Phoenix Foundation: Appointment of an Emergency Supervisor

[Rebel_Defi]

It is interesting that people with an axe to grind are hiding behind anon accounts. I have no issue sharing thoughts in public.

Part of the Phoenix Foundation proposal A272 is about the following issue (an issue which the detractors continue to ignore):

Risk Management / Trust: Serious failures in the handling of material ecosystem risks. Written security concerns about Astroport’s dependency on Neutron governance were dismissed days before that risk materialized, potentially exposing about $4.4M of Terra liquidity. Material information concerning Astroport was also held through private communications without being equally shared with other Directors while a fork or takeover was being discussed. The combination of risk judgment, information handling and stepping away during the incident has resulted in a material breakdown of Director-level trust.

The member of PF who should be taking the lead on chain/protocol security, indeed took a $900K grant for these very things - missed an important vulnerability. This is certainly something which I would like to see an Emergency Supervisor investigate fully.

It seems appropriate to remind everyone of the following community pool grant: SCV - Terra Security Expansion Program Proposal.

This was a Terra governance vote on Terra 2 in December 2022, where SCV was awarded $900K worth of LUNA from the Terra community pool. I think it is reasonable to ask SCV (Vini) to address these points:

1. Where is the published security research and vulnerability reports produced under this programme?

2. Has there been an IBC Incedent management report from SCV (regarding the Axelar asset exploit)? What has been the published learnings?

3. Please explain how the $3M loss during the IBC Incident could happen under SCV’s watch?

4. What open-source security tooling has been developed or maintained?

5. Please provide a summary of Terra projects that received the promised free security services.

From the Original SCV proposal:

(A) SCV would continue to disclose vulnerabilities and interact directly with protocols and their security owners to reduce risks and working on remediations when necessary. Researching results would be published in the form of blogs posts write-up or and vulnerability reports content on SCV’s public Github repository.

(B) This proposal aims to increase our reach, particularly in other areas including in-house opensource security tooling, security monitoring of the chain and security research.

(C) That being said, if this proposal passes, SCV would be able to scale its operations at Terra as described above and provide these following services, free of charge, to each live project related to Terra.

Penetration testing on Web and APIs → We would provide continually security assurance and recommendations on dapps and APIs. SCV would cover all public CVE’s and common exploits based on each technology;

APIs/Backend Code Review → We would code review backend implementations and APIs middlewhere integrations to ensure there’s no risks involved. GitHub/Gitlab monitoring → Whenever there’s a wrong commit that exposes sensitive content, leading to a risk to the protocol, owner or user, SCV would be the first to know and report;

Security Assistance (vCISO) → We can help with a security related questions and requirements when prototyping an application or an implementation; We can provide guide along the process to ensure all risks and issues are identified in earlier stages;

CW Contract Checks → While we can’t comprehensive audits contracts on-demand, we are able to assist with small modifications and security sanity-checks specially prior audits.

OSINT → SCV would watch for our open source intelligence flow and act accordingly on each event. These events can be anything with a risk attached to it, ie: password leaks, new sub-domain added, etc.

References:
PF prop A272 - DAO DAO
Original $900K SCV proposal - https://common.xyz/terra/discussion/7889-scv-terra-security-expansion-program-proposal
SCV - Terra Security Expansion Program Proposal - https://analytics.smartstake.io/terra/proposal/3534

[mbaejir]

Just a reminder that participation here is entirely voluntary. Other members are not obligated to reply. Please refrain from repeatedly tagging or prompting individuals for a response. This goes for anyone else here too.

[PhoenixPinion]

I would just like to reiterate Max’s point again. Essentially, there is no real deadlock that causes the BORG to no longer be able to function (and hence require an Emergency Supervisor to intervene). The terms for Adverse Event have unfortunately not been met. Essentially, nothing changed since after A272 except a lost vote which tried to remove a director and change the setup from 3-4 to 2-3 (multiple things at once).

These are the rules of the game. You must first complete level 1 before you can continue to level 2. Level 1 is Adverse Event must be triggered.

