Dual Governance: An Overview

April 18, 2024 in Governance by Lido

TL:DR

A dual governance explainer has been published to the Lido forum – and a Snapshot vote is expected to go live April 18th.
If the vote passes, the optimistic timeline is for a testnet deployment in Q3, with mainnet scheduled sometime in Q4.
Dual governance allows stETH holders, in the worst case, to delay any proposed changes to the Lido protocol until they have fully exited (withdrawn their ETH from the protocol).
The main goal is to prevent LDO holders from changing the social contract between the protocol and stETH holders without their consent.

Current Status & Plan

After a several-month long mechanism design exploration phase, a small team of Lido DAO contributors have come up with both a mechanism design and a tech spec for dual governance.

If LDO holders approve of this direction (tomorrow's snapshot vote will serve as a temperature check), contributors plan on going forward with a technical implementation, preparing for the testnet runs, as well as engaging multiple parties to challenge the mechanism design, technical implementation, and parameter choices.

Optimistic timeline is for the first testnet deployment to happen in Q3, with mainnet launch scheduled for late Q3 / Q4. Note that these are approximate dates subject to change depending upon the security checks and testnet results.

Dual Governance: Motivation

Well-designed onchain DeFi protocols are able to put users ahead of tokenholders. In the sense that even if the protocol is failing, users can still permissionlessly exit with their funds intact, and there's nothing token holders can do about it.

This is something that is truly new to financial markets and infrastructure. Something that is only made possible by the non-custodial nature of on-chain DeFi.

This power of exit, is an extremely underrated differentiator between on-chain DeFi and off-chain DeFi/TradFi.

It turns out that if we want to preserve the right to exit under the most extreme scenarios for Ethereum stakers using Lido, a naive Moloch style rage quit mechanism isn't quite good enough.

This is because of how Ethereum's validator exit queue works – all Ethereum validator exits are processed through a single queue with limited throughput. This rate-limited exit queue means that in the worst case it could take more than a year to exit the protocol. During this time, LDO holders could, in theory, pass proposals that are not in the best interests of these users.

However, it is possible to achieve rage quit style exit guarrantees by effectively freezing significant parts of LDO governance until dissatisfied stETH holders have either fully exited or convinced LDO holders to reverse course.

By allowing for stETH holders to exit en masse before a given proposal is passed, dual governance represents an important step towards mitigating Lido protocol governance risk for Ethereum stakers.

Visual Examples

Unhappy path (no de-escalation)

Malicious proposal to change the withdrawal vault contract

**A well-funded LDO holder makes a malicious proposal to change the stETH withdrawal contract and rug users. This proposal gets enough LDO support to pass.**

A small group of users (stETH holders) pick up on this and vote to veto the change. In doing so they both sound the alarm for more users to join, and ensure that neither this proposal, nor any other DAO proposals which affect them can be executed for the time being.

**More users join the veto while the DAO is in this temporarily frozen state. Some need to take the time to unwind from their DeFi positions. That's ok.**

**The DAO remains frozen until all users that have joined the veto are able to fully withdaw their ETH.**

**After all users have been made whole the DAO reverts back to its normal state (unless there is another rage quit motion already in motion).**

Happy path (de-escalation)

Good faith proposal to remove a node operator

**For some reason or other LDO holders vote to boot a node operator out of the curated set.**

**LDO holders realize they've made a mistake and de-escalate by voting to cancel all pending proposals (including the one that triggered the rage quit).**

**The de-escalation is successful – stETH holders remove their veto – and the DAO resumes a normal state of affairs.**

Call to action

If you'd like to contribute to the discussion, or just care about understanding the details, please read the research distillation and voice your comments under the snapshot proposal. Any input at this stage is much appreciated.