Decentralizing Access Control with Michael Lewellen

you very much uh hello everyone we're going to be talking about decentralizing on-chain access controls which is to say how do you have a dow without giving away the powers to everyone or really using it efficiently so some quick details about me uh by the way this is like my third or fourth Eve Denver I'm like losing count now but I started with Bitcoin in 2012 that's how I got into the space started building with ethereum smart contracts in 2017 and then I joined open Zeppelin about two years ago now uh first managing audits on their audit team and now doing a lot of solutions architecture for our biggest clients like ZK seeing compound and several others and I also do some public policy work on the side in Texas uh which is usually around like basically Legacy governance which is always an interesting comparison point to uh what we do in Dallas today uh so open Zeppelin you've probably heard of it but our mission is to protect the open economy we have a leading service for blockchain security audits as well as general advisory and we also have products that help you to automate and uh basically provide security on your systems after deployment uh some of which we'll talk about at the end of this slide deck uh so if anyone's interested in getting more uh General advisory like what you'll see in this talk reach out to us afterwards uh so what we're talking about here is decentralized access control and by that I mean uh allowing us the powers to do things like mint new tokens or upgrade the contract or pause particular functionality during an incident uh these sorts of things that are very common to many uh big Dows today uh need to be managed carefully and usually the path to becoming a Dao involves in decentralizing these uh powers from a small team to a large distributed Community but sometimes it comes with trade-offs the way that you can actually then make decisions as a Dao is sometimes far less efficient and that opens up other ways that your Dao starts to suffer as an organization and as a community so if you can plan ahead and you can think about how you actually go down that path for Progressive decentralization without losing the efficiency that's really where planning ahead with your Access Control pays off so let's talk about some Access Control Primitives that people are using today uh with our contract library at open Zeppelin and then how you can kind of build from there so ownable uh who in here knows what the ownable token standard is okay yeah we got like a third to a half um so this is the basic thing it's got an EIP uh it's well used in our contracts library and all it says is we're going to specify a single account who's the owner of this contract uh and they're going to have special powers that are uh denoted by the only owner modifier so then you can basically add that onto any function that is sensitive and only the owner can call it and if anyone other than the owner calls it it just fails simple so for example I might create a Denver token and I might then make it so that the owner uh is the only person who can mint it so there's a single AOA that now does minting and this might be like set in the Constructor when we first deployed the contract um and so now we have this contract where there's a single eoa that owns it which is basically a single private key stored somewhere uh and uh this is usually the default you just start with an eoa uh but this does come some risks uh you know is if this is like a developer team member maybe they go Rogue maybe they lose the key and someone else gets access to it uh in general it's not a great place to be long term because it's just such a you know massive single point of failure uh so the next thing that many projects will do is they'll create a multi-sig usually using gnosis safe and so they'll say well instead of just one account we'll Define five accounts uh that have uh some signing permission on this power and then we'll say that if three out of five of them agree and sign on to a transaction it will be processed so now we've uh basically you know increased our security threshold for decision uh from one to three so now the only scenario we have to be worried about is if three of those keys goes Rogue or get stolen not just one uh and but that now actually means we have to be careful about what signers were assigning if we wanted to be like somewhat decentralized in the sense of a community could trust it maybe they all don't work for the same protocol team there's other community members that are part of the multi-sig and there's no one entity that can gain a signing threshold um so the next step let's say okay multisig is cool but now we want to go full Dao we want to make sure that when we actually make a decision uh the whole Community is approving of it well usually you'll introduce a governor contract similar to compound Governor Bravo or the system that we built for open Zeppelin was essentially a derivative of that with a lot more like extendable features uh so we use like let's say opens up on governor and we say basically all the token holders are going to have to submit a proposal vote on it and execute it for anything to happen and the vote threshold is let's say you know a majority vote with like a 20 Quorum or something like that um so this is great this is like usually the level of decentralization that a lot of Dow projects uh try to get to or let's say claim that they've gotten to uh with a multi-sig and snapshot but this is like you know what compound did and a lot of other projects have followed suit with however it comes with some downsides that a lot of projects usually really don't experience until they've already done it which is now the fact that all these administrative actions take much longer to perform so yeah maybe you want to vote on an upgrade but maybe voting on like uh you know changing parameters or paying your developers on time is now a lot of work and uh you know for example with a compound proposal we're talking about a seven day process two-day review three days of vote and then another two day in the time lock waiting for it to execute so minimum of seven days to do any administrative action on chain with compound uh with the sole exception of the pause Guardian which we'll talk about in a second um but this means like for example when compound had a an upgrade that went through uh that caused some issues when they wanted to put through another upgrade to change it it took another seven days so they had to wait seven days to fix a bug in production which is never fun so General trade-offs eoa owner it's very efficient it's very fast you can do things quickly um but you have centralized control and that undermines some of the security and digital decentralization uh Dow owner you know high threshold for trying to get anything done which gives you a lot of security and decentralization but it takes a slow time