[Rebel_Defi]

Are you just looking at the A272 vote? Or do you have anything to say about the issues raised? Quite concerning imo. I’d imagine prop will go on-chain later this week.

[PhoenixPinion]

System.“Adverse Event” means (i) any fraud, gross negligence or violation of law committed by or on behalf of
the BORG, or by or on behalf of BORG Personnel in connection with the BORG’s activities; (ii) any
knowing and intentional material breach of any material term of the Governance Agreements by the
BORG or any BORG Personnel that could reasonably be expected to materially adversely impact the
BORG or the Community (or any part of the Community); (iii) the commission of a felony or any crime
of moral turpitude by any BORG Personnel (whether or not in connection with the BORG or the
Community); (iv) any material legal proceedings by or against the BORG or BORG Personnel in their
capacities as such; or (v) any other change, event, effect, claim, circumstance or matter that is or could
reasonably be expected to become materially adverse to the ability of the BORG or BORG Personnel to
perform or satisfy any of their respective duties, liabilities, or obligations under these Bylaws, including
without limitation any persistent deadlock or dysfunction of any Body or Community Autonomous
System.

We are going by the law so we must make sure we actually follow the law. Only when this is triggered may an Emergency Supervisor be appointed by the Terra Governance system. There is no clear definition of “deadlock” in the papers. This is the only time deadlock appears in the bylaws. You have all simply agreed that we are in the deadlock situation, and I’d say that’s far from true.

[Rebel_Defi]

Still not engaging with the substance of A272.

Not sure why you think chain security vulnerabilities are a good thing.

[MaxP]

272 is not the topic of this discussion, though yes I have actually addressed it quite thoroughly. Please stop repeating this, as you have stated it multiple times.

[rose]

I would like to clarify two things from my perspective.

Adverse Event and Emergency Supervisor

I do not consider the failure of A272, or a disagreement between directors, to constitute an Adverse Event in itself. A failed vote is a legitimate outcome of a governance process, and I remained willing to continue working constructively with the other directors.

However, I recognise that ongoing difficulties from the subsequent events may now warrant independent intervention.

My concern is that if the Adverse Event relates to the functioning of the Board as a whole, the scope of any investigation must reflect that.

The disputed allegations raised in A272 have not been independently assessed, and I do not believe it is productive to debate their merits publicly without access to all the relevant information.

An independent review should be empowered to examine the relevant actions, decisions and responsibilities of any of the four directors, including my own, insofar as they relate to the circumstances under investigation.

This does not mean an open-ended review of every historical Foundation decision. It means ensuring that no relevant conduct is excluded from scrutiny simply because it falls outside the original allegations against one director.

I am not opposed to independent oversight. I want to ensure that any investigation is genuinely impartial, appropriately scoped and focused on identifying a fair, constructive resolution that allows the Foundation to move forward.

Removal and/or Appointment of New Directors

Separately, I also believe the procedures governing the appointment and removal of directors require independent clarification.

The bylaws refer to upgrades to the Stewardship Multisig when electing subsequent directors:

However, they use the defined term System Upgrade in connection with removal.

The definitions suggest that a System Upgrade refers to a blockchain upgrade, rather than an ordinary multisig vote.

This raises a material question about whether an ordinary Stewardship Multisig vote is sufficient to effect a removal under the bylaws. The relevant provisions should be interpreted together with the Articles and applicable governance processes by independent Cayman counsel or the original constitutional drafter.

I also have additional concerns about the proposed temporary 2-of-3 multisig arrangement, should it eventuate. While I appreciate the offer to abstain from ordinary decisions, the exception for onboarding new directors would still allow two directors to potentially approve appointments without the agreement of the third, assuming the applicable governance procedures permit this. Such appointments could have lasting consequences for the Board’s composition.

This is not an objection to appointing new directors, nor a judgement about any potential candidates.

While the bylaws appear to specify the technical mechanism for appointing subsequent directors through upgrades to the Stewardship Multisig, that does not necessarily mean the selection process should be limited to a multisig vote.

