[Non-constitutional] Subsidy Fund for Security Services

[pedrob]

Hello! Thank you very much for developing this proposal and process. With @SEEDGov we’ve been involved as an Advisor in the LTIPP and I think this process has a very interesting and well-thought-out design. So, congratulations and thank you.

That said, I have some questions and concerns very similar to those expressed by @coinflip, which I support and believe need further discussion.

According to the proposal approved in Tally “The mandate of the ADPC aims to create an optimal organizational framework for service procurement while also creating a marketplace for service providers that would have gone through preemptive quality assurance.”

@Bernard

These subsidies will be exclusive to a pre-approved whitelisted set of security audit service providers, selected by the ADPC, who will publicly display their fees.

It is my understanding that mandate 1/5 was to develop the RFP for the selection of these service providers. How is it that now it depends on a pre-approved white list? Am I wrong?

Also, when listing your mandates, you mention that:

@Immutablelawyer

Steps [2], [3] & [4] of the mandate will necessarily have to be coupled with a 14-day consultation period pre-structuring so that input is solicit from the ArbitrumDAO and other relevant third-parties. The input collated during the public consultation period will necessarily need to be made public.

Where can I find the “input collated” for the evaluation criteria (mandate 2) of small projects that will receive the subsidies? Have you discussed the rubric with the LTIPP Council? There have been very useful learnings from their scoring experience that I think can be helpful.

@Bernard

The administration and selection process of these subsidies will be managed by the ADPC. Even though the ultimate decision will lie with the judgment of the ADPC, their assessment will be strongly guided by a means test that evaluates key metrics to determine deserving projects.

As Conflip mentions, and with whom I agree regarding the question of involving ADPC in the process as program manager, committee, and decision maker, I believe it is better to limit your participation to a sort of program management role (similar to StableLab in the LTIPP where the other decisions are made by Advisors and Council).

@Bernard

Furthermore, the ADPC’s mandate was always to act as the screening committee to decide the vendors to whitelist for the program. As you can see in the Tally vote which established the ADPC, ‘the ADPC bears the responsibility of diligently executing the steps essential to implement the aforementioned procurement framework’.

I don’t believe this response satisfactorily addresses his question. ‘Diligently executing the steps’ means managing or advancing a process, not positioning oneself as the decision maker for everything related to it.

@Bernard

Exactly right, the ADPC is currently in the process of setting up the procurement framework to whitelist security service providers for the DAO. Given the large amount of legal work required to structure an RFP, it is still in the drafting phase and has not yet been published to procure any security service providers.

Why is there a need to rush this snapshot vote before having this defined?

@Bernard

Fully agree here on gap in security experience - as mentioned above, we are in the process of sourcing a neutral security expert as an advisor to aid us in judging both, applications from service providers during the RFP process and applications from projects looking to receive subsidies from the Subsidy Fund.

Assuming it is approved, wouldn’t this incur additional costs? Given that you acknowledge a lack of security experience, the role of the ‘security expert’ would be crucial in assessing the applicants. Why not directly appoint a manager or a committee of security experts and provide them with compensation to carry out the task?

It might be interesting to involve the ARDC in this process, as it includes a DAO advocate, a member qualified for Risk Assessment, and a member qualified for Security Assessment.

@Bernard

and we have received no other indication from the rest of the community that another committee is required to handle fund disbursement.

I sincerely believe that it was not sufficiently discussed. I have requested information about the public notion, the biweekly reports, and the minutes of the meetings, none of which were made available to the DAO.

The only message with information about a call was in the Telegram group regarding the first call, which was announced approximately an hour before it actually took place. If I am mistaken or do not have the correct source of information, I apologize.

@Bernard

In recognition of the additional responsibilities undertaken, each of the five multi-sig wallets is proposed to receive a supplementary compensation ranging from 500 ARB - 1,000 ARB monthly.

What is the need to expand the budget that has already been approved for controlling one (or the same) multisig?

@Bernard

Grant Application Terms and Conditions can be found here .

I believe it would be ideal for this entire document to be presented on the forum rather than in a separate PDF on Drive that could be modified in the future.

@Bernard

• 1 cohort of 8 weeks (2 months) for a total fund size of $2.5 million.

• 2 cohorts of 8 weeks each (4 months) for a total fund size of $5 million.

• 4 cohorts of 8 weeks each (8 months) for a total fund size of $10 million.

Regarding this, I believe it would be better for the funds paid by the DAO to be denominated in ARB

Thanks again, I think overall the proposal is good and well thought out.