Multi-Collateral Dai: 3 Months Later – Mariano Conti

thanks for coming this talk was supposed to be called multilateral died three months later but after what happened this morning and watching Taylor's talk two hours ago I read it most of my slides so I hope you enjoyed this quick intro my name is Mariano Conte I'm head of smart contracts and maker foundation I'm one of the oldest employees at the foundation right now I've been kidding pay him what was Pro decide then cyan died since July 2017 I've been using crypto to escape Argentina's inflation since 2014 and I hope you watched my DEFCON 5 talk about that but when I'm gonna talk today about is die how we have 125 million die and Counting and the responsibilities that come with that and what we can do about it so this is a shot of die stats calm it'll give you a snapshot of what is going on with MCB multi collateral die at any time and I mean this is all just a lot of numbers but some interesting ones 124 million total die which is now 125 plus the old version psy 21 million there's a hundred and forty five million combined die plus I the system holds between the two around 2% of all eath in existence 1.3 percent of all bad we're reaching the debt ceiling so there's gonna be a governance boat soon and I'm gonna be talking more about that one of the cool things that we did is that the ESR which gives you 7.5 APY on any diet that you lock up and that is driving adoption by a huge amount and we've seen projects like chai which right now it's at 3.5 million but used to be five yesterday which are making use of DSR and you know interesting ways but just want to point out a couple of numbers fifty six percent of all diets in DSR and I don't know what's going on okay there we go and another cool thing the maker protocol is burning $10,000 worth of MKR each day via surplus auction this is the system working and working for its NPR holders the initial supply of NPR was 1 million we're down to nine hundred and eighty seven thousand and as long as the protocol is working this is gonna continue and you can look at it in dye actions calm / clap and so basically the system is working and it's working fine dye is the foundation of defy in my opinion it is defies the number one use case for etherium dice a stable medium of exchange it's allowed us to do stuff that just is impossible with a volatile asset like ether it's supported pretty much by every protocol and that many projects this weekend are gonna be old and die and be sr which makes us really proud it is almost a standard stable point on a theorem and like I say the freakin words but after watching today's talk and what happened with fulcrum I'm gonna stand here and tell you all of the risks that the maker protocol has this is non-exhaustive and what we're doing to fix them and what you can do with us to fix them so let's begin with the first one smart contract risk we all know about this it's maybe we forgot something and somebody drains 2% of all ether that's a risk that it's always gonna be there that it's just we can't escape that this is smart contracts it is software software has bugs we can mitigate that and we've done that with formal verification so we're gonna be releasing soon a lot of information about how the core of multi collateral dies formally verified but this brings me to the form of verification fallacy is like if you write your proofs the wrong way then they're gonna pass but you're proving the wrong thing so you need to be extra careful with that and it's not just yet our contracts are formally verified you should trust them it's like it's Turtles all the way down it's good that we have it but it's often not even enough the big one MKR governance attack this is something that is real it is mitigated oh it is something that we have something called the government security module which adds delay which could be 24 hours to every single governance change to the system this is something that the smart contracts team and the whole of maker foundation decided that we wouldn't start with it because we thought the risk of smart contract bug was going to be higher than the risk of a governance attack but as three months have gone by and there are no smart contract bugs we need to revisit this and we're gonna be revisiting very soon especially given what we saw this morning you know whale collision this is a real thing there are at least four known whales that yeah it sometimes even one whale is gonna be enough to vote whatever they want into the system and sometimes it will only take two and as long as there is voter apathy and there's not enough MKR securing the system this is a totally completely real threat but governments of course if those whales get together and they say hey I want to get whatever token into it or I want to change the rest parameters then the whole system can crumble down and if dye crumbles then pretty much most of the if I I'm sad to say will crumble with it of course the black swan we 97% of dies back by ether right so if ether drops 50% today I don't know if the system could really you know survive with it when we launched single collateral die I believe ether was around 800 we had the all-time highs of 1400 and then it went down to 80 but this was a gradual two-year bear market right we can we can handle that I don't know if we could handle a Black Swan event that's why the multi in multi collateral is gonna play a big part later on Oracle attack of course it's that's one of the big things it you know if somebody pushes the wrong price yeah then you can borrow infinite diegans ether against fat we mitigate this with the Oracle security module which is something that prices are delayed by one hour and we have 59 minutes to react and do something about it and we talked about this but we don't talk about it enough or people say you don't talk about risks enough so that's why I'm here today talking about all this this morning like flash freaking the hones that's probably gonna be what my team is gonna be working on the next month mitigating all of this so thank you dy DX have a Stanny wherever you are you've given us a lot of work but this is work that we do gladly because if it can be done it will be done and and we need to prepare for it right so that's what we're gonna do pour liquidity and bad actions you know if your vault gets liquidated and there's not enough keepers there to buy your collateral or the price is dropping then you may end up losing more than just a 13 percent penalty that is something we should discuss more so why am I telling you all of this it's because defy is still in its infancy and we are all its moms and dads it's we are the ones building the protocols and making them better and we should be aware of this we should tell people the risks I'm not saying we should tell them there are some maximalist yeah I'm not gonna say the word but they come to us and every time I mentioned something that yeah but what about the risks and okay I'm telling the risks each time somebody asked me I'm gonna point to this presentation because I want to help build without having to mention them all the time they're always in my mind but we need to acknowledge them and fix them that's that's it that's how we're gonna grow the physical system and by the way I'm all in dye and ether of course because of this because I'm working on making it better every day so how can you help all of this and by the way that was non exhaustive there's I can think of five more that just came into my head right now the big one is participating governance help us we have chats forums on chain we're on Twitter we're on reddit we're here help us make good decisions and something I've been sense is 20:18 pulled your MKR I don't know