Given that the original directors were approved through Terra Governance, my belief is that the community should have an opportunity to participate in selecting their successors. I would like to see open applications, clear selection criteria, appropriate conflict-of-interest disclosures and an opportunity for community discussion before appointments are made.

[Rebel_Defi]

Still waiting to hear from @vini what this $900K Terra Security Expansion Program grant bought Terra. The actual amount paid to SCV/Vini personal wallets for audits on Terra 2 is closer to $1.5M.

There were promises made in the original proposal which afaik have never been delivered. Please correct me if I am wrong.

[vini]

Hi Rebel, I don’t think this request of yours is relevant to what we’re discussing here. SCV isn’t the party being questioned, and A272 doesn’t mention SCV at all. Perhaps you can email SCV with these questions instead?

On your other point: you say you have no issue sharing thoughts in public. Could you please share whether you have any ties to the Foundation or to other protocols on Terra, or any current agreement with either?

[Rebel_Defi]

Posts above question Philipp/Eris. But you say that questioning Vini/SCV is not relevant? I entirely disagree.

Prop A272 has multiple issues that relate to you and SCV (your company).

Governance / Due Process: Failure to follow established governance and conflict-of-interest procedures.

You voted YES on a prop to pay SCV (your own company) money. In fact, the Atrium audit grant was paid to the wallet that created the proposal - your personal wallet.

Risk Management / Trust: Serious failures in the handling of material ecosystem risks. Written security concerns about Astroport’s dependency on Neutron governance were dismissed days before that risk materialized, potentially exposing about $4.4M of Terra liquidity.

SCV is supposed to be providing chain security. But this is happening on your watch. There was also the ~$3M Axelar asset exploit that affected Terra users.

You have conflated SCV and Vini, by paying a PF audit grant to your own wallet instead of SCV. So I think it is entirely legitimate to ask you about deliverables for Terra on the $900K SCV Terra Security Expansion Program grant.

[cryptobull]

@PhoenixPinion , you make one point I take seriously. Deadlock is the trigger here, not a failed vote. A272 failing is not, by itself, an Adverse Event. @rose said the same thing, and she’s right. So let’s not pretend a 2-2 tally on one proposal automatically flips the emergency switch.

But here’s where your own argument turns on you. Look at the full definition. The Bylaws include “any persistent deadlock or dysfunction of any Body” as an Adverse Event. Persistent. Dysfunction. Two words that describe what’s happening now, not just what happened when A272 went down.

You say we all simply agreed we’re in a deadlock, and that’s far from true. Fair. So don’t take my word for it. Take the record. Four directors. Two camps. A 75% threshold. Every proposal touching composition, removal, or replacement runs into the same wall. That is not a one-off vote. That is a recurring pattern. And the Bylaws give us a solution for exactly that pattern.

Here’s the technical fork in the road. You can argue the word “deadlock” needs a tighter definition before anyone acts. That’s a legitimate legal debate. But it’s also a debate that takes time, and in the meantime the Foundation cannot vote its way out of a paper bag. Or you can use the mechanism the rules already provide a temporary, independent supervisor with a four-week mandate to investigate, hear all four directors, and issue a determination. One path stalls. The other moves.

I’m not asking you to surrender the 75% threshold. I’m not asking you to shrink the board to three. I’m not asking you to hand anyone the treasury. The supervisor touches none of that. What the supervisor does is clear the procedural block so the bigger questions, board size, director accountability, the threshold itself, can actually get a vote on a functioning Foundation.

And let’s be honest about what the alternative looks like. @Ex_TFL has laid out a documented trail of unanswered questions about handovers, financial relationships, and onchain voting patterns. @Rebel_Defi has raised the $4.4M Astroport exposure and the $900K security grant that didn’t catch a material vulnerability. Rose has asked for an independent review that covers all four directors, including herself. These are not small things. They are the reason trust broke. You cannot resolve them through another forum thread. You resolve them through an independent process with subpoena-like access to the records.

