BIP-53: Decision on how to proceed regarding the Boosted Pools incident

Intro:

Starting on the morning of 27 Aug 2023 Beethoven X experienced multiple attacks on both the Fantom and Optimism deployments, with a total loss of around $1.1M on Fantom and $320k on Optimism. Balancer released a full technical postmortem report here: https://medium.com/balancer-protocol/rate-manipulation-in-balancer-boosted-pools-technical-postmortem-53db4b642492 and Beethoven’s perspective and time-line can be seen here: https://medium.com/beethoven-x/rate-manipulation-in-balancer-boosted-pools-a-beethoven-x-perspective-e419bbb66592. The vulnerability was publicly disclosed to the user base on 22 Aug 2023.

Motivation:

There are always risks in DeFi, which can be mitigated by audits and due diligence, but never completely avoided. Multiple protocols have experienced exploits and there’s no one way to proceed if such an incident occurs.

A discussion was started in the governance channel of Beethoven X discord regarding what steps should the Beethoven X DAO take. The discussion was not deemed sufficient to decide on how to proceed without a vote, which is why the current BIP was created.

It is important to note that even though Beethoven X suffered attacks on two different chains, then there are important differences between the deployments and thus the decided outcome may vary too. The Optimism deployment is set up as a partnership between Beethoven X and Balancer. Balancer has decided to build a facility for users to report potential losses, which also includes the joint Optimism deployment: https://snapshot.org/#/balancer.eth/proposal/0x576e698cd8649dd6a6a2456f06c4648bb0d95e35da000c51c82f243774b7ef9f. Their reasoning here is that a large portion of the liquidity might be stale (no longer actively managed) and therefore simply airdropping a full reinstitution of the funds does not seem adequate. After this system has been built, users will be given 60 days to report their loss and following decisions will be based on that information. While Beethoven X contributors will offer Balancer their assistance with this task, the Optimism reimbursement will be based on Balancer's timeline and the final decision will need to be agreed upon by both DAOs.

The subject of this proposal is the Fantom deployment, where the loss was considerably higher and where Beethoven X DAO can decide how to proceed on its own. Similarly to Balancer’s arguments, the full reimbursement of the funds through simply airdropping to affected wallets does not seem adequate, so this vote will decide whether we should proceed by setting up a similar system to Balancer. This gives the possibility to further analyze the losses and provide various options for potential reimbursement. Voting YES means Beethoven X contributors will work on creating such a system, the actual reimbursement would be decided by the following vote. Voting NO means this system will not be created and no reimbursement will be carried out for the losses on Fantom deployment. This BIP should be considered as an isolated response to a specific event and not be considered a precedent setting.

Impacts/Risk Assessment:

There are no specific impacts for voting YES to this proposal, other than the work that needs to be conducted to set up the reporting system and analyze the results. Any actual decision would be decided by a following vote.

Voting NO to this proposal means that no reimbursement will be carried out. It is difficult to assess potential impacts/risks with such a decision, since the view would be subjective to every user. Even though the decision should be considered as a separate event, then as an assumption one could consider decreased trust in Beethoven X to reimburse user losses in the future as a potential negative impact.

Specification/Execution Plan:

The passing of this BIP would mean that Beethoven X contributors will:

1. Build a system/facility for users to report their loss of funds.
2. When created, widely announce and give users 60 days to report their loss.
3. Analyze the data and report the findings.
4. Put up a following governance vote to decide on how to proceed based on the results.