An update on the Web3 Foundation
On November 8th, immediately following Ethereum conference, Devcon3, a flaw in the library behind Parity’s multi-signature wallet was found and an unknown attacker used this to retire the code on which (among others) the Web3 Foundation’s primary cold wallet storage solution was dependent. While no funds changed ownership in this attack, it leaves the wallet without the necessary code in place to operate and, in particular, transfer funds.
The ramifications for this attack are that 306,276 ETH belonging to the Web3 Foundation is presently blocked within its primary offline multi-signature wallet.
General Finances
As of today, the Web3 Foundation has substantially more than $45m split between fiat and BTC. While a portion of this needs to be set aside for mundane expenses such as accounting and legal, it still leaves a vast sum of funds to be used, first and foremost, for the creation of Polkadot. We are in no doubt that this level of funding will be more than sufficient to build and deliver Polkadot to the original technical vision outlined. As of today, there is no reason to expect any delays or alterations regarding Polkadot development and deployment. Proof-of-concept work began months ago and we expect it to ramp up over the coming weeks.
Furthermore, we are confident that the funds will allow us to not merely develop and deploy Polkadot but to also build out the community and ecosystem using a variety of methods including meet-up events, conferences, hackathons and general publications.
Outside of Polkadot, discretionary spending on the wider Web3 and crypto ecosystem is certainly still possible, but inevitably to a lesser degree than before, since it was here that much of the largesse of our funds was to be deployed. We do consider this spending to be an important part of Web3’s mission and overall useful for Polkadot, but it does not feature within the main ‘product offering’ of Polkadot, and so will inevitably take a secondary place until such a time that we believe the Web3 can afford it.
Should the blocked funds be freed for use, this spending profile would be the primary beneficiary: this includes supporting the R&D of non-core protocols such as Whisper, Swarm and many others in the decentralised ecosystem, peripheral tooling and languages, general academic sponsorship and low-level research of no immediate relevance to Polkadot. We sincerely hope that a change in status of the blocked funds will allow us to support of these projects and directions to the benefit the wider ecosystem.
Technical Solution to Unblocking
An EIP (proposal for a protocol change to improve Ethereum) has been previously submitted by Vitalik Buterin (EIP156 ) outlining one possible solution for unlocking funds that become blocked in an account inaccessible due to a retired contract. This EIP, as it stands, is insufficient for the unblocking of Web3 Foundation’s funds. However, work is underway on technical proposals, in the same generalist vein as EIP156, that would be sufficiently powerful to unblock the Web3 Foundation’s funds. As such, it is our hope that funds can eventually be recovered as part of a wider “win/win” technical improvement to the Ethereum protocol.
The decision to use Parity’s multi-sig wallet
The Web3 Foundation did not take the decision to use Parity Technologies’ multi-sig lightly and, compared to alternatives such as the Ethereum Foundation’s Mist Wallet and third-party alternatives such as the Consensys/Gnosis wallet, it was based upon three points. Firstly support, secondly security and thirdly, cold-wallet integration.
Regarding support, some of the people working on the Polkadot crowdsale were based in Berlin. Though in a different place, Parity is Berlin-based. In-person technical support was not only a general desire, but was utilised on several occasions during the setup of the operations. Forgoing this could have caused very real delays and issues in deployment.
Regarding security, Parity’s wallet had indeed gone through a large-scale security problem only months before. The belief that the software was now secure was based upon the fact that: all core developers of Parity had reviewed the fixed code looking specifically for other problems that may be hiding, that the fixed code had been reviewed by many within the Ethereum security apparatus as part of a general desire to understand the underlying issues and its fix, and finally the fact that several people had even gone so far as to write articles deconstructing the code for the sake of explaining the issue to others. It was our belief that the code couldn’t reasonably harbour a critical bug given this amount of attention. We were wrong.
Regarding cold wallet integration, it was our desire to have all of our signatories use a secure, air-gapped cold wallet. The Parity Wallet solution provided a zero-friction interaction between air-gapped cold-wallet transaction signing for multi-signature transactions. Our field survey concluded that it was the only wallet which provided this feature at this level of accessibility.
Moving forward
Parity will continue to push commits to the initial Polkadot buildout as planned.
We will be examining all options regarding releasing our blocked funds. We understand that this requires the engagement and support of the community. To this end, our conversations will be ongoing. We encourage your questions and feedback.
Riot: https://riot.im/app/#/room/#web3foundation:matrix.org
Twitter: @Web3Foundation
