Questions about Optimistic Snapshot + Aragon Network

There have been a couple of announcements recently indicating a shift in Aragon voting ux from on-chain voting to off-chain voting using Snapshot. This new feature becomes potentially more powerful when combined with Aragon Court (maybe soon Aragon Protocol) to enable “Optimistic Snapshot”.

Some recent posts about this:

This has implications for the Aragon Network DAO, which will potentially be adopting Optimistic Snapshot as the main ux for ANT holders to create and vote on proposals.

I have some questions about how Snapshot works and what implications its design has for the security of the Aragon Network DAO:

  • Who can create proposals on Snapshot?
  • Is there a Snapshot admin who can delete proposals or block them from going onto the ballot, or censor certain votes (e.g. all “Yes” votes on a proposal the admin is opposed to)?
  • What happens if Snapshot goes down? Is it then no longer possible to create new proposals or cast vote on ongoing proposals?
  • How can a user challenge an action taken on-chain that conflicts with the actual outcome of a Snapshot vote?
  • Is there an " authoritative" Snapshot instance? Or can anyone set up a private Snapshot instance, vote with just their own ANT, and declare the results to be the “true” intent of ANT holders?

I’ll start there and follow up depending on the answers to these questions.

cc @jorge @Evalir

3 Likes

Thanks John, these are really interesting questions!

Here are my answers:

Who can create proposals on Snapshot?

It depends on the space configuration—by default, spaces are set up so there are multiple tabs, specifically core and community proposals. Core proposals can only be posted by whitelisted entities defined on the space configuration. Community proposals can be posted by anyone, but normally communities adhere to a strict formal for all proposals.

Is there a Snapshot admin who can delete proposals or block them from going onto the ballot, or censor certain votes (e.g. all “Yes” votes on a proposal the admin is opposed to)?

While there’s no centralized admin entity, proposals can be filtered out using the space config. They’re still accesible if you have the official URL, as they’re published to IPFS, which means they cannot be taken down fully.

What happens if Snapshot goes down? Is it then no longer possible to create new proposals or cast vote on ongoing proposals?

If the snapshot hub goes down, then it’s no longer possible to create proposals or cast votes on ongoing proposals. This has not happened yet though, and there have been talks with the Snapshot creator, Fabien Marino, for hosting more than one hub to avoid a central point of failure.

How can a user challenge an action taken on-chain that conflicts with the actual outcome of a Snapshot vote?

Assuming the person is using the new DAO Framework, Govern, one can either call the function to challenge the action on the Govern Queue of their DAO directly (through etherscan), or they can head to the Govern Console (currently released on Developer Preview and under active development) And challenge it through the UI. It’s important to note though, that they’ll have to keep in mind the DAO configuration at that point in time, as challenging requires both:

  • Having the necessary permissions (we’ll assume everyone can challenge)
  • Having the necessary collateral e.g an X amount of ANT.

The dispute would then be taken to the Court (or Protocol) for jurors to give their ruling.

Is there an “ authoritative” Snapshot instance? Or can anyone set up a private Snapshot instance, vote with just their own ANT, and declare the results to be the “true” intent of ANT holders?

While the software is free and open source for anyone to use, the currently hosted instance on snapshot.page, used by quite a few big projects, is taken as the de-facto instance. On top of that, as every proposal is published to IPFS, determining if the report of the proposal result has been made using a “private” instance is as easy as checking if IPFS hashes match.

3 Likes

Thanks! A few follow up questions:

  • Wouldn’t whoever runs the Snapshot hub being used (e.g. whoever is the sysadmin of snapshot.page) be the centralized admin in question? Based on the space config doc you linked to earlier it looks like whoever controls the repo GitHub - snapshot-labs/snapshot-spaces has ultimate power over spaces.
  • This Snapshot hub admin could block certain proposals from getting added to a space, or stop certain people from voting by refusing to counter-sign their votes, right?
  • Although I can look at a proposal on IPFS eg. here I cannot vote on it using IPFS, right?

UX flow-wise, are proposal authors putting the action into the Govern queue first and then manually creating the related proposal in Snapshot? Wondering if there’s a way that we can create a rule in Snapshot that says “you can only create a proposal if you have added a pending action in the Govern Queue of this DAO”.

We probably want to specify in the Aragon Network Agreement that a vote is valid if it is posted to one of several running instances, to guard against the DAO being frozen if snapshot.page does down. However this doesn’t solve the problem of either a rogue snapshot.page admin censoring proposals/votes or answer the question of what to do if snapshot.page goes down in the middle of a vote – If the vote duration expires before snapshot.page comes back online, and the vote outcome was “yes”, can the proposal be enacted? Can the vote somehow be invalidated, and if so what evidence would be acceptable to jurors/guardians? We’ll have to come up with some solutions for these failure modes.