[EP 5.12] Roles Modifier V2 Migration & Updates to Endowment Permissions
Abstract
This proposal aims to roll out an updated version of the Zodiac Roles Modifier module. The new version improves usability and transparency of treasury management operations. Upon approval, the Roles Modifier v2 module will be activated.
Furthermore, this proposal requests authorization from the DAO to revise the permissions policy. A notable change includes enabling swapping actions on CoW Swap while the other permissions primarily focus on eliminating obsolete actions and protocols, and refining parameters within the existing permissions.
Roles v2 Migration
Motivation
As previously stated, the Zodiac Roles Modifier facilitates karpatkey’s proxy management of the Endowment by ensuring that only pre-approved transactions, defined by the permissions policy voted on by the DAO, can be executed. In collaboration with karpatkey, the Gnosis Guild team has significantly upgraded the Zodiac Roles Modifier module and the Zodiac Roles app. These enhancements have resulted in a more powerful and robust on-chain permissions infrastructure with the following improvements:
- Introduction of Allowances: Implementation of spending limits within permissions.
- Enhanced Call Data Scoping Toolset: This toolset considerably broadens the range of functions that can have permissions set, increasing flexibility.
- Advanced Logical Conditions: Allows for the creation of complex permissions structures to accommodate sophisticated operational needs.
- Compatibility with DeFi Kit: This feature integrates with karpatkey’s permissions policy building module, facilitating the straightforward crafting of protocol actions.
- Improved Visualisation and User Interface: the new Zodiac Roles app UI 1 not only displays permissions clearly but also provides a user-friendly interface to compare changes in each policy update, enhancing transparency and simplifying audits.
For more detailed information, please refer to the following resources:
Contract Audits
The Zodiac Roles Modifier v2 contract has been rigorously audited by G0 Group, the internal auditing team of Gnosis DAO, and by Omniscia. The detailed audit reports are available for review here 1.
Changes to the Permissions Policy
This proposal outlines the following modifications to the permissions policy:
- Token Arrays for Swapping:
- Considering the tokens involved in the existing permissions, we have updated the token arrays to ensure they can be seamlessly swapped across the various whitelisted protocols and aggregators.
- Token IN Allowlist: [CRV, DAI, USDT, BAL, AURA, CVX, ETHx, COMP, rETH, SWISE, wstETH, LDO, WETH, ankrETH, USDC, stETH].
- Token OUT Allowlist: [DAI, USDT, USDC, rETH, wstETH, WETH, stETH].
- The above arrays are to be utilised for swapping on CoW Swap, with equivalent lists replicated for Uniswap v3 and Balancer.
- Introduction of CoW Swap (diff 4): 5. Addition of a CoW Swap Order signer to enable gas-minimised and MEV-protected swaps. This includes an extensive set of aggregated exchange routes, improving the efficiency and effectiveness of required swaps. 6. Tokens will be swapped on CoW Swap according to the token IN/OUT allowlists mentioned above.
- Deprecations and Removals: 7. Uniswap v2 Swaps (diff 1): Removed due to insufficient liquidity in V2 pools. 8. Stakewise v2: Deprecated functions related to deposit (diff 1) and claim (diff 1) functions in light of the recent launch of Stakewise v3. Consequently, permitted actions related to Stakewise v2’s sETH2-ETH Uniswap pool are also removed (diff). 9. Compound v2 (diff): Discontinued all actions targeting v2 contracts and v2 cTokens (cUSDC and cDAI) due to the ongoing transition of the protocol to its v3. 10. Revocation of Existing/Obsolete Allowances: All existing and outdated allowances previously set by the Endowment are revoked (set to zero). The ability to call the corresponding approve functions is included in the newly proposed policy. Accordingly, the payload contains a bundle of transactions to revoke these allowances.
- Updates: 11. Uniswap v3 (diff 1) and Balancer (diff): Adjusted to allow the mentioned token IN/OUT allowlists. 12. Curve Pools: Addition of stETH-ng (factory) pool (diff) and removal of cUSDC + cDAI pool (diff 1; Compound v2 tokens). 13. Curve ZAP Deposit Contract (diff): Introduced to allow depositing and staking of LP tokens in a single step. 14. Convex Staking (diff): Added the CVX/stETH Rewards contract. 15. Lido Withdrawals (diff): Enhanced to include new withdrawal methods using permits for both wstETH and stETH; methods include
requestWithdrawalsWstETHWithPermit and requestWithdrawalsWithPermit. 16. Spark Rewards Claim (diff 1): Added functionality to claim wstETH rewards in Spark.
Audit Considerations
We highly value the community’s involvement in reviewing and providing feedback on this proposal. We encourage members with the necessary technical expertise to examine the content carefully (including this payload 1) and share their insights with us.
For effective testing of the permissions policy configuration, we have utilised a Testing Avatar Safe 1. This safe mirrors the current state of the permissions policy v4 1 granted by the Endowment to the Manager SAFE operated by karpatkey. The enhancements in the Zodiac Roles app interface now allow for a clear visualisation of all existing permissions, accessible here 2.
The updated interface also simplifies the process of identifying changes by displaying the current permissions policy on the left side and the newly proposed policy on the right side. To further aid in the adoption and understanding of these tools for audit purposes, we have detailed the proposed changes in version 5 documentation, following our standard Policy Update Request (PUR) format.
Additional considerations
Roles Modifier v1 and Enabling of v2
The existing Roles Modifier v1 module will remain active to ensure a smooth transition and prevent any unexpected disruptions in operational execution. Ownership of the deployed Roles Modifier v2 module 1, equipped with the new proposed permissions policy, has been transferred 1 to the Endowment’s Avatar Safe. These permissions are displayed here 4 and match those shown on the comparison interface here 1. The payload will only activate this module, marking the first phase of the migration process. A subsequent policy update proposal will seek to disable the v1 module.
Policy Visualisation in Terms of DeFi Kit Actions
The “show annotations” button, located at the top-right here 1, provides a visualisation of the proposed permissions policy expressed through the DeFi Kit Protocol Actions. This feature offers a more abstract and simplified description of the policy, enhancing understanding and accessibility.
