Uno sviluppatore indipendente ha pubblicato un post sul blog che illustra in dettaglio come un utente malintenzionato potesse acquistare circa 40.000 token MKR per ottenere il controllo della governance e chiamare una funzione che si autoproclama tutta la garanzia bloccata. Inoltre, potevano stampare infiniti Dai che potevano quindi essere utilizzati su piattaforme come Uniswap e Compound per prendere in prestito in modo permanente attività.Questo problema avrebbe potuto essere mitigato da una funzione di ritardo che avrebbe consentito ad altre parti interessate di innescare un arresto globale contrastando gli aggressori, tuttavia il parametro era impostato su 0 secondi. Da allora il team di Maker ha pubblicando una proposta per aumentare il ritardo del modulo di sicurezza di governance (GSM) a 24 ore.
- Dai e la sua controparte di garanzie singole Sai, rappresentano oltre il 70% dei prestiti in essere. Se un attacco come questo dovesse essere eseguito, sarebbe devastante per il movimento Open Finance, distruggendo oltre $ 300 milioni di valore, distruggendo la fiducia nel sistema.
- Mentre l'esistenza dell'attacco è preoccupante, è promettente che il team di Maker sia stato in grado di reagire e proporre una soluzione affinché la community possa votare lo stesso giorno. Le reti di governance decentralizzate sono ancora agli inizi, ma la discussione sui potenziali vettori di attacco è in grado di rendere più robusti questi sistemi.
- Scritto da Micah Zoltu SU MESSARI.IO NOTE DI MAKERDAO: The Governance Security Module (GSM) "
When Multi-Collateral Dai (MCD) went live on Nov 18, the Maker system passed a critical milestone by activating one of the biggest technology upgrades the protocol has seen to date. And while that’s a momentous occasion, it does not mean that MCD has stopped evolving.
As discussed in Maker Community forums, governance calls and in chat, there will be refinements and updates to the Maker protocol presented to governance for consideration over the coming months. Included in these updates are additional collateral types presented to, and reviewed by, the community, as well as a series of Foundation and community proposals intended to continue improving the governance system.
Next on the list of planned upgrades is the introduction of the Governance Security Module (GSM) into the core protocol. On Monday, December 9th an additional Poll will be added to the governance portal which will allow the community to include the GSM in this week’s Executive vote.
Should the proposal pass, the change will increase the GSM delay from 0 to 24 hours.
Why make this change now?
The GSM is designed to give the MKR token holders a chance to review any changes that will go into the system and act accordingly if those changes are deemed to be malicious. Since the launch of MCD, the delay has been set to 0. This allowed the community to take immediate action to mitigate technical errors, oracle malfunctions, or outlier cases like a market panic or an economic attack.
As the likelihood of these events begin to decrease post-launch, it is nearing time to review the GSM discussion regarding the optimal amount of delay to enact.
This release has now been moved up due to the Foundation being notified of a blog post which details a series of events which could lead to an exploit of the governance system. The community previously considered the possibility of the exploit but it was not an immediate issue. However, the probability of this exploit grew due to potential publicity from the aforementioned blog. For this reason, the community is being presented with a poll to mitigate this hypothetical exploit in advance of our typical debate and consensus-seeking processes.
The community should expect a series of discussions and documents over the coming weeks which will explore the implications of the GSM and options for its best application.
Stronger together
It's thanks to the radical transparency of crypto that we have these critical discussions and advanced incentive analyses in the open all the time. This scrutiny adds to the strength and security of the systems that we all build. It is why open-source software and systems are safer than closed-source equivalents. In the legacy system, these discussions happen behind closed doors; in crypto, there is no place to hide.
Please join the conversation in the MakerDAO community governance forum, and on Rocket.Chat to discuss the latest on everything related to Multi-Collateral Dai.
