could be staffed only by Index Coop & Set contributors (4-of-5 or 4-of-7). There are are two primary reasons why such a set-up would be suboptimal compared to 4-of-7 multi-stakeholder structure:
- “3 stakeholders > 2 stakeholders > 1 stakeholder” [see above] - decentralization and resilience benefits are lost.
- Liveliness does not improve - 4 signatures still required in 4-of-N single stakeholder; in multi-stakeholder, that threshold can still be met by Set & IC signers being well coordinated.
One could also consider going for fewer signers (i.e. 3 or 5) or more signers (i.e. 9 or 11).
- Lowering the number of signers violates many of the principles above.
- Increasing the number of signers will make sense in the future as the treasury grows in size [see “Dynamic” above]. However, given the size of the TMG today, doing so would add complexity and coordination costs with no clear benefits in return.
Next Steps
I am excited to see what thoughtful questions and comments come up that help us work towards shared goals. The door is wide open to principled ideas for how to improve upon this vision.
Assuming the vision as it stands, an optimistic approach to next steps would include:
- [assuming optimism] Set executes step #1
- [assuming optimism] IC IIP’s two IC core contributor signers
- [assuming optimism] IC begins sourcing final 3 signers
Research
General
- DAO Rugability and Architecture
- Multi-signature wallet resources
- How to Securely Manage Company Crypto Funds with Gnosis Safe Multisig
Mulitsig Structure Review
Index Coop Forums Review