MIP40c3-SP42: Adding Immunefi Security Core Unit Budget - IS-001

MIP40c3-SP42: Immunefi Security Core Unit Budget - IS-001

Preamble

MIP40c3-SP#: 42
Author(s): @travinimmunefi
Contributors: @psychonaut
Tags: core-unit, cu-si-001, budget, dai-budget
Status: RFC
Date Applied: 2021-10-06
Date Ratified: <yyyy-mm-dd>

Sentence Summary

MIP40c3-SP42 adds the DAI budget for Core Unit IS-001: Immunefi Security.

Paragraph Summary

MIP40c3-SP42 adds the budget for Core Unit IS-001: Immunefi Security. It contains:

  • Total Budget Cap: The hard limit voted on by Governance
  • First-month forecast: The actual first month estimated expenses
  • Regular monthly forecast

Specification

Motivation

Based on the nature of the work done by the Immunefi Security Core Unit, the budget reflects the needs of the team to ensure continuity of the work described in our MIP39c2. This is summarized in, but not limited to:

  • Identification of critical infrastructure and people
  • Initial triaging service for the upcoming bug bounty program
  • Incidence response set up and facilitation
  • Educational content creation around security
  • General security advisory
  • On-call security advisory

Core Unit ID

IS-001

Budget Implementation

The budget is designed with the following in mind:

  • Operational costs to run the core unit and perform its tasks
  • Operational costs of third parties contracted
  • Legal expenses
  • Having a buffer for unexpected legal, technical, or financial problems
    Therefore, a vote to ratify this MIP means MKR holders make a commitment to:
  • Funding an initial 6 month budget for IS-001
  • A continuous funding model based on the SES top-up mechanism

Team Summary

Team members Amount
Facilitator 1
Deputy Facilitator 1
Team Total 2

External Team Summary

Budget Cap Breakdown

Dai Expenditure

We will be asking for a Total Budget Cap spanning a 6-month runway, the amount of which is currently TBD.

The budget cap will differ from the actual expenses of the core unit. The cap refers to the maximum that the core unit can request for operating and it includes room for unforeseen circumstances.

Budget Breakdown

Summary Monthly Cost Quarterly
Facilitator $2 083.33 $6 250+
Deputy Facilitator $10 000 $30 000
Immunefi $10 000 $30 000
ChainSecurity $10 000 $30 000
DeFi Safety $5 000 (one-time) $10 000 (one-time)
Software and Infrastructure Expenses TBD TBD
Company Setup (1st year) $2200 (year) $2200 (year)
Total TBD TBD
+ Contigency Buffer (15%) TBD TBD

Budget Details

Providing additional detail with regards to the above line items:

Facilitator

Though listed as an individual, the compensation will be provided directly to Immunefi, pending MIP41c4-SPXX. All costs are only inclusive of all work done by the Facilitator. The quote provided assumes the maximum amount of hours, on a yearly basis, but has been evenly distributed per month.

Deputy Facilitator

The Deputy Facilitator will work a minimum of 24 hours per week, increasing the number of hours as necessary as well as having a planned increase to a full-time role as the Core Unit progresses. Like the Facilitator, all costs are only inclusive of all work done by the Deputy Facilitator.

Immunefi - https://immunefi.com

In addition to the contributions of the Facilitator, Immunefi will also provide professional services including, but not limited to:

  • Initial triaging of bug reports
  • Content creation
  • Postmortems
  • General ecosystem security content
  • Core unit focused security content
  • Security advisory services
  • Office hours support
  • On-call security advisory
  • Incidence response facilitation support

The provision of Operational Security Services will be covered under a separate budget proposal.

ChainSecurity - https://chainsecurity.com

The company, which provides software audits for the MakerDAO smart contracts, will provide final triaging services for smart contract bug reports as well as provide technical assistance during incident response. The quote provided is the maximum estimated amount required assuming a combination of regular working hours as well as emergency response hours. However, it is not expected that this would be used maximally each month.

DeFi Safety - https://defisafety.com

The company, which provides security scoring for DeFi projects, as well as provides recommendations to projects to increase their security levels, will provide assistance with the identification of critical infrastructure and people and incident response preparedness. The monthly quote provided is a one-time fee for a set amount of hours for general work to be provided by DeFi safety as detailed in the Core Unit proposal which may extend beyond the first month if not consumed. The quarterly amount is including the first month of the set amount of hours purchased but with an additional batch of hours assuming that more will be needed. If more will not be needed, for any reason, it will not be required.

The company’s contribution to the Operational Security Services will be covered under a separate budget proposal.

