[BIP-732] Permissions Policy Update Request #6 (Gnosis Chain)

General Chat Karpatkey Updates
1

PR with payload

https://github.com/BalancerMaxis/multisig-ops/pull/1450

Abstract

This proposal seeks BalancerDAO’s approval for updates, new actions, and strategies related to the permissions policy governing the newly launched karpatkey-managed treasury on Gnosis Chain. These changes are part of a broader effort to optimise the DAO’s treasury, with the goal of enhancing its performance, flexibility, and diversification.

The proposed new permissions focus on strategies involving sDAI on Gnosis Chain and new vaults to stake GNO on Stakewise V3.

Motivation

Treasury management strategies must adapt to changing market conditions and protocol updates, including migrations and the launch of new pools. Protocols and pools that were previously deemed too immature or risky for BalancerDAO may become viable as they demonstrate reliability over time. This proposal seeks to incorporate these updated strategies into the current Permissions Policy.

Changes to the Permissions Policy

This proposal outlines the following modifications to the permissions policy:

  1. sDAI on GC
  • Bridge DAI and GNO, Mainnet <> GC, two ways, in Gnosis Bridge.
  • Deposit and withdraw xDAI <> sDAI in Spark.
  • Swap sDAI <> xDAI <> USDC <> USDT in Cow.
  • Swap GNO <> WETH in Cow.
  1. Whitelist new vaults to stake GNO on Stakewise v3

Zodiac Roles Modifier Permissions Policy

Permissions page

https://roles.gnosisguild.org/permissions/gno/6MHFZ0ZgjVykkwQgsdbxy0JvaZS4IWhii7UE8PLT9ME

Permissions diff page

https://roles.gnosisguild.org/gno:0x13c61a25DB73e7a94a244bD2205aDba8b4a60F4a/roles/MANAGER/diff/6MHFZ0ZgjVykkwQgsdbxy0JvaZS4IWhii7UE8PLT9ME

2

review summary

  • cow: sign orders restricted to:
    • sell usdt for sdai
    • sell usdc for sdai
    • sell wxdai for sdai
    • sell sdai for usdt or usdc or xdai
    • sell weth for weth or gno
    • sell gno for weth or gno
  • cow: unsign any order
  • stakewise: axl (StakeWise | Vault)
    • burnOsToken(*)
    • updateState(*)
    • mintOsToken(AVATAR,*,*)
    • deposit(*, AVATAR, *)
    • claimExitedAssets(*)
    • enterExitQueue(*, AVATAR)
  • stakewise: stakesaurus (StakeWise | Vault)
    • idem as axl
  • usdt
    • approve(cow_relayer)
  • weth
    • approve(cow_relayer)
  • xdai bridge
    • relayTokens(AVATAR)
  • gno: approve
    • stakewise axl
    • stakewise stakesaurus
    • stakewise seednode
    • cow_relayer
    • stakewise stakecat
  • gno.transferAndCall(xdai_bridge, *, kpk_managed_msig)
  • stakewise: seednode (StakeWise | Vault)
    • idem as axl
  • sdai.approve
    • cow_relayer
    • sdai_adapter
  • sdai_adapter
    • deposit(*, AVATAR)
    • redeem(*, AVATAR)
    • redeemXDAI(*, AVATAR)
    • depositXDAI(AVATAR)
  • usdc.approve(cow_relayer)
  • stakewise: stakecat (StakeWise | Vault)
    • idem as axl
  • wxdai.approve
    • cow_relayer
    • sdai_adapter

remarks

no write funcs on seednode contract

the seednode vault write functions currently cannot be found on gnosisscan: ERC1967Proxy | Address 0x9eeB6be79899CfE45018866A2113c6b77fa96F35 | GnosisScan

this could have to do with the fact that it is upgradable, although the other stakewise vault do not have this issue. this upgradability potentially also jeopardises the value of scoping these permissions; an upgrade could simply replace the logic. note: no audit or review done from our side on any of the stakewise products

inconsistent cowswap token permutations

it is completely unclear to my why the cowswap token combinations are set up the way they are set up here; eg why sell usdt for sdai but not for gno? why the need to swap gno for gno?

that being said, it is good to see the more flexible unsign permissions (no scoping at all)

3

@gosuto regarding the points you mentioned;

  1. No write funcs on seednode contract.
    Gnosisscan hasn’t automatically indexed the proxy contract. We’ve added it with the general implementation for all Stakewise vaults. So you can now see the write functions to the proxy: ERC1967Proxy | Address 0x9eeb6be79899cfe45018866a2113c6b77fa96f35 | GnosisScan

  2. inconsistent cowswap token permutations
    The goal is to set up preliminary swaps that allow for an efficient exit from a token exposure. This means that if we choose to reduce or eliminate exposure to a token, we can do so quickly and cost-effectively by moving into a similar asset class (sDAI <> Stables & GNO <> WETH). This is also subject to future PUR’s that add swap permissions on top of these ones.

4

wonderful, lets get this to snapshot then!

5

https://snapshot.org/#/balancer.eth/proposal/0x220379d594dfecfc09e64ea8fb9f60d112b91298bb72184f778087d6d6641451