DAOs and BORGs: blending the best trust-minimization techniques of the onchain and offchain worlds

This way you do this, probably like that. Okay, cool. So this is going to be very informationally dense. The talk was labeled as intermediate, but I am going to speed run through the basics, like super speed run through them. So don't get mad that I'm going to kind of like speed run through the basics, like super speed run through them.

So don't get mad that I'm going fast. Basically, yeah, it's to get to the good stuff faster, right? And then I'll slow down and take my time on the detailed interesting stuff. Yeah, as I go through, I will be saying some very opinionated and potentially controversial things as if they are fairly simple, obvious truisms. The reason why I'm doing that is just because it makes for a better talk, not because I'm like a fascist who doesn't understand all the nuances.

So you can always feel free to like challenge me later on these various assertions, but it just kind of simplifies, simplifies the discussion, simplifies the presentation, et cetera. So with all that being said, I'm Gabriel Shapiro. I am what they call a crypto lawyer. I'm also more recently a founder of a company called Metalex that researches and develops certain, what we call cybernetic law solutions that include governance issues for DAOs. Covered that.

So first question is, like, what is a DAO? I'm sure you guys have heard this question ad nauseum today. I will just say that, like, basically no one agrees, so the DAO that can be defined is not the true DAO, thus spake DAOzu. There are kind of like two basic answers you can give to this question, right? Oh, and let me start my timer here so I don't take too long.

One is like basically if you just looked at everything that is called a DAO and tried to honor that nominal essence, so to speak, that everyone gives, it's just way too many things, right? It's like venture capital funds that use smart contracts. It's art collectives. It's protocol DAOs, things that are governing, you know, DeFi protocol parameters. Just like some people even call like Bitcoin itself a DAO as a network.

Just many, many, many things. And about the best you could say is that, like, it's some type of group of people who use blockchain for at least some of their governance or, like, storing their assets or something, right? That's not a very satisfactory or precise thing. Just to give, like, an example there, yeah, like Metacartel VenturesDAO, which I actually helped found and I'll be mentioning throughout. You know, it's really a venture capital fund.

It's an LLC. But it uses, like, tokenized voting, right, and uses smart contracts to hold the assets. But, you know, at the end of the day, it's just a venture capital fund, right? So that's an example of, like, how diverse these things called DAOs can be, right? My answer is, like, I have a much more opinionated answer, which is I go for like a purist definition of DAOs, right?

And I just look at the word, right? The acronym DAO, right? So at a minimum, DAOs must be decentralized and autonomous and some kind of organization, right? What does decentralized mean? It means that whatever like the human discretion is in running this thing, like it's dispersed over a large agile and potentially anonymous group of incentive aligned persons.

And we prefer that it's like a permissionless or relatively lightly permissioned like entry into that group so that it can be very broad and so that there are no like unfair hoardings of power, so to speak. And autonomous to me means that it's self-governing, self-governing, trust-minimized, and resistant to extrinsic exercises of power. So the intrinsic power is decentralized, and the extrinsic power is hopefully close to eliminated. And you can actually go back to the original thing that inspired DAOs, which is an article by Stan Larimer, not Dan Larimer, although I think they might be cousins, arguing that Bitcoin is a decentralized autonomous corporation. And he had three rules for what he called DAX, what we now call DAOs.

They basically have three laws of robotics, or what we call three laws of DAObotics. Law number one is that a DAO must run under the control of an incorruptible set of rules that are implemented as publicly auditable open source software. Law number two, a DAO must not be able to change its rules without the consent of its stakeholders, and such consent must not violate law number one. And law number three, a DAO must seek to protect its own existence as long as that does not violate law number one or law number two. Now what is a Borg?

You may have heard this term, maybe not all of you have heard of it, but it is a cybernetic organization, hence Borg. And what that means is it's some kind of like real legal entity, could be incorporated or unincorporated, could be a partnership, but most likely is going to be incorporated, where the rules of that entity, the legal rules of that entity mandate the use of certain smart contract or blockchain systems, right? So this represents a blend of legal and on-chain technology, right? There are two main varieties. One is DAO adjacent, right?

So if you've ever heard of any type of multi-sig that can freeze a DeFi protocol or some type of grants multisig that is funded by a DAO. That's basically a DAO-adjacent Borg. An example would be like Curves Emergency Multisig. It can freeze pools that are 30 days or younger, and it can stop Curve rewards to a pool, and it can't really do anything else. And the other would be like BizBorg.

