[Draft] [Executable] Next Era of ENS DAO: Empowering the ENS Foundation

DAO-Wide Archived Proposals
15

Live calldata security review

The executable proposal is now live. The manually derived calldata matches the on-chain bytes, and the full governance lifecycle (vote → queue → execute) simulates successfully with the expected effects.

What the two transactions do:

  1. Transfer 1M ENS from the DAO treasury to the Foundation Safe
    (0x9C7dB6B1085ec4D07f75c0BD91AD3FcD368fA19E, 3-of-5: nick.eth, alexurbelis.eth,
    kartik.eth and two addresses without ENS records).
  2. Replace the DAO timelock as owner of the Endowment Safe (endowment.ensdao.eth)
    with a new EndowmentTimelock (0x0bcC3dA6aD796F59288C0961602675E88A2B406C).

What we verified on-chain:

  • The EndowmentTimelock is identical to OpenZeppelin TimelockController v4.3.2,
    with a 9-day minimum delay. Its deployer renounced admin.
  • Only the Foundation Safe can schedule transactions. Execution is permissionless
    after the delay. The DAO holds no role on the new timelock.
  • The Security Council can cancel queued transactions through a veto-only wrapper
    (0x0A9387643ce6291f8C545286675D76bCd0Ba3EdD, bytecode identical to the audited
    security-council contract). The test exercises this: the SC cancels a queued
    transaction, and a non-cancelled one executes only after the delay.
  • The veto cannot be removed and the delay cannot be shortened, since role changes
    pass through the same delayed, vetoable path.
  • The Endowment’s existing modules are untouched. The treasury manager continues
    operating as is.

Notes for voters:

  • The three new addresses above are not in the proposal text. They can only be
    verified from the calldata or this review.
  • “All Endowment transactions pass through a 9-day timelock” applies to the owner
    path. Two pre-existing module paths bypass it and survive the swap: karpatkey’s
    Roles v2 module and a Safe Allowance Module granting the MetaGov WG multisig
    30 ETH per 25 days for treasury management fees.
  • The Foundation Safe becomes the only key able to initiate Endowment transactions.
    Its signers should use dedicated hardware wallets, keep signer addresses isolated
    from other applications, and set an ENS name or subdomain on each wallet, publicly
    confirmed by the board member behind it.

If the Foundation multisig is compromised:
The 1M ENS can be moved immediately, since it sits in the Safe and not behind the
timelock. The Endowment cannot be drained while the Security Council cancels what
the attacker schedules. The risks are the Council missing a 9-day window, or its
veto expiring in August 2028 without renewal. KPK’s only transfer permission is USDC pinned to
the DAO timelock, so managed funds can still be returned to the DAO.

All simulations and assertions are available here.

To verify locally:

  1. Clone: git clone https://github.com/blockful/dao-proposals.git
  2. Checkout: git checkout 6ab60a3
  3. Run: forge test --match-path "src/ens/proposals/ep-empowering-ens-foundation/*" -vv