Slock.it Proposal #1 - DAO.Security (redux)

[Ursium]

The code for the Proposal can be found at:

slockit/smart-contract/blob/master/DAOSecurity.sol

The address of the deployed Proposal is: f8c35f1cf2dc4dbeaeeb2ecb298a80b506a5781d

Compilation instructions:

1. Use browser solidity
2. Choose Solidity version: 0.3.3-4dc1cb14/Release-Emscripten/clang/Interpreter + WITH OPTIMIZATION
3. Source code was hand combined by copy pasting the relevant contracts: http://pastebin.com/BCfC5cuL

Google Hangout proof:
Saturday 28th - 3pm CESTA.
https://plus.google.com/events/cf7a4gabn0fsvvs6kq34ocsck5c

Proposal PDF:
https://download.slock.it/public/DAO/proposals/daosecurity.pdf

Blog Post
https://blog.slock.it/both-our-proposals-are-now-out-voting-starts-saturday-morning-ba322d6d3aea#.i6kuucdp0

[etherscan]

Contract has been opcode Byte level verified at http://etherscan.io/address/0xf8c35f1cf2dc4dbeaeeb2ecb298a80b506a5781d#code

[profitofthegods]

I think this is an improvement; in general the security aspect can be better handled collaboratively but I agree that having one person as a point of reference and to help organize other contributions, and to ensure that there is always somebody looking at each proposal, is a good idea.

Am I correct in summarizing the changes as:

1. Nay votes will no longer count towards qorum

2. Grace period to split after the result of vote is known

3. Remove extra balance

4. Add solo split (nobody can follow you into new contract)

Also can you clarify for me: Does the grace period to split still require not voting, or can somebody who voted NO to a proposal still split during the grace period?

[per]

Thanks Stephan, and the rest of the Slock.it team to be so reactive to the community concerns and to be professional to take on the responsibility of the DAO security.

You all can give your pros/cons and vet on this page as well: https://dao.consider.it/slockit-dao-security-proposal-revisedredux

[Lefteris]

Hello!

Lefteris from slock.it here. Yes, your summary looks correct.

As to your clarification:

Does the grace period to split still require not voting, or can somebody who voted NO to a proposal still split during the grace period?

The point of introduction of such a grace period would be exactly to allow people to vote whatever they wish without fear of inability to split afterwards. You are only "locked in" for the duration of the vote, afterwards you are free irrespective of what you voted. And with a grace period you can make an informed decision having all the information available at the end of the voting debate period.

The particular github issue tracking this is: https://github.com/slockit/DAO/issues/164

[ChrJentzsch]

Those are the issues we will address. We are discussing them with security experts, so the final decision on the best way forward is not reached yet, but as it stands today, you are correct in your assumptions.

[0x666E5150]

Was anything ever done about the issue of the DAO holding rewards hostage from the split reward tokens by reinvesting them in other projects?

[daob]

Thanks for creating the DAO and for the security proposal, which I support.
I think you guys are doing an awesome work.
That said, here are some notes on the verification process that may be helpful to improve the DAO governance for the next time.

I've taken upon myself to make this "whitelisting" process a bit more transparent for the community and other token holders.
Here is a writeup of the verification event, with info on most people and transaction verifications.

Hopefully, next time, for the sake of transparency, the participants should write down this report themselves

Also, more importantly, I have some doubts on WHO WAS THE CURATOR?
as he didn't show his face and the only name "Colm" suggest he is "Colm Holbert" (@colm1), a Sloc.it team member who **doesn't appear to be on the curator list .

... and if it would be the case it would be a clear conflict of interest??!!

@Ursium can you explain this please?

Also, who is "Patrick" aka "psdev" (he too doesn't appear on the curator list)?
Who is "Bill"?

---

THOUGHTS ON GOVERNANCE FOR VERIFICATION EVENTS:

• After every verification of a proposal, there should be a report similar to this one, with a writeup of the keys and transactions for the community to check

• it should be clear who all the participants are, with their name, role, and address clear in text accessible in the writeup and in the comments of the hangout video

• it should be clear who the CURATOR is, and probably he/she should present themselves first, indicating their account/key, that identifies them in the DAO Contract (if there is such a thing)

how do you query the DAO Contract for the list of curators?