Software and Infrastructure Expenses

These expenses will include, but will not be strictly limited to, the setup and maintenance of:

  • Secure communications channels for sensitive discussions
  • General communications tools for office hours, general updates, etc.
  • Backups and/or primary hosting for identified critical infrastructure
  • Internal organizational tools

These expenses will also include the provision of a premium testing environment for bug bounty hunters.

Company Setup

Fees include all legal and administrative expenses for the creation and maintenance of the Immunefi Security Core Unit entity as a limited liability company for one year.

Monthly Budget Statement

Within the first 5 days of each month, IS will submit a Monthly Budget Statement to the signers of the Auditors Wallet with the following sections:

  1. Budget Forecast - The amount of Dai that is required to maintain a 3 month operational runway.
  2. Previous Month Actuals - The actual expenses (DAI and MKR) of the month that just ended
  3. MKR Vesting Overview - a schedule of the expected MKR vesting amounts for the current team configuration, grouped by the pay-out month.
  4. Transaction Amounts
  • The required DAI amount for the Operational Wallet to replenish the 3 month operational runway
  • Any excess DAI amount that will be returned to the Auditors Wallet

Related Documents

1 Like

Can you please provide the Community as to why a Deputy Facilitator cost more than a “Facilitator” and do any of the two also represent a personal interest in ChainSecurity via employment, or equity.

Also, can you please provide a little more colour as to why ChainSecurity will be the recipient of a salary–is that for the services that ChainSecurity as a separate entity provide? And what do you mean by “The Company, which provides software audits for the MakerDAO smart Contracts” are you doing ALL future smart contract audits for all the future components of MakerDAO? And how often do you expect ChainSecurity to play a role ( I think MakerDAO averages around 1 to maybe 2 bugs per quarter). Although a possible compromise can cost a lot more than $30K :sweat_smile:

2 Likes

@TravinImmunefi is a co-founder of Immunefi and will remain in his current leadership position. He envisions spending less than 20% of his time on the Maker Core Unit. In contrast, I work only for the proposed Core Unit and will be responsible for many of the Facilitator functions, approaching full-time.

1 Like

Understood. And you are the Deputy Facilitator, or Facilitator?

I am slated to be the Deputy Facilitator. I think it makes sense for @TravinImmunefi to be the Facilitator, at least for now, because he is the most responsible party and has the broadest view on where the Core Unit should navigate.

1 Like

First, I apologize for my late reply. I had to deal with a health issue towards the end of last week.

ChainSecurity isn’t getting a salary. This is just a consumable amount depending on the amount of hours that they’ll be needed for that month. If they won’t be using any of the hours, then no funds will be sent to them. And yes, they will be contracted.

With the sentence that you bolded, I meant that ChainSecurity has been doing audits for MakerDAO in the past. The Immunefi Security CU itself will not be doing audits, though audits and penetration testing may be recommended to other CUs in the course of our operations.

With regards to our expectations of ChainSecurity playing a role, we are working on a very rough estimate right now, as the bugs themselves are also quite varied. Some bugs are extremely obvious and don’t even require a Proof of Concept. So ChainSecurity would likely not need to spend much time with it. Additionally, they will be called in to provide assistance with regards to any incidence response that will be needed, and this largely affected that calculation, as definitely more hours will be needed if there’s an active attack.

Can you please provide the Community as to why a Deputy Facilitator cost more than a “Facilitator” and do any of the two also represent a personal interest in ChainSecurity via employment, or equity.

Neither of us are employed or hold equity at ChainSecurity.

1 Like

Thanks for submitting this @travinimmunefi and @psychonaut , couple of questions from me,

Firstly, for transparency, PECU currently maintain a retainer with ChainSecurity for contract and security audits. We also manage the preparation of repositories and documentation for auditor interaction (as it relates to PECU). In prior discussion with SES, we determined the ChainSecurity retainer to be for all technical Maker initiatives and that priority would be given to urgent issues so we would not be fighting over a limit auditing resource.

Am I therefore correct to assume that the ChainSecurity $10k would help fund the rolling retainer and the overall triaging of issues from other teams (not just PECU)? If it doesn’t contribute to the retainer already in place, I’m not sure exactly how it fits in, but let me know if I’m missing something.

1 Like

In terms of tangible deliverables what does this aspect cover? It makes it less transparent to see the full of expense of the CU MIP39c2-SP24.

Final point, there was prior talk of a TechOps Core Unit taking ownership of what you have listed under software and Infrastructure Expenses (Secure comms, hosting/backup tools, comms and organization tools).

I get it that this core unit is focussing on comm channels in the event of a critical failure, but has there been thought towards leveraging hardware/tech from the exMaker TechOps team. Not sure if this is what you had in mind already?

1 Like