RFC: Uniswap Universal Governance Module

Proposal Discussion
9

Celer Network community would love to submit a proposal to be considered as a solution for UGM.

A quick introduction to Celer:

Celer is a generalized blockchain interoperability protocol enabling a one-click user experience accessing tokens, DeFi, GameFi, NFTs, governance, and more across multiple chains. Developers can build inter-chain-native dApps using the Celer Inter-chain Message (IM) SDK to gain access to efficient liquidity utilization, coherent application logic, and shared states. There are 10+ cross-chain applications live today that are built with Celer IM on various use cases including governance and liquidity protocols. cBridge, an asset bridging application has processed $9.7b transaction volume across 31 chains for 200K users.

UGM with Celer

A UGM solution that is live in production and ready to use

Celer IM based UGM is already live in production with FutureSwap since the end of April 2022. The reference implementation of UGM is very straightforward and we describe the high level flow here based on the application design pattern.

When a governance decision is made on Ethereum, the governance contract will call sendMessage of a “send box” contract which takes in the destination chain ids, message to be passed and destination contract addresses. The message will contain the serialized bytes of the governance decision.

This message will be synced with State Guardian Network, which is a Cosmos SDK based blockchain. Validators in SGN will witness the message and reach consensus on the Cosmos layer that this message indeeded exists and generate a stake-weighted multisignature attestation that is stored on the chain.

A message executor (can be run by Uniswap or run by validators of Celer Network) will collect this message and call executeMessage of a “receive box” contract. After necessary on-chain validation of the message, the message will be eventually relayed to the destination contract.

The validation, except for the generic checking of the validity of the signatures, also has two security models available to determine when the target contract will receive the message. The first security model is to directly pass the message on and rely fully on PoS security of the Cosmos chain.

However, in the case of low-frequency applications like UGM, we recommend using the second security model: an optimistic rollup-like security model. In this security model, every message that is passed onto the destination chain will be first put into a “quarantine zone” for a configurable period of time. During that quarantine period, every single validator in the SGN and the application executor (collectively, App Guardians) can monitor and cross-check the message arrived on the destination chain vs sent on the source chain. If there is any invariant mismatch, the message path will be cut off immediately and the message will not be executed. This changes the security assumption from “trust majority stake” to “trust any” with app developers capable of running one of the “any” App Guardians themselves. This is how FutureSwap implemented their cross-chain governance module.

Once the quarantine clock times out, the message will be executed by calling a standard interface on the destination governance contract. This will complete the UGM process.

With the complete walkthrough of the application scenario, we now respond more directly to each of the evaluation criteria in the RFP.

Security

As discussed above, Celer’s generalized message cross-chain solution comes with two security models and we recommend using the optimistic rollup solution here. More context on Celer’s security models:

Celer comes with two security models that each app and users are free to choose from on a per-tx basis.

  1. Cosmos-consensus Security Model

By default, inter-chain dApps rely on the security of the State Guardian Network (a Cosmos Chain) by processing messages routed from another chain without delay. The SGN offers L1-blockchain level security just like Cosmos or Polygon with it being a Proof-of-Stake (PoS) blockchain built on Tendermint with CELR as the staking asset. If a guardian acts maliciously, its staked CELR will be slashed by the consensus protocol. This level of economic security is something that grows with the staked CELR’s value and is simply not available in simple Multi-signature or MPC/PoA-based solutions.

  1. Optimistic-rollup-style delay buffer Security Model (for UGM)

1600×706 130 KB

So, what happens if more than two thirds (in staked value) of the validators behave maliciously in the State Guardian Network? Although this is highly unlikely given the economical security and distributed nature of the validators in Celer Network, Celer does have a second security model, inspired by the Optimistic Rollup design, that works securely even under this worst-case scenario.

Instead of instantly processing a message routed by the SGN, a two-phase commit-confirm pattern is used to process any inter-chain message. Before any application consumes the message, the message has to be “committed” to the blockchain by SGN into a “quarantine zone” for a period of time. Only after the delay has passed, can this message be “confirmed” and pushed to the final destination application.

