Arbitrum Audit Program

[pedrob]

gm

Thank you very much for your detailed response. I agree with many of the opinions and learnings you’ve shared.

@Arbitrum

It took around ~10 months to stand up and complete the 8 week program. Unfortunately, this meant there was no security subsidy fund by the ArbitrumDAO for most of 2024.

Since you mention that you’ve been very involved in the execution of the Subsidy Fund, why do you think this took so long? The DAO is usually not this inefficient in the administration and execution of its programs.

@Arbitrum

Technical expertise. One of the anticipated lessons learnt from the security subsidy program run by the ADPC is the need for involvement of technical experts who can evaluate the project that needs an audit and ensure the quote from the auditor is indeed a fair/accurate assessment.

I’m in complete agreement with this. In fact, it was a suggestion I made when the Subsidy Fund was being discussed. However, for some reason, it led to a vote for a new committee rather than incorporating an expert, which was ultimately rejected by the DAO.

@Arbitrum

Our increased involvement was a sign that it may be better for the ADPC to focus on topics that match their core competencies and not necessarily run an audit subsidy program. Additionally, if we are expected to carry on the continuation of a framework and execute it on behalf of others, then we (AF) should just set it up ourselves.

To be clear, I wasn’t suggesting that the ADPC (or at least its current composition) continue managing the Subsidy Fund. In fact, I’ve shared my concerns about its execution and am still waiting for the final report, which I understand will be published this week.

However, I don’t necessarily agree with your last point about taking over a framework developed by others and the idea that just because it was developed by others (others would be the DAO in this case), it should be discarded, and you should start from scratch with your own framework.

I believe the process developed by the ADPC did have value, mainly in the criteria outlined for both auditors and projects selection. Maintaining continuity in the process and criteria provides predictability for auditors and projects looking to apply and how to improve for future applications. It also allows the DAO to replace program managers without friction or negatively impacting the program.

In that sense, building a new program from scratch will cause the very delays you are trying to avoid. And of course, this will happen again in the future.

I’m very happy to see you stepping up and getting more directly involved in the DAO. What concerns me, however, is the possibility of you taking ownership of the initiatives and starting from scratch, which could lead to the loss of sustainable frameworks that don’t rely on a single provider or manager (or at least with the intention of reaching that point.). It’s true that you may be the most suitable to execute this work and lead the committee, but I’d prefer that, as a DAO, we can be a bit more inefficient if it means developing frameworks that are sustainable over time for when you decide to step back again.

That’s why, for instance::

@Arbitrum

Approving Auditors

The Arbitrum Foundation will take on the role of evaluating auditors who want to apply for this program which includes an interview, reference checks, compliance, and agreement to the terms & conditions of this program. It should be noted that we will conduct an individual negotiation with all approved auditors to take into account potential different rates and offerings from the auditors. Additionally, auditors can apply at any time to join the program.

This aspect seems a bit concerning when considering the continuity of the program in the future. We can certainly trust you AF to manage it, and you will likely do it great. But the day you decide to step away, it will become a problem. That’s precisely why the procurement process was created.

In this same regard:

@Arbitrum

On the final point, how to avoid projects getting a grant and then launching on another chain, this is generally the same problem that all grant programs encounter:

• We will prioritise projects who are leveraging Arbitrum’s core technology stack, like a smart contract for stylus or deploying their own chain.

• We may decide to invest in the project over a simple grant as that offers a closer partnership with the project and helps align incentives for all parties involved to remain on Arbitrum.

• Depending on subsidy size, there may be clauses that require projects to launch on Arbitrum before other projects.

This is something you can set up and execute, but since it’s not a standardized process, it could eventually be lost (with the criterias applied and the knowledge obtained).

@Arbitrum

A subsidy will be offered as a grant or an investment in the project depending on size and long-term alignment.

The same goes for the idea of offering investments. It’s very interesting and may be appropriate, but as it’s structured, it’s not creating a framework that can be replicated in the future for other PMs.

@Arbitrum

Arbitrum Audit Committee

We propose a committee with a mixture of technical expertise and DAO representation who will have the necessary skills and time to review proposals on an on-going basis.

1. Chair: Team Member - Arbitrum Foundation (Waiving Payment)

2. Team Member - Offchain Labs (Waiving Payment)

3. Technical Expert - Elected by DAO

4. Team Member - ArbitrumDAO’s OpCo (when operational)

I think this composition of the committee is appropriate. That’s why I believe using the existing framework, with the lessons you’ve pointed out as areas for improvement, can be a great complement to create a kind of v2 program that is sustainable over time, regardless of who makes up the committee.