So yes, passing this proposal is the only way. Not because every objection is wrong. Because every objection leads back to the same room, and that room has no exit without an outside referee. Vote yes. Let the supervisor do the narrow job. Then we argue about thresholds and board sizes with a Foundation that can actually decide something.

[JustATerraUser]

1. Where is Vini? He is barely active in community chats. Echoing @Rebel_Defi’s point: during critical events like the bridge exploit and Astroport risks, we saw zero proactive action until others stepped in to handle the damage.
2. Real skin in the game for Directors: Every director should be required to hold a significant amount of LUNA and actively provide liquidity on-chain, backed by transparent wallet proof. You can’t lead without sharing the downside risk.
3. Supervisor requirements: I support bringing in an emergency supervisor, but they must also hold a significant amount of LUNA—not just parking funds in stable LPs with zero exposure to the chain’s future.

[MaxP]

Show me one case where any project predicted an exploit before it happened, and prevented it.

Vini is actually the most responsive when mentioned out of all people on PD payroll. (in terra main chat, according to a chat export beginning with the creation of the group)
Even ignoring the inaccuracy of that statement, being “active [in chats]” is not a responsibility that is tied to his role.

[vini]

I want to respond to the concerns raised in connection with A272 and clarify my position.

Astroport and Estima

My position was that the Foundation should assess the available options before committing substantial funding to a new DEX. That included comparing maintenance, a fork or a handover of existing infrastructure against new development, including costs, security and long-term maintenance.

I also suggested seeking proposals from other developers and involving Terra governance where the decision had significant implications for the wider ecosystem.

I sought clarification from Astroport’s team about its governance arrangements and received reassurance. My objections to the proposed alternative concerned concentration of control, audit requirements and access to source code.

During the incident, I voted on and executed the Astroport liquidity withdrawal, LA A34.

Before the incident, I had expressed support for the DEX subject to governance, admin-control and source-access safeguards. I subsequently voted for and executed the revised Estima grant, A266.

DeFi and ecosystem development

I support developing DeFi on Terra. My suggestion to get LUNA listed on launchpad platforms alongside meme coins was intended to attract users and trading volume, not to turn Terra into a meme coin.

My concerns about DeFi proposals have focused on oracle reliability, liquidation mechanisms, block capacity, source-code access and concentration of control. Raising those concerns is not opposition to DeFi development.

Grants and funding

I support the Foundation’s mandate to fund ecosystem development. By saying grants should be the exception, I meant approval should not be auto-default approval. Each application needs due diligence, clear deliverables and consideration of alternatives.

The community entrusted PF with assessing and approving funding. I also believe major, long-term commitments may warrant broader community discussion or a Terra governance vote. That does not mean every funding decision needs to go to governance.

Board governance and accountability

Directors should exercise independent judgment and question proposals. Disagreement alone is not misconduct.

I support an independent review of the relevant conduct of all four directors, including my own, using the same standards and giving each an opportunity to present evidence and respond.

I favour stronger independent oversight and adding independent directors while keeping the Board small and effective.

PF should remain accountable to the Terra community. Any governance changes should be transparent and follow the applicable procedures.

[0xPhilipp]

As a PF Director, I can attest that your account omits critical internal information and context.

An independent review with access to the Foundation’s internal records is necessary to verify these statements and establish a complete, unbiased account of the events.

[MaxP]

Honestly at this point, (and if the accused has no issue with it of course) just share it… it’s going to be made public anyway. Why drag it out and further dramatize the process?

---

Edit (to avoid double-commenting): I meant to reply to the comment just above mine originally, but this is in addition to Vini’s comment, and touches on some important and constructive points.

---

Cosmwasm (and therefore Astroport to a large degree) have been covered by a very healthy bug bounty program for many years now, thanks to the Sei team (whether they like it or not).
They have paid out over $10m in bounties, which over the past 2 years or so have tapered off to essentially nothing.

