A mistake happened on our side. After discussing during an internal all-hands with the whole team, here is what happened and what we’ll improve:
What happened?
There was an internal misunderstanding of the process - specifically, what should be reviewed and how should it be communicated. The smart contract developer who performed the review read the proposal, created the calldata, and tested it. The problem is, this wasn’t the calldata that Spence had posted in the forum. We should have reviewed and validated the calldata that was posted, not generating our own.
To be clear: there are two validation points
- the forum validation (where we made the mistake)
- The on-chain validation when the proposal is submitted (which was done correctly).
The actual on-chain submission was right and correctly verified, but our forum validation process missed its intended purpose and could have led to an error. In this case, it would have asked for less capital than needed, and Spence would have needed to submit one more proposal.
Our next steps
We’re implementing immediate improvements to our internal process:
- Improve our internal review process by ensuring detailed pair reviews and documenting the process to ensure consistency
- Improve our documentation about the proposal and verification executed
Here is our SLA for SPP2 as well. This process will constantly be updated and made more automated. We’ll keep the DAO updated on these improvements in our quarterly reports.
We appreciate the feedback and the opportunity to strengthen our contribution to ENS governance security.
Transparency is one of our core values - we will always make ourselves accountable and clearly communicate mistakes. Security is crucial, should be treated seriously, and in the open.