Madhavan MalolanPermissionless Hierarchy : A new way to look at DAOs.
DAOs are the biggest misnomer of web3. They don’t work, and no one seems to know how to make it work. Here, I present a view to challenge the way we look at DAOs to begin with. The take-away for me from 2 days of DAO discussions in Amsterdam is nobody has figured out how to manage the chaos to get anything useful done in a DAO. DAOs are today just a glorified Discord channel with no clear route to be either Decentralized (what does that even mean?) or Autonomous. “DAO” is a marketing gimmick....
Madhavan MalolanRequest to build - Decentralized NFT based lending protocol
A completely decentralized protocol that lets people borrow money from the treasury by producing an NFT. This is to be built on top of LooksRare, because LooksRare is decentralized and hence infinitely composable.Borrow at floor priceProduce an NFT from an NFT collection on LooksRare. The maximum amount you can borrow against the NFT is the minimum floor price of that collection over the last 30 days. You can only deposit verified collections’ NFTs - for securing the protocol. Open to any oth...
Madhavan MalolanA construction for a zk-oracle network
Oracles are going to be the most important piece of web3 infrastructure after we increase on chain TPS via rollups and L2s. If there is a million transactions possible in a block, most of the block space will be used by oracles bringing off chain data on chain. Super important for us to figure out a decentralized oracle network. Chainlink is doing a great job - the question is how can we bring in data feeds that have higher participation from the community members/data providers?Data guildsTh...
Founder [Questbook (YCw21)](https://questbook.xyz) Writing about things that need to be built in web3
Madhavan MalolanPermissionless Hierarchy : A new way to look at DAOs.
DAOs are the biggest misnomer of web3. They don’t work, and no one seems to know how to make it work. Here, I present a view to challenge the way we look at DAOs to begin with. The take-away for me from 2 days of DAO discussions in Amsterdam is nobody has figured out how to manage the chaos to get anything useful done in a DAO. DAOs are today just a glorified Discord channel with no clear route to be either Decentralized (what does that even mean?) or Autonomous. “DAO” is a marketing gimmick....
Madhavan MalolanRequest to build - Decentralized NFT based lending protocol
A completely decentralized protocol that lets people borrow money from the treasury by producing an NFT. This is to be built on top of LooksRare, because LooksRare is decentralized and hence infinitely composable.Borrow at floor priceProduce an NFT from an NFT collection on LooksRare. The maximum amount you can borrow against the NFT is the minimum floor price of that collection over the last 30 days. You can only deposit verified collections’ NFTs - for securing the protocol. Open to any oth...
Madhavan MalolanA construction for a zk-oracle network
Oracles are going to be the most important piece of web3 infrastructure after we increase on chain TPS via rollups and L2s. If there is a million transactions possible in a block, most of the block space will be used by oracles bringing off chain data on chain. Super important for us to figure out a decentralized oracle network. Chainlink is doing a great job - the question is how can we bring in data feeds that have higher participation from the community members/data providers?Data guildsTh...
Share Dialog
Share Dialog
Founder [Questbook (YCw21)](https://questbook.xyz) Writing about things that need to be built in web3
Subscribe to Madhavan Malolan
Subscribe to Madhavan Malolan
<100 subscribers
<100 subscribers
Auditing wait times on top audit firms are 9-12 months and expensive.
We need something that is more participative and allows for new and yet-unproven security auditors.
Here I propose a decentralized audit marketplace that turns the auditing process into a prediction marketplace.
A jury is usually reputed security engineers. This jury doesn’t do the audit itself, but only signs off a reported vulnerability as a real bug.
There are 5 jury members selected for every audit. They control a 3/5 multisig that approves a detected bug once it is reported by an auditor.
They receive 5% of the total audit spend.
The contract must be deployed onchain so as to make the code immutable.
Once the contract is deployed, 2 betting pools are created. Called NoBugs and YesBugs - representing a betting pool that says there are no severe bugs in this contract v/s yese there are bugs in this contract.
The person requesting the audit must fund both the pools equally to kick start the marketplace.
A security auditor looks at the deployed contract and judges whether there are bugs in this contract or not.
If they’re confident there are no severe bugs, they may add money to the NoBugs pool.
Till the time a bug has been reported, the money from the YesBugs pool starts streaming to NoBugs pool, such that the YesBugs pool will be exhausted in 30 days.
If a security engineer finds a bug, they may report the bug to the jury.
