Governor Note: Lido DAO’s LDO and stETH Dual Governance

Key Insights

• Lido DAO wants to adopt a dual governance model for its Ethereum liquid staking protocol.
• Using LDO as the standard governance token, stETH would have veto power over LDO decisions.
• While the model is still awaiting specifics on its technical implementation, there are four proposed options to avoid a governance gridlock or veto abuse between LDO and stETH holders.
• To prevent a governance gridlock, the first option requires holders of LDO tokens to lock their tokens via veLDO for voting power. LDOs locked to support a vote are burned if stETH holders reject it.
• Three additional options aim to prevent stETH holders from abusing their veto rights. The voting system could introduce a significant timelock as an alternative to an indefinite veto state when no LDO votes are cast. If stETH holders veto a decision and fail to resolve the situation back to the control of LDO holders, then the timelock will eventually be lifted. Second, if a successful anti-veto passes, the DAO will seize stETH tokens used in the veto. As a last option, the system could be extended to node operators so that they can decide when stETH holders can veto decisions.

Lido DAO is considering a proposal introducing a new governance framework that will allow staked ETH (stETH) holders to vote alongside Lido governance token (LDO) holders. Stakeholders praise the proposal for its innovative solution to Lido governance risks and conflict of interests. The proposal is currently in draft form, and a technical submission for its implementation is in development. Our analysis focuses on the potential benefits and risks of the dual governance system.

Why Lido DAO needs a New Governance system

The Lido DAO governs Lido Finance, a liquid staking protocol with staking pools for Ethereum, Polygon, Solana, Polkadot, and Kusama networks. Lido's protocol allows Proof-of-Stake (PoS) token holders to stake their crypto assets and receive a derivative staked asset (stAsset) they can use as they earn staking rewards. If a token holder stakes their tokens directly to the network, they will only earn staking rewards, with opportunity costs of missing out on DeFi investments.

In addition to missing out on investments through staking, node operations also present technical constraints. A minimum of 32 ETH is required to stake on the Ethereum Beacon Chain, which most users do not have. In Lido, users can pool their ETH into its staking pool and receive staked ETH (stETH) they can use elsewhere. In exchange for a small fee, whitelisted node operators receive the pooled ETH, and users earn staking rewards without the technical hassle. With over 32% of all ETH staked through Lido, the size of Lido's staking pool is a growing concern. The Ethereum community worries that Lido DAO will become too powerful creating the risk of cartelization and stakers’ coercion.

Because Lido DAO controls the code behind stETH and whitelists its node operators, the protocol could be maliciously modified to steal staked ETH from users. Lido DAO also has a treasury worth about $400 million, making it an attractive target for governance attacks.

Despite the unlikely possibility of the DAO voting to steal users' ETH, it manages a variety of staking pools with different requirements for each network. Therefore, while stETH holders are interested in protecting Ethereum, Lido DAO does not necessarily share these interests or those of any particular network. Instead, the DAO will govern the protocol according to its needs.

Principal-Agent problems arise in this situation. An Agent’s (LDO holder) ability to decide, set priorities, or take risks that are not aligned with its Principal (stETH holder) is akin to politicians acting in their self-interest instead of their constituents’. By allowing stETH holders to veto LDO votes that affect their interests, the dual governance proposal will prevent this moral hazard from occurring.

As a second objective, the proposal aims to reduce the scope of LDO governance through ossification. Ossification refers to becoming less flexible as a result of hardening. By ossifying the protocol, specific functions that LDO governance is capable of changing will be made less governable or immutable. As one of the proposal authors explained, ossifying the protocol too early would stop it from adapting to new network-level functionality and changes, but never ossifying it will make it vulnerable to governance as it grows and becomes more complex. Hence, as Ethereum approaches its new PoS state, Lido protocol ossification is in the works to reduce its governance exposure and address the DAO's vulnerabilities.

Current LDO Governance Mechanics

LDO holders are the only ones eligible to vote on Lido DAO decisions. The voting for routine DAO decisions happens on Easy Track, an optimistic governance mechanism that only allows objection votes to stop a motion from taking effect. Silence, in this case, approves consent until 0.5% of LDO's total supply objects, alerting stakeholders to review their submissions. Lido designed the Easy Track to minimize governance fatigue on the DAO. The Easy Track focuses on votes involving node operators' stake limits, managing referral partners, and allocating funds to rewards and Lido Ecosystem Grants Organization (LEGO).