to do things and some things need to be done quickly or just more efficiently so this is where role-based Access Control starts to really break things down and make life easier so uh first let's talk a little bit more about upgrade risks I already mentioned it a couple times but when I'm talking about upgrades uh who here knows what a smart contract upgrade ability is with like a proxy okay yeah we're like doing about half again um so for those of you who don't know it's basically a way to uh circumvent the traditional immutability of a smart contract normally you deploy smart contract on ethereum and it's going to be exactly the way that is the way it was first deployed until the end of time um but if you want to like change it and you want to like upgrade functionality or you want to fix bugs what you need to do is uh create a proxy pattern uh there's other upgrade patterns but the proxy pattern is most common it's what we have some libraries for at open Zeppelin and basically you just put in all your logic into a separate contract and then you can Swatch swap it out at any time so this is great for being able to like basically change your functionality without forcing your users to migrate to a new contract but it does introduce risks now you have to worry about upgrades being safe if you you an even minor upgrade that could cause issues um and uh you can all you also have to worry about like being integrated with other protocols that are upgradable so like I I integrate with another protocol that's upgradable I depend on their functionality be you know a certain set of interfaces and then if they they changed that and I'm not prepared for it well that could break my protocol so this uh so with great power comes great responsibility is essentially what I say about upgradability um so let's define power separately now let's say we want to add in addition to Mint we'll add two new powers to our smart contract we'll say there's an ability to pause and stop all smart contract operations and freeze it and then we'll have upgrade which allows us to of course change the functionality of the smart contract which is very powerful we need to be careful with it so with odable we want to have different decision makers for each of these three powers now and we don't have that flexibility because we just set one Executive Admin and that's it so what we can do is use role-based access control with the opens up in the library to Define separate roles so by default if you use the library through our contract wizard you will typically have a default admin that's able to assign the powers for all the roles and then the specific roles themselves and they'll all have their own modifier where you just say only roll and then you put in whatever the constant is for the role like pause or role upgrader role admin now we can decide what kind of decision maker we want for each role so let's bring back in our Dow and let's say well we want the Dow to have powers to both uh basically set the roles so it's going to be the default admin it will decide what all the powers are and who who gets them and it will also be the sole Authority on upgrades because we do want to have a high threshold for that in this particular case so we have an important check on Powers that can break immutability but pausing well that's important for security scenarios and we would like to have an entity that can move quicker than a dow that might have like a seven day period um so let's choose a multi-sit so a multi-sit can be set up they can pause the contracts um and this is good because we do you know pausing the contracts does have a big impact on a protocol in terms of their availability so we don't want to just give it to anyone we don't want it to be like someone who's trigger happy or maybe you know can still use pausing maliciously to like pause functionality to take advantage of something in the market so you know we this is an important power we have to handle it carefully but if we have to pause something quickly we do have to get three out of five people together to sign a transaction very very rapidly uh and with crypto I mean we could have we could be in different time zones uh some of us might not be like you know beyond speed dial so especially if you have not planned around incident response in your multi-sig this is a a big point of contention because you you really have to be able to move quickly in some scenarios for pausing and a multi-sig might add quite a bit of time on that even though it's much better than a dow so how can we keep the multi-sig in charge of this pause power but move faster this is where delegating eoa pausing Powers becomes really important and this is something that you can do today with gnosis zodiac but there's other tools that people are working on including at open Zeppelin to improve on this but basically what you can do is using doses safe if you've already set that up as your multi-sig you can define a module that delegates the power of the multi-sig to another account and through that you can then say Okay normally we have to go through the multi-sig to call all these functions but we're going to say for this specific function we're going to allow this eoa to do so and that power is controlled by the multi-sig so the multi-sig can set the eoa to be a positive and it can remove the power for it to be a positive so now we have the ability to say okay this eoa is controlled by either whoever the developer is on call or maybe even an automated bot that can rapidly fire a pause in response to seeing something on chain that we know is going to be an issue that we have to stop the protocol for so using those zodiac and using governor and using rpac we can set up a system where now we have the fastest response time possible but we still have a good level of decentralization and how that power is managed so there's a spectrum of Access Control we've built out we have the Dow which is super decentralized awesome uh we've got a big check on power we feel like everyone has a say um upgrades and who gets the roles are the things we want to take our time with and be sure that we do appropriately but when it comes to pausing we want to set up a multi-sig where the people on that multisig know what they're doing they're trained they have an instant response policy in place and ideally uh they're trustworthy members of the community the Security Council is something that a lot of protocols use like CK sync light in order to control upgraded powers and potentially go around time locks and so and then for that multi-sig that multi could Society will either set one of our signers in a separate eoa or some automation that can then do pausing powers and we the multi can revoke that power at any time if we think it's being used inappropriately so the worst that might happen is the e-way go ahead and goes ahead and pauses the protocol and the multi Sega says no you shouldn't have done that we're