Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Meta SNIP for security council actions (part of the meta snip on security) #94

Closed
wants to merge 6 commits into from
Closed
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 49 additions & 0 deletions SNIPS/snip-template copy.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,49 @@
---
snip: $SNIP_ID
title: SNIP Purpose and Guidelines
author: $SNIP_AUTHOR <$SNIP_AUTHOR_EMAIL>
status: Living
type: Meta
created: $SNIP_DATE
---

## Simple Summary

This snip will deal with the emergency powers the security council will have and how they need to communicate these emergency actions to the broader community.
Eikix marked this conversation as resolved.
Show resolved Hide resolved

## Abstract

The snip answers the following questions:
Eikix marked this conversation as resolved.
Show resolved Hide resolved

- What type of actions fall under “emergency action”?
- When should such actions be used?
- What is the legal quorum to make such a decision?
- Is there any mandatory delay in the action?
- How and when (before action ? after action?) to communicate this to the network?
Eikix marked this conversation as resolved.
Show resolved Hide resolved
- Does anyone have veto powers over their decision ?

## Motivation

We want to not lose user funds.
Eikix marked this conversation as resolved.
Show resolved Hide resolved

## Specification

Let's first define what type of actions fall under emergency action: a critical vulnerability that could significantly compromise the integrity, confidentiality, or availability of a chain governed by the Starknet DAO.
After performing any Emergency Action, the Security Council must issue a full transparency report (at an appropriate time after the security emergency has passed) to explain what was done and why such Emergency Action was justified.
The security council holds a huge responsibility, and should take emergency actions in a timely manner, after an incident, such as described previously.
We propose to have two major milestones for the council in order to ensure the stability of the transition from Starkware to the Starknet community.
The first step is to add a timelock to smart-contract upgrades of the Starknet core contracts on L1, for Starkware to propose upgrades. This timelock will be skippable by the security council in case of emergency, with a super majority (75% for) to push the update immediately.
The second step, when Starkware won't be the only one able to propose upgrades to the L1 smart-contracts, is to add a pausable function on the Starknet core smart-contracts on L1, to enable the security council to stop the bridge and state upgrade contracts. This will enable to stop any potential loss of funds, and enable the L2 consensus to decide on the best path forward for the community.
The security council has the obligation to communicate, provide a post-mortem and be transparent about the reason of potential actions taken.

## Implementation

For this SNIP we need:

- an L1 multisig
- Add a timelock to Starknet core contracts on L1 + the ability for the security council's multisig to bypass it (for phase 1)
- Add a pausable function only callable by the security council's multisig (for phase 2)

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this approach doesn't fully make sense. Pausing should be an immediate action and going through a SC takes too long. A better approach is: give the pause button to a centralized entity, i.e. starkware foundation, and have the SC have the ability to unpause and revoke such permission if the foundation misbehaves. This is how it is implemented in OP Mainnet. It makes sense to do so since pausing is a reversible action

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree


## Copyright

Copyright and related rights waived via [MIT](../LICENSE).