Source: Lido Finance

As for decisions outside Easy Track's scope (such as protocol upgrades, node operator and treasury management, fees, and LDO mechanics and issuance), Lido uses Snapshot for signaling and Aragon voting if on-chain action is required. Voting on Easy Track, Snapshot, and Aragon requires holding LDO tokens before the vote begins, which grants proportional voting power based on token holdings.

Source: Lido Finance

Proposed Dual Governance Mechanics

The proposed dual governance framework will modify the DAO's Aragon voting flow by adding a timelock and veto state for stETH holders.

Source: Lido Governance Forum

When a vote conflicts with stETH holders, they can lock their tokens in an escrow smart contract. This contract activates the LDO governance veto state in which only stETH holders can vote. Those who lock their stETH gain veto power over anti-veto voting, which approves a proposal for execution or blocks it forever if it fails. In contrast to the current voting mechanic that requires users to have LDO before voting begins, anyone can acquire stETH, lock it in escrow, and participate in an anti-veto vote after voting has begun. As a result, no restrictions can be placed on obtaining veto power.

In order for LDO governance to revert to its normal state of voting by LDO holders, users must withdraw their stETH from the escrow smart contract.

Dual governance improves the current voting system as follows:

1. Introducing Timelock:  Lido’s Aragon voting has no timelock for execution. An Aragon vote can get executed instantly if the vote passes before the voting period ends. Therefore, in the case of a governance capture, a last-minute intervention like Compound Governor Bravo, which queues votes in a 48 hours Timelock before execution, is difficult. The intervention would be difficult even after considering a last-minute mitigation via its main phase (48 hours when voters can vote for or against the proposal) and objection phase (24 hours when voters can only vote against or switch their for votes to against). Audius governance fell victim to this missing piece barely 24 hours after the governance note on the failed Yam governance attack. For good measure, Easy Track has a multi-sig that can respond in case of an emergency.
2. stETH intervention for conflict resolution: The new veto state allows stETH holders not only to intervene and reconcile conflicts of interests but also to serve as a more potent timelock that protects the protocol from an LDO governance attack.
3. Trust for Lido Scaling: Since stETH holders have the final say on what upgrades get executed to the Ethereum liquid staking protocol code and the node operators’ registry, this design will allow Lido to scale its operations. It also ameliorates the current system concerns, resolving the associated risks with Lido’s growing power on Ethereum without limiting the protocol’s growth.
4. Address LDO governance centralization concerns: stETH holders can serve as the last line of defense opposing the centralization of LDO distribution. Recently, LDO governance centralization was a major concern. A single wallet address holding 15 million LDO tokens attempted to swing Lido’s Treasury Diversification #2 vote to sell LDO tokens to Dragonfly with no lockup at a market discount. Notably, 85% of the voting result was determined by five wallets holding 55 million LDO tokens.

Source: Dune dashboard

Source: Dune dashboard

While protocols like Aave, Curve, Lido, and FTX exchange hold the bulk of stETH, the token would have a more equal voting power distribution if Lido entered a veto state where stETH holders vote. In addressing the question of LDO and stETH holders’ overlap,  Lido’s Lead Smart contract developer Sam Kozin and the proposal’s lead author argue that stETH has a more diverse distribution of holders. Thus, the reputation risk and technical constraint involved in veto voting would dissuade the top protocols from using their omnibus wallets in Lido’s veto votes.

Source: Dune dashboard

Given the stETH held in custody, it is difficult accurately measure stETH’s Gini coefficient to predict its voting power distribution. Still, the capital concentration of LDO resides in fewer wallet addresses, and stETH counteracts it.

Dual Governance Mechanics’ Options

The dual governance proposal presents four options to implement along with the basic dual voting mechanism. Three of these options resolve identified scenarios when the dual governance model is challenged. The scenarios would be less severe if the protocol withdrawal gets enabled since users will be able to redeem ETH by depositing stETH. However, until Ethereum’s Merge becomes complete, Lido cannot allow withdrawals. Hence, addressing these potential blindspots will avoid introducing new attack vectors.

