Security Council: Vote #1 - Change to Security Model

Sorry for the delay @Joxes and thanks for your patience.

does all upgrades have ALL a 14 delay period or is there a method to execute them immediately for, by example, emergency purposes?

All upgrades have a 14 day delay period. There is a withdrawal pause functionality that may be used by the Foundation in the event of emergency situations. This means that in the case of an emergency bugfix, L2 → L1 messages would be delayed by 14 days as well. We think that this is the right tradeoff to make, because it means that the Security Council cannot unilaterally pass an upgrade which steals assets.

Deleting an output for any reason other than OP Mainnet bugs/invalid outputs is considered a violation of the Law of Chains?

Based on the Law of Chains, deleting or censoring valid outputs on an OP Chain would generally be considered a violation, unless done to address a clear security threat or bug.

Specifically: the Law of Chains states that OP Chain state transitions must follow the rules defined by the OP Stack to uphold state transition validity (Section 3).

OP Chain state transitions, and cross-chain messages sent to or from OP Chains, must only be finalized if they follow the rules defined by the most recent Optimism Governance-approved release of the OP Stack.

It also notes that Chain Servicers censoring or limiting transactions to extract profit or violate User Protections would violate security, uptime and liveness protections (Section 3).

A Chain Servicer that: illegitimately censors, reorders, or limits transactions (e.g., by running off-chain sequencing code that is not approved by Optimism Governance, or by colluding with L1 validators to artificially inflate sequencer batch submission costs) in order to extract a profit or violate User Protections.

Finally, it also states that “Chain Servicers must promptly address emergency bug fixes or other security compromises.”

can the Security Council act in an emergency if the sequencer, batcher or proposer acts maliciously (let’s say, massive censorship that not even governance can operate)?

From the Security Council Charter: “The Security Council is permitted to preemptively address actual or anticipated bugs, defects, unplanned maintenance, or stability, integrity, availability, non-repudiation or other security issues with the OP Stack or any OP Chain." (Emergency Response section)

The Charter also states: “All protocol upgrades, and the specific designation change that removes a sequencer for the sequencer allowlist, are subject to a 14 day delay period before becoming effective.” (Delayed Upgrades section)"

However, the Law of Chains makes clear that enforcement of the Law of Chains is the responsibility of Optimism Governance. In other words, the Security Council’s ability to remove a sequencer should only be used for security-related incidents; more general violations of the Law of Chains should be adjudicated and enforced by Governance, not the Security Council.

What is the method that will be used to check reaction times (also liveness)?

Liveness checks will ensure that signers have access to their keys by extending the Safe contracts added functionality. The exact mechanism is currently under development. :

From the Security Council Charter v0.1: “If the number of signers is reduced below 8, then a safety mechanism is activated which hands control of the Security Council to the Foundation.” What is this mechanism and how does the Foundation intend to enforce it?

This mechanism will be implemented in a new Safe module contract. In the event that the number of signers drops to 7, all signers will be removed and the Foundation will be added as the sole signer.

4 Likes