[Constitutional] AIP: Establish an L1 Voting Recovery System
We support the direction of this proposal. The ordinary DAO governance process depends on the L2 governor, with the Security Council providing an alternative route for repairs. An independent route on L1, with voting power still tied to delegated ARB, gives tokenholders a way to repair governance if neither of those is available, and we think that is worth building.
There are a few things we think are important to address as the proposal moves towards its final form.
The proposal said the affected chains would be confirmed before the temperature check, and the section still reads “to be confirmed”. It would help to know whether Arbitrum One, Nova or both are in scope.
The motivation describes the L1 path as a last resort, while the constitutional text makes it available at any time in addition to the ordinary process. We would like the text to reflect the stated purpose more closely. One option worth discussing is a Security Council cancellation role on the new L1 timelock. On the existing L1 timelock, CANCELLER_ROLE is held by the L1 Upgrade Executor, on which the 9-of-12 Security Council holds EXECUTOR_ROLE, so the Council can already cancel queued operations there. A similar arrangement could prevent misuse of the L1 path while the Council remains functional, but it would also let a compromised Council block recovery.
At the same time, a compromised Council that is still able to act has authority through the L1 Upgrade Executor and, depending on the final ownership configuration, may also be able to affect the new contracts through their proxy admin. The proposal should explain how it balances these failure scenarios and state clearly which of them the L1 path is and is not designed to cover. It could also be worth limiting the L1 path in the Constitution to actions needed to restore ordinary governance, such as repairing governance contracts, Security Council membership and rollup recovery.
The rule against duplicate or conflicting AIPs needs an exception for proposals stalled by the governance failure the L1 path is intended to address. Under the current definition of pending, such an AIP may neither fail to pass nor be implemented, which would make submitting the same recovery action on L1 inconsistent with the constitutional rule indefinitely. We would suggest that an AIP stops counting as pending if it has not been implemented within a set period after its earliest executable time, with a separate rule for AIPs that get stuck before they can be queued. The design should also specify how any queued operations from superseded AIPs would be cancelled or otherwise prevented from executing after recovery.
We also share the point raised by Arb_Junior and TodayInDeFi about stale state. Since there is no maximum assertion age, delegates need clear guidance on how to assess voting power taken from an old confirmed assertion during a long outage.
Finally, we look forward to the specification (l1-voting.md is referenced but not linked), a permissions map showing what the new timelock can reach through both upgrade executors, test results and the audit. It would also help to know who will maintain checkpoint monitoring over time, and whether delegates are expected to cover L1 gas for proofs and voting during an emergency.
Thank you to Offchain Labs for working on a scenario most of us hope never happens.
Vote: FOR
Platform: Snapshot