Sushi RouteProcessor2 Post-Exploit Request For Comment

Approach:

I agree with Hasu’s general statements:

  1. Lido governance should approach this and other questions by setting a constitution, and in this case “important policies” which can be followed consistently
  2. In this specific case a concrete policy must be set going forward which covers the handling of MEV collected from exploits
  3. We must make sure that this policy does not open Lido to having every case of MEV (whether from known exploit or not) disputed, which would create an admin burden that Lido DAO is not equipped to deal with, and an expectation that any MEV is potentially recoverable

The specific policy:

However I disagree with the actually proposed policy (i.e. that Lido should never act as an arbitrator and should just put its hands up and say “not our problem” when clearly hacked or stolen funds pass to the DAO / node operators or stakers).

A goal of neutrality for Lido is honourable, but using the excuse of neutrality to avoid difficult problems is not.

A policy taking a more nuanced approach will be less simple, but can still be crafted to avoid unnecessary burden on the DAO and remain clear. An example would be:

  • Exploits must be known and clearly defined and then reported via a specifically designed channel (i.e. a thread set up in the forum)
  • Lido treasury, operators, and stakers must be able to be shown to have received more than 50 ETH from MEV related to this exploit (to filter out smaller requests)
  • Lido will then arbitrate to recover funds, and all its operators (accepting its constitution) will opt into agree to do this also

Competitive environment

A final point is that it is worth considering the overall direction of travel for the MEV ecosystem and competition for LSDs. With staking withdrawals now open, the liquidity moat that stETH has may shrink in the future. This will make competition over other factors more important than it has been in the past, and mean that competitors with smaller market share are less disadvantaged in DeFi than they have been up to this point.

We know that there is for example competition in the MEV space for more MEV to be returned to users and distributed in ways that are more aligned with ecosystem. Examples are mevblocker . io compared with i.e. Flashbots.

If Lido takes a policy of neutrality and refuses to ever return funds collected as MEV from major hacks, then I would expect some other liquid staking providers may use this as a differentiator to gain market share, signalling that they are more aligned with the DeFi users, projects and ecosystems.

Teams such as Sushi, and other DeFi projects, may feel align themselves with LSDs that have policies to help return stolen funds, instead of with Lido which does not. However this is clearly speculative at this point…

6 Likes