So this would be something like Meta Cartel Ventures DAO, which I mentioned earlier, or like a corporation that like tokenizes all of its shares and lets them vote on chain and distributes funds on chain. Why is a Borg not a DAO? Well, it lacks autonomy and it lacks decentralization. Basically, it violates those rules I mentioned earlier, right? I won't dwell on that, but it's there in the slides if you want to see exactly why.

Also, side note, why Borgs and not sub DAOs? You may have heard of the sub DAO model. Well, sub DAOs are usually not DAOs. They are usually small groups of multi-sig holders, again, that for some reason people call sub DAOs. So, again, they violate those rules.

They're not decentralized. They're not autonomous. From a legal perspective, you really don't want, if these things are like some small group of people who may incur liabilities or do bad things, you don't really want them to be sub DAOs because then the DAO may have legal liability for them. You want them to be more separate and autonomous. Securities law is also, you know, if like the DAO token holders are basically like electing, like just fully electing these people and it's more of an agency type relationship, you might be turning your DAO tokens into shares and securities.

So these things, these like, we have various trust problems with DAOs and with multisigs. And the ethos of crypto is verified, don't trust, right? So the point of this talk, the point of this entire track is coordination, right? How to solve these problems. And Borgs are basically a technique for doing this.

The first trust problem that is faced by these like multisigs in relation to DAOs is member management, right? Oftentimes when a multi-sig is, a DAO adjacent multi-sig is proposed, it's with like a very specific membership set. It might be people who are doxed, it might be people who are pseudonyms like the well-known Bantag who's like very high reputation as a NIM, right? But nonetheless it is a specific set. But how do you accommodate over time membership changes?

Who decides that? And the default is that these things are just a standard safe, and therefore those people decide the membership changes. But the DAO seems to care who the members are, yet the people who were appointed, they can change their membership willy-nilly, and they never have to go back to the DAO. That's a problem, right? Particularly a problem if there is no other recourse against these people, as is typically the case, other than, quote-unquote, reputation slashing, right?

If they do something bad, they will lose their reputation, and they will never be appointed to one of these things again. Okay, but that's great for the initial set of potentially high-reputation people who are appointed, but what if it changes over time to like lower reputation people? Or what if the people who like claim to be on it, like immediately actually just like assign the keys to someone else or something and you could never know, right? The other trust problem is asset management, right? Often these things, I mean, I think like Arbitrum recently approved like a hundred, over a hundred million to some like gaming grant support type of thing, right?

And they're putting in place trust mitigation measures, but this thing happens all the time, right? These multi-sigs get, these DAO adjacent entities get large amounts of money from a DAO, right? And this presents various issues. Number one, like transparency of asset management, right? And like one thing to notice is that if you just like, you may think that the fact that these funds initially go to a multi-sig means, oh, it will be transparent.

But actually, in the default case, the multi-sig can just immediately send them to a centralized exchange or to a custodian or sell them for fiat and put it into a bank account and all that transparency would be lost. And there's typically nothing that can be done about that. There's no legal rule against it. There's also no on-chain mechanism that typically prevents it. So the transparency isn't really there, actually.

And asset management accountability, they're supposed to do specific things with these assets, but there's often no way to enforce that either, again, other than this sort of idea of reputation slashing. The other issue is permissions management, right? So I mentioned Curve Emergency DAO, or Curve Emergency Board earlier, that has certain specific permissions over the Curve smart contract system, but it's only supposed to use them for specific reasons, right? Like basically if there's some sort of security emergency. So it would be like very bad if someone is on that multisig and let's just say, well, let's just say it's someone from Curve and let's just say like Uniswap community tried to do like a Uni stablecoin pool on Curve and just because there are competing protocols, the Curve people didn't like it and they shut off Curve rewards to that pool or they killed that pool, right?

That would be bad because it's not for a security reason, right? But actually there's, like, no way to really, like, enforce that or even make clear that that is an actual rule. An example here from real life is that Kujira, basically the devs had a highly levered position themselves in their own borrowing protocol, and they used their multisig authorities to change the parameters in their favor and just kick the can down the road over and over again, and eventually resulted in a protocol insolvency that could have lost people a lot of money if they were not bailed out by 14 people. The other thing is that, like, you can actually have bad mitigations to all the problems I mentioned, right? One is that you, like, basically you just put the DAO in complete control of everything.

And, again, that lapses into the sub-DAO model. And it also may really result in, like, an adverse selection effect in terms of who can contribute to the community so to speak right because if like you can get rugged at any time by a DAO well really valuable serious people are not going to operate under that they want either employment law protections or they want some kind of deal where like if I produce x