Skip to content

Latest commit

 

History

History
198 lines (153 loc) · 8.82 KB

MULTICHAINGOVERNOR.md

File metadata and controls

198 lines (153 loc) · 8.82 KB
Raw

Multichain Governor

The Multichain Governor contract is live on Moonbeam. This contract is responsible for creating and executing proposals.

Overview

The Moonbeam governor contract serves as the source of truth for all governance actions in Moonwell. Whenever a new proposal is created, it will send out a message that will be transmitted to the voting contracts of destination chains. This will empower WELL and stkWELL holders to participate in the voting process on proposals that are going to go live on Moonbeam. The proposals framework used for Moonwell governance is designed to work cross-chain, which implies that proposals that are active on Moonbeam can have an impact on the system's state on other chains.

Governance Parameters Configuration

  • votingPeriod: The time period in seconds that the governor will collect votes for a proposal.
  • crossChainVoteCollectionPeriod: The time period in seconds that the governor will collect votes for a proposal before it is executed and after the voting period has ended.
  • quorum: The minimum percentage of votes required for a proposal to pass.
  • proposalThreshold: The minimum number of votes required for a proposal to be created.

Only the Governance contract can change these parameters. This implies that a proposal must be created and passed to update these parameters.

Permissionless Actions

Create Proposal

Any address can create a proposal by calling the createProposal function if they have at least the voting power threshold required to create a proposal. The proposer must provide the following parameters:

  • targets: An array of addresses to call
  • values: An array of values to pass to each of the calls
  • calldatas: An array of ABI-encoded calldatas with function signatures to pass to the targets
  • description: A string describing the proposal

Vote

Any address can vote on a proposal by calling the castVote function. Users can vote for, against, or abstain on a proposal.

The following tokens are used as sources of voting power:

  • WELL: The native WELL token on Moonbeam
  • Staked WELL: WELL Staked in the safety module
  • xWELL: The native multi-chain token for Moonwell
  • Vesting WELL: Vesting WELL locked in the claims contract

The caller must provide the following parameters when casting their votes:

  • proposalId: The id of the proposal to vote on
  • voteValue: The vote value to cast. 0 for yes, 1 for no, 2 for abstain.

Votes can only be placed one time per proposal, and once a vote is cast, it cannot be changed.

Execute Proposal

Any address can execute a proposal by calling the execute function. The proposal must have passed the cross chain voting collection period and have enough for votes to be executed. The caller must provide the following parameter:

  • proposalId: The id of the proposal to execute

If the proposal is cross-chain, a VAA will be generated by Wormhole which can be queued and executed on the Temporal Governor of the target chain.

Rebroadcast Proposal

Any address can rebroadcast a proposal by calling the rebroadcastProposal. This function is useful in case the wormhole relayer or wormhole core contract is paused. Can only be called if the proposal is in the active state.

Cancel

Any caller can cancel a proposal by calling the cancel function if the proposer voting power has drops below threshold. Otherwise, only the proposer can cancel the propsal.

Guardian Actions

There are only two roles with permissions on the Governor contract. The Pause Guardian and the Break Glass Guardian. Anytime a role is used, they can only be used once, and then their roles are revoked once the action is completed.

Pause Guardian

The Pause Guardian can pause the Governor contract, which will prevent any new proposals from being created, any votes from being cast and any proposals from being executed. Pause also cancel any active proposals. After the pause duration, the governor will automatically unpause, thus not allowing the pause guardian to brick the governor. The pause guardian will only be able to pause once, and then the governor will need to grant the pausing ability again.

Break Glass Guardian

The break glass guardian is able to propose and execute a governance proposal that calls any address with the following set of whitelisted calldatas:

  • transferOwnership to Artemis Timelock
  • setPendingAdmin to Artemis Timelock
  • setEmissionManager to Artemis Timelock (Used for stake token emission)
  • changeAdmin to Artemis Timelock
  • wormholeCore publish message to Temporal Governor that grants Artemis Timelock governor ability

No checks will be performed as to which contracts are being called, and addresses are the only parameter the break glass guardian can specify without sanitization. The calldata they pass must be an exact match of one of the calldatas specified above, otherwise the entire transaction will revert.

View Only Functions

  • getReceipt: Returns the vote receipt of a voter for a proposal
  • proposalInformation: Returns the proposal information for a given proposal id. Includes the proposer, vote snapshot timestmap, vote start timestamp, vote end timestamp, corss chain vote collection end timestamp, for votes, against votes and abstain votes.
  • proposalVotes: Returns the vote count for a proposal
  • getProposalData: Returns the targets, values and calldatas for a proposal.
  • liveProposals: Returns the list of live proposals ids.
  • getNumLiveProposals: Returns the number of live proposals.
  • currentUserLiveProposals: Returns the number of live proposals for a user.
  • getUserLiveProposals: Returns the list of live proposals for a user.
  • getVotes: Returns the total voting power for an address at a given block number and timestamp.
  • getCurrentVotes: Returns the current voting power for an address across well, xWell, stkWell and distributor
  • proposalActive: Returns true if a proposal is active, false otherwise.
  • chainAddressVotes: Return the votes for a particular chain and proposal that have been cast.
  • state: Returns the status of a proposal. The status can be one of the following:
    1. Active: This means that the proposal is currently in the voting period.
    2. CrossChainVoteCollection: The voting period has ended, and the proposal is now waiting for cross-chain votes.
    3. Cancelled: The proposer has canceled or anyone can cancel if the proposer voting power has become lower than the minimum proposal threshold.
    4. Defeated: The proposal has been defeated, the amount of against votes plus the amount of abstain votes is higher or equal than governance quorum.
    5. Succeeded: The proposal has passed, the amount of for votes plus the amount of abstain votes is higher than governance quorum.
    6. Executed: The proposal has been executed. If the proposal is cross-chain, the payload will be relayed to the Temporal Governor for execution on the target chain.

Security Considerations

This contract makes multiple assumptions about its own state and external system states to ensure proper functioning. Any one of these items being compromised could lead to unexpected behavior.

  1. Approved calldata is correctly set for the Break Glass Guardian. Incorrect calldata could allow the Break Glass Guardian to call any function on any contract. Side affects of incorrect configuration include but are not limited to:

    • complete loss of governance abilities on both Base and or Moonbeam deployments
    • setting of incorrect oracle data
    • arbitrary changes to governance parameters

  2. The Pause Guardian is not malicious.

    • if the Pause Guardian is malicious, they could pause the contract for the current pause duration of 30 days before the contract pauses again.
    • if the Pause Guardian is malicious, they could wait for a governance proposal to grant another guardian the ability to pause the contract, then pause the contract, clearing this proposal from the active set of proposals. Then the community would need to wait 30 days before they could create, vote on and pass another proposal again.

  3. The vote collection contracts on other chains are not malicious and working properly.

    • if the vote collection contracts on other chains are malicious, they could prevent the Multichain Governor from executing proposals, or pass proposals that are failing by registering incorrect vote counts.

  4. Wormhole is live and working properly, this ensures that voters on other chains can participate in governance.

    • if Wormhole is paused or offline, the Multichain Governor will still be able to execute and pass proposals, however, users on other chains will not be able to submit or have their votes collected.
    • if Wormhole becomes malicious, it could register incorrect vote counts or prevent the Multichain Governor from executing proposals.