The jury will vote with their signature on whether the bug is a severe bug. If the jury accepts the bug to be a severe bug, the NoBugs pool is liquidated and all the money from NoBugs pool is distributed to the people who funded the YesBugs pool. This distribution happens proportional to
When the funder put money in the YesBugs pool (earlier you make the bet, more is your reward if true)
Amount put in as the bet (larger your bet that there are bugs, more is the reward)
5% goes to the jury members equally
If the size of NoBugs pool is greater than 95% of the summation of the pools, the NoBugs pool can be liquidated. All the people who bet that there are no bugs get rewarded by the same ratios as presented in 7a.
If the no bugs reported is the pool that won, an NFT is created with the amount of money that was liquidated and the ENS of people on the jury.
Security engineers who are not part of large auditing firms and are looking to prove their worth, building their reputation.
If the engineer has audited the contract and is highly confident that there are no bugs they’ve missed - they’ll fund the no bugs pool
If the engineer isn’t sure, it is prudent to fund the YesBugs pool for there is likely always a bug - especially in early iterations of a contract
If the engineer has found a bug, it is better to rally people to bet on NoBugs and increase the pool size of NoBugs and produce the bug to the jury once the NoBugs pool is large enough.
By rallying more people to bet on NoBugs an incentive is created for more engineers to come and find a bug in the contract. If someone else finds & reports the bug before the aforementioned security engineer, they lose the reward they could have claimed.
Hit me up at @madhavanmalolan
This might not be something that can be built on a 1ETH bounty that I typically give out. But if this is something you are keen on taking up and building end to end hmu, we can work out something :)
Auditing wait times on top audit firms are 9-12 months and expensive.
We need something that is more participative and allows for new and yet-unproven security auditors.
Here I propose a decentralized audit marketplace that turns the auditing process into a prediction marketplace.
A jury is usually reputed security engineers. This jury doesn’t do the audit itself, but only signs off a reported vulnerability as a real bug.
There are 5 jury members selected for every audit. They control a 3/5 multisig that approves a detected bug once it is reported by an auditor.
They receive 5% of the total audit spend.
The contract must be deployed onchain so as to make the code immutable.
Once the contract is deployed, 2 betting pools are created. Called NoBugs and YesBugs - representing a betting pool that says there are no severe bugs in this contract v/s yese there are bugs in this contract.
The person requesting the audit must fund both the pools equally to kick start the marketplace.
A security auditor looks at the deployed contract and judges whether there are bugs in this contract or not.
If they’re confident there are no severe bugs, they may add money to the NoBugs pool.
Till the time a bug has been reported, the money from the YesBugs pool starts streaming to NoBugs pool, such that the YesBugs pool will be exhausted in 30 days.
If a security engineer finds a bug, they may report the bug to the jury.
The jury will vote with their signature on whether the bug is a severe bug. If the jury accepts the bug to be a severe bug, the NoBugs pool is liquidated and all the money from NoBugs pool is distributed to the people who funded the YesBugs pool. This distribution happens proportional to
When the funder put money in the YesBugs pool (earlier you make the bet, more is your reward if true)
Amount put in as the bet (larger your bet that there are bugs, more is the reward)
5% goes to the jury members equally
If the size of NoBugs pool is greater than 95% of the summation of the pools, the NoBugs pool can be liquidated. All the people who bet that there are no bugs get rewarded by the same ratios as presented in 7a.
If the no bugs reported is the pool that won, an NFT is created with the amount of money that was liquidated and the ENS of people on the jury.
Security engineers who are not part of large auditing firms and are looking to prove their worth, building their reputation.
If the engineer has audited the contract and is highly confident that there are no bugs they’ve missed - they’ll fund the no bugs pool
If the engineer isn’t sure, it is prudent to fund the YesBugs pool for there is likely always a bug - especially in early iterations of a contract
If the engineer has found a bug, it is better to rally people to bet on NoBugs and increase the pool size of NoBugs and produce the bug to the jury once the NoBugs pool is large enough.
By rallying more people to bet on NoBugs an incentive is created for more engineers to come and find a bug in the contract. If someone else finds & reports the bug before the aforementioned security engineer, they lose the reward they could have claimed.
Hit me up at @madhavanmalolan
This might not be something that can be built on a 1ETH bounty that I typically give out. But if this is something you are keen on taking up and building end to end hmu, we can work out something :)
No activity yet