going to unpause it and we're going to take away your power so uh that has even though there are still obviously some areas where you would want to be careful about how that pauser eoa is used you still didn't obviously do not want to lose it you don't want to have to worry about someone going rogue but the amount of impact the damage that can do up to a protocol is much more minimal um so looking at this broadly like thinking about like how are you layering your on-chain governance the best way to think about it is if you want decentralization that's where you build on a highly decentralized platform like ethereum uh or other networks that have that level of um credibility and uh censorship resistance and on top of that we want to build a set of immutable smart contracts for example maybe our token isn't upgradable uh because that's an important primitive in our ecosystem and other immutable smart contracts like uniswap for example um but we still have some smart contracts that we have to manage through a dow that are upgradable um and then from there there are certain powers of that Dow that we will handle let a multisig council handle full of people who are more prepared to make those decisions they're either more better subject matter experts or they're just able to make more decisions more frequently more efficiently and then from there we can delegate specific powers to certain operational units so as an example the way we work with compound today they're built on ethereum they have an immutable token that can't be upgraded it can't have its token supply chain change which is important because that is the same token used to govern the Dow and then the Dow controls all the markets and it itself has you know like we saw earlier about a seven day period for making decisions but then it designates other entities it has a pause Guardian a multi-sik that can pause the protocol rapidly and a Grant Community which shows some of the treasury functions of funding Community projects so we don't have to have a dow vote just so someone can get like a 20K Grant we can move more efficiently there and then finally we find specific things that we delegate to specific units that either get paid or have a relationship with the Dow so compound Labs still does a lot of protocol development but has no direct on-chain Powers Gauntlet does Financial Risk Management for the protocol and then opens up and does security audits on a lot of the proposals that go through the Dow we get paid through the Dow for that service as well um so with the time we have left I'm going to tell you a little bit more about how you actually practically build this stuff with the opens up until stack um so the first thing is of course opens up in contracts is a big building base for a lot of these projects ens for example users opens up when Governor uh and a lot of our other base uh contracts to build out their ecosystem so ownable and rbac access control that we just saw that's a big part of our contract library and if you use the contract wizard you can actually uh take some of our standard contracts erc20 721 1155 Governor or even just a custom contract as a base and add in your Access Control Powers add-in upgrade ability even create a Dao and so a lot of this gives you a good starting point you can open it in remix deploy it play around with it and then once you're ready to go big you can actually then take it and just extend it for whatever additional functionality you need to add um so on top of this another thing that people actually don't know about is as much is our security platform Defender so Defender is there for your post deployment environment like once you've deployed the contracts how do you manage them effectively um so for example admin is a great way to interface with gnosis safe and other uh approvals of actions on change so for example a developer team that's that is not a signer is able to actually propose something that a multi-ship should sign and then you have an interface through which you can actually approve it and like see all the details of what's going to happen as well as like set access control and other things you have relayer you can do secure hosted key storage and be able to sign transactions rapidly this is actually what a lot of our clients use to be able to have pause Powers already so a relayer eoa would be the perfect thing to delegate powers to it's you know custody in AWS it's perfectly safe but you know worst case if you don't trust AWS you have a multi-sig that that power can be returned to and then Auto tasks which are basically just Automation and JavaScript you can do anything with an auto task including send access the relay error or you can trigger them from Sentinels which shows a lot of on-chain monitoring and then finally we have advisor which is just a collection of security best practices so what we've been actually doing a lot of here at uh if Denver is we have been promoting our serverless templates so serverless for those of you do you want to do like Cloud programming that know about serverless yeah okay a few people here yeah so serverless is something where you can configure your entire stack in yaml for your like Cloud configuration so your typical infrastructure is code approach we've extended that and made it a plug-in for Defender so you can configure your entire Defender stack in yaml um as well as all your auto tasks and other things so you can very quickly either Define your stack and have a good version controlled way of updating it maintaining it or you could take existing templates and pop them into your Defender account and very quickly have a comprehensive multi-sig monitor governance monitor pause Powers setup in your relayer things like that so to get started you can just sign up for a free account on Defender and by the way we have a bounty program we're offering over 10K in prizes so all you have to do is use Defender in your project in some way and tell us how you used it and you're eligible for over 10K in prizes and if you don't know how to get started with Defender we have these pre-built templates using serverless where you can just basically go in the CLI tweak a few parameters like say you know for the multi-sync monitor all you have to do is say what address do you want us to Monitor and what network and then the rest of it's just inputting your API key hitting deploying the CLI and you're good to go and we have more advanced things like being able to migrate tokens in a smart contract quickly to another contract um obviously pausing Powers deploying from the contract wizard is another one um and we have a readme instruction set that also gives you a lot of details on how to get started uh so thank you and happy hacking that's uh 10 seconds so if you have any more questions uh I'll be off to the side for a second but you can also come see us at the booth uh we're way over in the sporkwell lounge uh to talk to others [Music]