Proposal #265
Passed on 01 Jul 2022 with 99.9% of the votes for yes.
Yes
99.9%
100.0% without abstain
Veto
0.0%
of votes cast
Ended
01 Jul 2022
99.85%
of votes cast
0.13%
of votes cast
0.02%
of votes cast
0.00%
of votes cast
On the 8th June 2022 at 02:49:55 UTC a major bug in the osmosis AMM has forced the validators to halt the network at block 4713064. The issue was that withdrawing funds from liquidity pools would result in getting assets worth more than what you had in the pool. This bug could've potentially drained the assets in all liquidity pools accross osmosis by simply adding liquidity and directly removing it again. Fortunately, the damage was limited to only 5 million dollars due to the fast reaction of the validators. However, apart from the financial damage, the 3-day shutdown also cost a lot of trust, which has to be earned again in the long term.
To prevent the malicious exploitation of such bugs I would like to propose two things:
Creation of a Vulnerability Disclosure Policy The goal of a Vulnerability Disclosure Policy is to encourage people to report bugs privately to the osmosis devs before making it public. Such policy would give information about how osmosis has to react to such bug reports and also give the reporting user the security to no being persecuted legally. I'll add some examples for such policy:
[Hidden link] [Hidden link] [Hidden link]
Creation of a according but bounty program Having a Vulnerability Disclosure Policy usually also means having a bug bounty program to incentivise the reporting of such bugs instead of abusing them. The bounty paired with the legal security should then hopefully be enough to ensure critical bugs can be fixed before being disclosed to the public. Immunefi is a platform where many crypto projects are running their bug bounty program (Polygon, MakeDAO, THORChain, PancakeSwap, etc.). Also Sifchain is having a bug bounty program there with rewards up to 2M$. This Bug Bounty should be funded by the strategic Osmo reserve and the community pool. Furthermore, core devs and external and independent actors should be involved in the bug bounty dao/team.
A bug bounty program doesn't mean that reported bugs are swept under the carpet. A vulnerability disclosure policy also includes when and how bugs can/will be disclosed to the public.
YES -> You aggree that a bug bounty and a vulnerability disclosure should be created and carried out. The creation itself with the exact policy will have to pass governance again. NO -> You believe that's not neccessary and don't want a bug bounty and a vulnerability disclosure policy NO WITH VETO -> You believe such policy/bug bounty would harm the network and want to prevent that at all cost