how why there's no vote delegation yet somebody has to build this we're giving 2,000 died at this hackathon if somebody builds a proof-of-concept you know threaten the whales tell them it's like if we pull enough we got protocol politicians that can you know appease some of this concerns we have a great collateral and boarding guide for the next tokens that are gonna be in MCD and that is being driven all by the community I joined the chat the other day and they almost kicked me out there it's like no no you're not part of the process like when we have something we'll let you know I said okay you know this is working point out the flaws like like I'm doing and help us eradicate them and I mean help us fix and not for it I'm not your boss I'm not your dad if you want a fork do it but there's so few projects in defy right now or any theorem in general that are working that I urge everybody to take the one that is mostly working that it has a few kinks and the we can fix and help us fix it you'll make me sad if you for it but I will try to learn from what you do and I'll we will try to incorporate it into the make your protocol so yeah I think I have like ten minutes for question I wanted to make this quick so thank you very much and please ask anything you want about this thank you so those are some links you know the forum that's where governance happens the chat voting just I encourage you all to participate so while sleep sermons are meant for joins a vet allows any war to live the Duke of any user and take the gem from their from their job so my question is like why why why our lives only only for a for our own Wireless lives only for joins and should you be able to frog the cat's yeah that's a good question I know that that one is not the easiest thing I love your much clearer I by the way and I think you've mostly said something correct so one of the things we're going to do and we had this in single collateral die is we had something called the die mom which sat in between the system and governance so right now governance controls the system directly our plan is to put in a stop gap in the middle so this of course has to be voted in but the idea would be that governors would not have access to people's earns directly but they would only be able to prop them with correct parameters via what we would call the die mom but I applaud your effort and I love that you're learning the language so going back to the mica blog post yeah I saw a tweet linking to an article that I can no longer find that argued the underlying voting protocol works slightly differently in such a way that it also prevents this type of attack are you familiar with that block poster can you comment on that technique I think was probably Nikolas right the co-founder of maker yeah so what it says is that in continuous voting the way NPR governance works right now is you put in a large amount of mkr on what we call a spell which is really just a an address and that address controls the system so usually that address is a smart contract that is meant to be run once and never again which we call spells which change some parameter but it could be an externally on the count it could be something else and the point of Micah's blog post was that when you're voting for something else you're removing in MKR for one spell and putting in another and there could be a time of imbalance when you lower the current governance the current voting spells so much that somebody could come in at that point and put something else what Nicole I argue is correctly is that the system is prepared to handle this because you can vote on two or more things at once so you can vote on the current one and the new one and you can protect the system the only problem is that our UI does not support that we have a very complex UI and people just didn't use it we created a more simple UI and people used it a little bit more but there's still voter apathy there's not a lot of people using it and the UI does not account for this so yes this is something that that we're aware of and it could be fixed just by a UI or via using the more complicated one that we had but I mean we're gonna do something about it thank you I was hoping you could go a little bit more into boat delegation so there's a number of different ways to create both delegation as wondering maybe you could talk about some of the parameters that might be useful for somebody hacking at this event to maybe build into their system I think being able to delegate your vote from cold storage is something that we all want to have is there anything that needs to change in the maker dhow protocol for this to work and just maybe you just elaborate on on why that is important as well yeah right now vote delegation can be done without changing anything about the maker protocol you can do it as simple as you want I know Mooney somewhere around here who works on the smart contracting has a proof of concept it's just missing you know like everything a great UI you can just have somebody put mkr in a smart contract that somebody else controls but they only control it for voting they cannot move it around they cannot do anything else other than vote are in governance and then you can get more complex and say okay you can verify this is slightly more complicated but you can verify that what your politician is going to be voting on won't do more than what you're expected to do so you can say you can start simple I'm gonna delegate my votes for somebody who increases dye adoption but no more than I don't know that they don't vote for a spreading DSR of more than 1% and if they do then the transaction fails that is slightly more complicated but if somebody's hacking on this right now I would say work on the the spells that are used every week it's like changing the DSR and changing the stability fee and if you start with that you have 90% of what governance is about these days and I don't know whether yeah thank you so with them respect to Micah's governance attack I think it's I think it's great that you can prevented a delay that's awesome right so I'm like but it's not Activia okay but the approach is great it's going from force upgrades to opt-out upgrades which is strictly better but I worry if 24 hours is it's too little time in particular I wonder if like for example if the entire maker foundation is at DEFCON in some foreign country is in a malicious proposal is created will you guys be able to get access to your keys to will Wales in general be able to get access to their keys within 24 hours I wonder if I love the approach I just wonder if the delay is too small well the maker foundation even with its dev fun of a hundred and something thousand mkr the foundation doesn't vote with that so of course there's nothing in a smart contract saying that it can't vote with that it's just like social like but even so yeah 24 hours is gonna be the started the idea later on is that they're gonna be different delays for different things so say something is destructive and I use the word loosely as adding new collateral which can potentially be that would maybe be under a one month delay right something that changes a parameter no more than X percent could be under 24 hours something else could be under two weeks I mean I don't know if any project doing what we're doing like in the open as we are so we're open for you know and and this happens in the forums as well like the community says hey is 24 hours enough and they create polls and they tell us and I mean I think yeah 24 hours is gonna be good for certain things but not for everything and the protocol supports multiple the Dilys yeah and if there are no other questions I think we're done great thank you very much [Music] you