---

PROPOSAL#1 - REPORT OF THE VERIFICATION

DAO.Security

• Forum post https://forum.daohub.org/t/slock-it-proposal-1-dao-security-redux/3536
• The address of the deployed Proposal is:
  http://etherscan.io/address/0xf8c35f1cf2dc4dbeaeeb2ecb298a80b506a5781d#code
• Google Hangout / youtube video
• Verification DateTime: 2016.05.28 h15:00 GMT+1

what is the proposal about:
https://youtu.be/kYjxMAFEXaE?t=56
fix all the security issues before doing anything else, addressing all the security issues and possible attacks presented in the so called "Vlad Paper"

---

PARTICIPANTS

WHO IS THE CURATOR???
Who is Asdf?? is it "Colm Herbert" https://slock.it/team.html (he doesn't appear in the curator list)
who is Patrick / PSdev? (he doesn't appear in the curator list)
who is Bill

Simon Jentzsch

• Role: CEO slock.it
• Account: http://etherscan.io/address/0xdfAd325E000054C82182BE49af23f497703B52
• Transaction verification: http://etherscan.io/tx/0x5280798dfbfbbaca99680ab00e9734b155d7c7fe48cb82dac679c4b530b14c04
• Contacts: simon dot jentzsch at slock.it / google+

Gian Bochsler

• Role: cofounder of Bity.com - Slock.it partners
• Account: http://etherscan.io/address/0x0a21bcc2F988edae866419664ec57b80bafea780
• Transaction verification: http://etherscan.io/tx/0xe8bd69b8924dae4aab8499fdbb3d1c5f74b0e4b6dabd228add09df800d372caf
• Contacts: linkedin / google account "Jarod"

Stephan Tual

• Role: COO Slock.it
• Account: http://etherscan.io/address/0xd4f73f0361f500aa7cb483908bd61b0c414bdcb7
• Transaction verification: http://etherscan.io/tx/0xef4d4674bfe3912a8cf33e1db0bbc8f67ed042654a3949f510a8f2bf1c46d307

Alexis Roussel

• Role: cofounder of Bity.com switzerland / neuchatel
• Account: http://etherscan.io/address/0x0f212ada78e3607197528f87c09cf84cfe3329ae
• Transaction Verification: http://etherscan.io/tx/0xc294378e3f78d05e1df8127ac0b8c0f7658bc00b96d31e2f71b42ffffab4aacf
• Contacts: Linkedin / Google account Rachyandco

---

TRANSACTIONS VERIFICATION

all transactions to verify identity have been sent to "Bill" ??
http://etherscan.io/address/0x68952bb4f1e236b1d8cb956e7f6a2c8b6adbd5d9

TRANSACTIONS RECORDS:
http://etherscan.io/tx/0xef4d4674bfe3912a8cf33e1db0bbc8f67ed042654a3949f510a8f2bf1c46d307
http://etherscan.io/tx/0x5280798dfbfbbaca99680ab00e9734b155d7c7fe48cb82dac679c4b530b14c04
http://etherscan.io/tx/0xe8bd69b8924dae4aab8499fdbb3d1c5f74b0e4b6dabd228add09df800d372caf
http://etherscan.io/tx/0xc294378e3f78d05e1df8127ac0b8c0f7658bc00b96d31e2f71b42ffffab4aacf

interesting to convert the input data to Ascii to read the messages "Let the DAO change the world!"

[remyroy]

From what I can understand and see on the blockchain, the curators have not yet whitelisted this proposal which is why you will not see the proposal yet on the DAO contract.

[profitofthegods]

Thank you for providing that information.

[Lefteris]

Hey daob,

According to the guide on how to make a proposal to the DAO

Step 3: The Community Weighs inYour
forum post is public for the general community to verify that the byte
code matches the source code and analyze your contract. Ultimately
however, the final decision lays in the hands of the Curators.The
community will then verify your contract, which includes insuring the
bytecode matches its source, and confirming that it will not allow for
any attacks against the DAO. It’s a party and everyone is invited! If
you want to be part of all this fun join us on DAOHub forums here, or join the DAO slack chat (signup) with the community.

This was us performing Step 3.

Colm is not a curator, he is just acting as a link between the community and the curators. The verification hangout was public and people in thedao slack were invited to join. That's why you also saw more people.

[daob]

@lefteris, actually it seems they were performing step 2 - but it's still unclear if the process should be moderated by a curator or not.
I think it should.
if the role of the curator is to insert the account of the proposal in the whitelist, it seems important enough for them to be controlling the identities of the proponents, during the video

from how to make a proposal to the DAO

The DAO cannot send ETH to an address that is not on the whitelist. The function of the Curator is to manage this list. It’s important to note that Curators aren’t here to gauge the ethical or financial merits of a Proposal, but only to ensure that the Proposal smart contract will operate as described, and is safe to be included on the whitelist.

