RARI Multichain Governance Proposal Security Review

Arbitrum Research & Development Committee (ARDC) Security Member
1

Summary

OpenZeppelin, the Security Member of the ARDC, reviewed the Rari multichain governance proposal and its specifications. If enacted, the proposal execution will register a custom gateway for a new RARI L2 token contract that will migrate the RARI DAO from the Ethereum mainnet to the Arbitrum ecosystem. The new token contract has been fully audited and deployed to the Arbitrum Sepolia testnet and all contracts have been manually tested.

Overview

The $RARI token that is used to govern the RARI DAO is currently deployed on the Ethereum mainnet and is not upgradeable. However, the RARI DAO would like to upgrade its governance to allow for new features to be implemented such as snapshots and delegations. By bringing its governance to the Arbitrum ecosystem, RARI DAO would also improve the user experience through lower gas fees and increased accessibility of their system. Despite the non-upgradeability of the $RARI token, it is possible to make these changes to the governance model by using a custom gateway to register a new token contract. This proposed solution requires the Arbitrum DAO’s approval.

Despite the non-upgradeability of the $RARI token, it is possible to make these changes to the governance model by using a custom gateway to register a new token contract. This proposed solution requires the Arbitrum DAO’s approval.

Custom Gateway Motivation

The Arbitrum chain allows for tokens to be bridged between various networks, such as between Arbitrum and Ethereum. In the case of many ERC-20 tokens, this involves associating a token contract on some other chain with a paired token contract on Arbitrum. When users wish to bridge their tokens, the tokens are escrowed in a bridge contract on the host chain, and an equal amount of tokens is minted on Arbitrum. Using StandardERC20Gateway, any ERC-20 token on the Ethereum mainnet can be permissionlessly bridged to Arbitrum by default. However, this standard approach is not suitable for some tokens. For example, tokens accruing interest need to ensure that the rewards are dispersed properly to other chains instead of just being accrued to the bridge contract. A custom gateway system allows for specialized cross-chain asset bridging in such exceptional cases where additional bridging logic is necessary to be implemented.

The Arbitrum generic-custom gateway is designed as a flexible solution that is suitable for most custom needs beyond what is available using StandardERC20Gateway. In the case of the new $RARI token, the proposed changes include the addition of snapshotting and delegation functions, as well as the introduction of proxy-based upgradeability. According to the Arbitrum Foundation documentation, this is likely the right solution for such a migration since these changes are limited in scope (as opposed to the addition of minting functionality directly on Arbitrum, for example).

Technical Details

In order to register the new $RARI token to the custom gateway, the relevant steps are outlined by the Arbitrum Foundation.

  1. Deploy your token on Arbitrum
  2. Register your token on L1 to your token on L2 via the L1CustomGateway contract
    • The $RARI token currently deployed on the Ethereum mainnet should make an external call to L1CustomGateway.registerTokenToL2. This registration can alternatively be performed as a chain-owner registration via an Arbitrum DAO proposal.
  3. Register your token on L1 to the L1Gateway router
    • Finally, the $RARI token deployed on the Ethereum mainnet should make an external call to L1GatewayRouter.setGateway. This registration can alternatively be performed as a chain-owner registration via an Arbitrum DAO proposal.

The RARI DAO has already voted in favor of a proposal that would deploy the custom $RARI token on Arbitrum, ensuring the completion of the first action item. The RARI DAO is now requesting registration to the L1CustomGateway and L1GatewayRouter contracts via this governance proposal. The mapping between the tokens deployed on the mainnet and the Arbitrum chain would then be updated and the RARI token would be registered to the generic-custom gateway, completing the remaining two steps in the registration process.

The upgraded token contract from the proposal has also been fully audited.

Conclusion

The proposed changes, including registration of a new $RARI token to the generic-custom gateway, are appropriate to meet the needs of the RARI DAO. Since the currently deployed contracts are non-upgradeable and the RARI DAO wishes to add new features to their token, as well as enhance user experience, this operation is necessary. Using the standard ERC-20 gateway would not support the new desired enhancements and the changes do not require a unique, tailor-made gateway. Registering with the generic-custom gateway is a good fit for this transition.

4 Likes