During this delay buffer, a dApp can run an App Guardian service to double-validate the message on the source chain and check the authenticity of the message committed in the quarantine zone. If the App Guardian detects any inconsistency, it can prevent the message from being processed before the time buffer expires. For application developers who cannot run an App Guardian themselves, they can commission the SGN nodes to undertake the task of an App Guardian. In that case, the security model is strengthened to a trust-any model for the SGN. Therefore, even under the worst-case scenario of the SGN consensus failure, inter-chain dApps built on top of Celer’s construct will still maintain safety property without any concern.

Ease of Use

We estimate that the UGM cross-chain governance solution for Uniswap only requires about 150 LoC to implement the necessary smart contracts. We can provide a full reference implementation that is ready for review by the Uniswap community and security auditing firms. Another example of similar complexity is a full-fledged ERC-721 NFT bridge which has only 250 smart contract LoC.

Celer cBridge is already used by multiple developers for different use cases.

Some other examples below:

ChainHop, a composable cross-chain liquidity protocol built on top of Celer Network where users can swap A token on X chain to B token on Y chain with just one click. ChainHop actually integrates Celer Network and Uniswap on all supported chains. You can actually review the source code of ChainHop. This kind of fancy functionality only has less than 1000 loc. Similar use cases are Rubic and Swing.

Celer IM is widely applicable to build inter-chain DeFi applications as well. The decentralized derivatives protocol SynFutures is using Celer’s IM framework to support multi-blockchain futures trading, allowing users to leverage liquidity from any blockchain. Ooki, a powerful and fully decentralized margin trading, borrowing, and lending platform, is leveraging Celer IM to enable fee bridging among all of Ooki’s different blockchain deployments. Aperture, a cross-chain, community-driven marketplace for DeFi strategies, is leveraging Celer IM to enable one-click access to supported strategies for users from any blockchain. Solace, a decentralized insurance protocol that allows users to insure positions for over 180 DeFi protocols with one policy, is also integrating Celer IM for cross-chain insurance functionality. Of course, Celer IM can be used in many other use cases besides DeFi applications. Mystiko Network, the base layer of web3 that provides both connectivity and confidentiality to all blockchain data, transactions and applications, uses Celer IM to enable privacy protection against unwanted cross-chain data tracking and exploits.

Generalizable across all chains and L2s

Celer currently supports EVM-based chains that Uniswap supports or plans to support including Ethereum, Polygon, Arbitrum, and Optimism, Celo, Moonbeam, and Gnosis Chain. In addition, Celer supports some other EVM chains including Astar, BNB Chain, Avalanche, Fantom, Metis, Oasis Emerald, Evmos, Aurora, Moonriver, Boba Network, OKXChain, Heco, Ape Chain, Clover, Conflux, Crab Smart Chain, Kava EVM Co-Chain, Milkomeda Cardano, Nervos Godwoken, Ontology EVM, PlatON, REI Network, SX Network, Shiden and Swimmer Network.

For non-EVM based chains, Celer supports Flow blockchain and Cosmwasm chains such as Terra.

Solana is now on testnet.

Costs (gas)

Celer cBridge is highly efficient in gas consumption and has been optimized to do so. For example, the bridging gas costs between Arbitrum to Ethereum using Celer is about half of the official bridge.

Maintenance

We are happy to provide reference implementation and maintain such implementation in a white-clove service model. There might be some frontend module integration needed that we can closely work with the Uniswap team to complete.

Team & Contractual Details

Celer was initially founded in 2018 by four computer scientists with PhD degrees from MIT, UCBerkley, Princeton and UIUC with tens of years of industrial experience in networking security, operating systems and large-scale distributed systems. Throughout the long (crypto-term) history of Celer, no security incidents or hacks ever happened in any production software built by the Celer community. Overtime, Celer Network has now attracted many excellent community developers and becomes a decentralized community driven project that is focused on cross-chain interoperability.

Celer is a multi-chain operating system. Through Celer IM, developers can build inter-chain dApps using the Celer Inter-chain Message SDK with efficient liquidity utilization, coherent application logic, and shared states across multiple blockchains. Users of Celer-enabled dApps will enjoy the benefits of a diverse multi-blockchain ecosystem with the simplicity of a single-transaction UX from a single chain. Ultimately, the goal is to have developers using the existing Celer technology to abstract the concept of “multiple blockchain” away.

We believe Celer community has one of the best developer support processes through our strong network of community developers.

Finally, we thank Uniswap governance bodies for considering our submission to the RFP and we are also happy to discuss any other collaboration here.

Other Resources on Celer:

1 Like