Option 1: Burn rogue LDO after a successful veto

In a situation where LDO governance is captured and stETH holders intervene, it would be impossible for the system to reverse to a normal state since exiting the veto state would effectively hand over the protocol to an attacker. Therefore, the protocol gets stuck in gridlock preventing legitimate votes from executing. The proposal suggests adopting the veCRV mechanic for LDO voting to avoid this situation. Voters must lock their LDO in the Lido protocol for a representative vote escrowed LDO (veLDO), which grants voting power.

By using a veLDO mechanic for the basic voting, after a successful veto, the protocol can burn all LDO tokens in support of a vote that gets vetoed and rejected. Thus, an attacker would lose their LDO after stETH holders intervene and safely return the protocol to its normal state. But in a governance dispute between LDO and stETH holders, this mechanic would primarily affect LDO holders in favor of the proposal and could dissuade governance participants worried about taking a risky position. The proposal also suggests a variation where only a proportional amount of LDO to the stETH veto power gets burned.

One member of the Lido community argued against the LDO burn, pointing out how the design could cause hesitation to participate in governance. The member suggested that a better penalty could be an extended timelock for the locked LDO supporting a proposal that stETH holders reject.

Another suggestion in support of veLDO is that veLDO can enable holders to earn protocol fees and help further decentralize the LDO governance concentration through its emission to lockers. But Vasiliy Shapovalov, Co-Founder of Lido, pointed out that adding functionality to veLDO exacerbates Lido’s Principal-Agent problem by empowering LDO holders rather than stETH holders. Moreover, the DAO can achieve this result without the ve-model by requiring voters to lock LDO into the voting contract.

Dealing with Dual Governance’s Veto Abuse

As long as the escrow contract’s veto threshold remains, the new voting system would be in an adversarial mode under stETH holders’ control and could be abused. This design presents the possibility of governance griefing attack where an attacker holds the governance system hostage by depositing significant stETH in the escrow contract, transferring power from LDO to stETH, and preventing new proposals from passing indefinitely. They can profit from shorting the protocol tokens during the same period as the market reacts while having their stETH untouched until they decide to withdraw. To deter such an attack, prevent a state of gridlock, and enable the protocol to return to a normal state, the proposal suggests the following options:

Option 2: Significant timelock instead of veto

Significant timelock on LDO governance instead of veto means that a governance griefing attack will not be indefinite. Instead, the timelock slows down the governance process until it expires. Although this will make governance recovery possible, it slows down the process if the timelock cannot be halted and an attacker decides to withdraw.

Option 3: Expropriate stETH tokens

When stETH gets deposited in the escrowed contract, the escrowed stETH is prevented from being withdrawn if a stETH voter supports an anti-veto vote that fails or opposes an anti-veto vote that passes. The expropriated stETH will not count towards the veto threshold, so the system eventually reverses to a normal state. At the same time, LDO holders can vote to return the expropriated stETH, allowing negotiation with an adversary. However, an attacker can attempt to bypass this design by escrowing stETH and initiating withdrawal immediately. This would prevent their stETH from expropriation while wreaking havoc during the veto withdrawal delay.

Option 4: Include node operators in governance

The final option under consideration is to include node operators in the governance system as an attempt to improve Lido DAO’s neutrality. The proposed mechanism would require node operators to approve the vetoed state using quadratic weighting based on the staked amount. Rather than simply transitioning to a veto state with the stETH escrow threshold, node operators would become the determinants. The downside of this proposed addition is that it presents more smart contract complexity and risk to the system.

Implications to LDO Governance

Lido's governance scope takes on a new shape with the dual governance design. The design limits how much stETH holders can influence. By introducing a governance scope of dual governance, the proposal balances Lido DAO’s power over its operations with stETH holders’ power over the protocol upgrades.

While LDO as a governance token may be diluted by stETH, the July rally in LDO token price should cause little concern for its holders. There are still questions regarding the scope of dual governance involving the protocol’s other stAssets. Since 97.7% of Lido’s current TVL is on Ethereum, the need for the LDO and stETH dual governance is justified.