Statistics show the majority of inceidents do not involve very new workers, or very seasoned workers. Overwhelmingly they involve workers who are in a sort of cursed spot in their career, which is around 10,000 hours in their current role, or a very similar role.
For whatever reason this is about the time where people often become “comfortable” in their position, typically having worked until that point wihtout any major incident occurring on their watch.
This is not a fault of that person, it’s a literal trait of being human. It can happen to anyone, in any position, and it happens across all industried.

Having been in the work force for over 30 years, and through multiple experiences incljding my own, (which could very easily have been fatal, had there not been other safety procedures in place), in any serious (damage/loss-causing) incident or near-miss (which the recent astroport which had the potential for a large amount of loss is technically classified as), the person deemed “at fault” for it is almost never removed from their position becasue of it.
They are usually pulled into a formal process where they investigate the hell out of whatever happened, then discuss it openly with the team and anyone else who was involved. Everyone takes part in this process, they all learn and benefit from that person’s experience (instead of by making a similar mistake at some point), and they move on.

If they are let go following an incident, it’s due to a clear inability or the unwillingness to learn from it. If they respect the depth of the situation (and most do), that person is now the ideal person for that position, as they will be extremely vigilant from that point on, doing everything within their power to ensure nothing like that ever happens again.

[mbaejir]

@vini

I sought clarification from Astroport’s team about its governance arrangements and received reassurance

As another director I can confirm that this is not at all the full account and the post either misrepresents or is quite inaccurate.

There are large and serious intractable issues existing.

This is why an Emergency Supervisor has been requested to resolve this with the directors directly.

[Vegas]

At this point, I think it is clear that the Foundation cannot continue operating as it currently does. However, the proposed solution of removing one director and effectively concentrating power in the hands of the remaining two seems far more dangerous, not only for the community but also for the directors themselves.

Regarding Philip’s proposal to appoint an emergency supervisor to help resolve the internal dispute, I agree that, if no better alternative is available, external supervision may be the most practical way forward. However, I would prefer to wait for the response from the permanent supervisor that Rose is in contact with before making a final decision.

If that option is not viable, then I believe an emergency supervisor must be someone demonstrably independent and impartial.

For that reason, I do not believe the directors should have a role in nominating or selecting the supervisor. Given the current dispute, allowing the directors to influence the appointment risks creating a perception of bias, regardless of the individual’s actual intentions.

If emergency supervision is the only realistic way to protect the Foundation and restore confidence in its governance, the appointment process must be beyond reasonable doubt. The position should be opened to independent candidates, either through an open call for applications or through voluntary candidatures, under clearly defined and publicly agreed conditions.

I also think we should acknowledge that much of the information surrounding this dispute is internal and unavailable to the wider community. Therefore, arguing in favour of one individual or against another based on incomplete information is unlikely to help us reach a fair outcome.

For these reasons, I cannot support the current proposal as it stands, given that the proposed supervisor was nominated by the directors involved in the dispute. Unless all directors explicitly agree in writing to the nomination and the proposed appointment process, I believe we need a new proposal.

My suggestion is to establish a transparent process that clearly defines the supervisor’s independence, eligibility criteria, responsibilities, authority, limitations, rights, and expected duration of the appointment. It should also explain how candidates can put themselves forward and how the final appointment will be decided.

The objective should not be to help one side prevail over the other. It should be to protect the Foundation, community,Terra and the directors themselves through a process that everyone can reasonably regard as fair and independent.

Without that transparency, even a well-intentioned appointment risks deepening the existing divisions rather than resolving them.

[0xPhilipp]

Applications were open, and every Director has had since 5 October to propose candidates. No other qualified candidate came forward.

MB and I support Martin for his legal background and non-involvement in general drama. Neither Vini (Phoenix Foundation: Appointment of an Emergency Supervisor - #29 by vini) nor Rose (Phoenix Foundation: Appointment of an Emergency Supervisor - #31 by rose) has ruled him out publicly and are okay with him. Martin will be required to provide an independence declaration with his acceptance.

Requiring unanimous approval creates a veto the Bylaws do not provide. Lets not continue derailing the discussion and prolonging the issue.

The proposal goes to Terra Governance tomorrow. The community decides.