[TheDaoist]

Honestly, I believe Slock.It has a HUGE conflict of interest. I get that Slock.it has a lot to lose and wants it to succeed as much as we do, but we have to take everything with increased scrutiny and dilligence. If we really want to see chance as a community let's come together and work on this TOGETHER: https://forum.daohub.org/t/dao-2-0-and-governance-2-0-revamp-proposal/3718/5

This proposal is OUR proposal, and it will not go live until we as a community can agree and come together on it. I will be modifying it based on feedback from everyone. We can look at this proposal, take what we like and modify or add it to ours, but let's come together to work on one solid Proposal instead of many different ones. Preferably led by someone who does not have a conflict of interest -looks at slock.it- sorry guys, I know you mean well. But I think it's very important that we as theDao review this carefully outside of Slock.It.

[hatcyl]

So ... when do we vote? What does the process look like?

[taoteh1221]

Nice. How do we vote in the Mist wallet on this proposal? Any good guides somewhere for it yet?

[GroTheNetwork]

I am using the original homestead wallet 0.5.2 and I clicked on my wallet that holds DAO tokens, then i clicked on 'Contracts' at the top, then i scrolled down part way and since I'm already watching the contract I clicked on 'THEDAO' as it is displayed (showing my DAO Tokens) right above the 'Add Contract' button.

Then i clicked on 'Show Contract Info'. Then scrolling down on the right side you can select from the dropdown list, a specific 'Function'.

Functions listed are 'Refund', 'Create Token Proxy' and then 'Vote'.

So I selected 'Vote' and it has a place to put a number. From what I gather there are currently 5 existing proposals, from my understanding the only way those proposals function in your MIST wallet is that those proposals have been approved by the Curators and been assigned their own unique 'Proposal_ID' - which is a 256 bit unsigned integer.

So I have to go out to and make sure I'm reading the real proposal and have the real id number and then once i type in the Proposal_ID that I want to vote on a boolean voting check box just below where it asks for Yes (filled) or No (unfilled).

A drop down box below the 'Voting Check Box' labeled 'Execute From' allows me to select from any of my wallets and I'm assuming that I must choose the wallet where TheDAO contract actually was accepted from.

I have Ether in this wallet and it allows me to put in a number to send... but I will stop right there as I have not actually voted yet.

It seems that I can only vote on one of the five current proposals.

Assume you don't have to put any Ether in the Send field hoping the wallet is smart enough to only send the minimum transaction fee.

Wondering if I can allocate a specific portion of my vote or if it is all or nothing.

I have a lot of basic how to vote questions.

[colm1]

I would be really happy if you would join the verification team in future. If you join the https://thedao.slack.com/messages/verification/ slack there I will announce the next one. A strong community is really important to making sure the DAO verifcation process works. Today We had Bill and psdev. Next time you and some other members will join also.

[Ursium]

I just want to say to everyone who would like to vote on this (Yes or No) , it's not possible until the Curators add us to the whitelist. There is no reason not to as the bytecode and signatures were validated.

We are working on a kickass tutorial for voting as well as a neat interface that will be available on myetherwallet imminently. Once the proposal is whitelisted it will just be a click away

[Vosh]

This is the problem with even attempting proposal voting this early. No one....most people haven't a clue how to make this happen do to the complexity of the software. People need time to catch up.

[GroTheNetwork]

While you are working on that tutorial, perhaps it's time for a quick overview of the wallet structure.

For example, i understand in Bitcoin the balance is an unspent transaction and since it resides on the blockchain, all I need is a password to import that unspent transaction into any new wallet.

On the other hand, Ether requires the Keystore to reside on a computer and the user then has to enter the Private Key. It seems to me that people might have a tendency to use a less strong key as they need to have possession of not just the key, but the keystore files that goes with it. Please correct me if I'm making misstatements.

Also, i am afraid I might have chosen a custom install for my original 0.5.2 installation and placed it in its own folder as when I attempted to upgrade by unpacking the 7.4 version (if i recall) when it unpacked, it stated files were missing so I simply removed the upgrade attempt and 0.5.2 is still fine and works and watches the contract ok. Sometimes out of nowhere, it will actually show transactions involving THEDAO contracts but that seems intermittent. I can see my transactions I've made and my tokens no problem.

I realize these basic wallet questions are not really part of the Slock.it software and TheDAO software but getting to the point of being able to vote is going to be important if we don't want to exclude non-technical users.