# \[BIP-748\] Permissions Policy Update Request #5 (ETH Mainnet)

**URL:** <https://forum.balancer.fi/t/bip-748-permissions-policy-update-request-5-eth-mainnet/6129>\
**Category:** Karpatkey Updates\
**Created:** [October 21, 2024, 6:29pm UTC](https://forum.balancer.fi/t/bip-748-permissions-policy-update-request-5-eth-mainnet/6129 "2024-10-21T18:29:48Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![kpk](https://yyz1.discourse-cdn.com/flex027/user_avatar/forum.balancer.fi/kpk/32/3793_2.png) [@kpk](https://forum.balancer.fi/u/kpk)\
**Post date:** [October 21, 2024, 6:29pm UTC](https://forum.balancer.fi/t/bip-748-permissions-policy-update-request-5-eth-mainnet/6129/1 "2024-10-21T18:29:48Z")

</div>

### PR with payload

> <https://github.com/BalancerMaxis/multisig-ops/pull/1601>
>
> Permissions page: https://roles.gnosisguild.org/permissions/eth/NfctZijIdCdch4Wv…jsp4OPQHuFbclUBGqULuE8bI
> Permissions diff page: https://roles.gnosisguild.org/eth:0x13c61a25DB73e7a94a244bD2205aDba8b4a60F4a/roles/MANAGER/diff/NfctZijIdCdch4Wvjsp4OPQHuFbclUBGqULuE8bI
> @gosuto-inzasheru The easiest way to compare the original PUR policy you already reviewed and the new one is by checking the diff of the diffs:
> \[https://roles.gnosisguild.org/permissions/eth/6WhgTGie6QoelTwqaE6z8h0MqZa6UOkyZcwJif5si\[…\]NfctZijIdCdch4Wvjsp4OPQHuFbclUBGqULuE8bI?annotations=false\](https://roles.gnosisguild.org/permissions/eth/6WhgTGie6QoelTwqaE6z8h0MqZa6UOkyZcwJif5sig/diff/NfctZijIdCdch4Wvjsp4OPQHuFbclUBGqULuE8bI?annotations=false)
> 
> I also added the approval for sGYD we didn't include in the GYD \[Proposal\](https://forum.balancer.fi/t/bip-714-allocate-250-000-usdt-to-sgyd/6038)

# Abstract

This proposal seeks BalancerDAO’s approval for updates, new actions, and strategies related to the permissions policy governing the [karpatkey-managed treasury](https://app.safe.global/home?safe=eth:0x0efccbb9e2c09ea29551879bd9da32362b32fc89) on Mainnet. These changes are part of a broader effort to optimise the treasury, with the goal of enhancing its performance, flexibility, and diversification.

The proposed new permissions focus on strategies involving [Aave’s GHO](https://aave.com/gho), [Sky’s USDS](https://sky.money/), [Origin’s oETH](https://www.originprotocol.com/oeth), and [Stakewise’s osETH](https://www.stakewise.io/).

# Motivation

Effective treasury management strategies need to be adjusted based on market conditions and protocol updates, such as migrations and the introduction of new pools. Protocols and pools that were once considered immature and unsuitable for the BalancerDAO’s risk appetite can become more viable as they prove their reliability over time. This proposal aims to integrate these new strategies into the existing [Permissions Policy](https://roles.gnosisguild.org/eth:0x13c61a25DB73e7a94a244bD2205aDba8b4a60F4a/roles/MANAGER).

# Changes to the Permissions Policy

This proposal outlines the following modifications to the permissions policy:

1. GHO Carry Trade

- Deposit, sDAI, USDS, wstETH, osETH and WBTC on Aave v3 and allow it to be used as collateral.
- Borrow GHO
- Stake GHO in the Staking Module on Aave v3
- Claim AAVE rewards
- Claim GHO Merit rewards
- Swap GHO \<\> USDT, USDC, in Balancer.
- Swap stkGHO-GHO in Cow and Maverick

1. Sky’s USDS

- Deposit and Withdraw USDS in Spark
- Swap sUSDS \<\> USDS in Cow
- Swap USDS for Stablecoins in Cow

1. osETH in Stakewise v3

- Stake (and unstake) ETH on Stakewise v3.
  - Through the [Genesis Vault](https://app.stakewise.io/vault/mainnet/0xac0f906e433d58fa868f936e8a43230473652885).

1. oETH in Origin

- Mint oETH in vault
- Redeem WETH via ARM and vault
- Swap oETH for ETH and LSTs (same policy as with other LSTs) in Cow
- Back up swap permissions in Curve
- Provide liquidity in oETH-ETH pool in Curve
- Stake LP token in Curve and Convex
- Claim rewards, unstake and withdraw oETH-ETH in Curve and Convex.

# Zodiac Roles Modifier Permissions Policy

## Permissions page:

[https://roles.gnosisguild.org/permissions/eth/6WhgTGie6QoelTwqaE6z8h0MqZa6UOkyZcwJif5sig](https://roles.gnosisguild.org/permissions/eth/6WhgTGie6QoelTwqaE6z8h0MqZa6UOkyZcwJif5sig)

## Permissions diff page:

[https://roles.gnosisguild.org/eth:0x13c61a25DB73e7a94a244bD2205aDba8b4a60F4a/roles/MANAGER/diff/6WhgTGie6QoelTwqaE6z8h0MqZa6UOkyZcwJif5sig](https://roles.gnosisguild.org/eth:0x13c61a25DB73e7a94a244bD2205aDba8b4a60F4a/roles/MANAGER/diff/6WhgTGie6QoelTwqaE6z8h0MqZa6UOkyZcwJif5sig)

---

<div class="post-metadata">

**Author:** ![gosuto](https://yyz1.discourse-cdn.com/flex027/user_avatar/forum.balancer.fi/gosuto/32/2014_2.png) [@gosuto](https://forum.balancer.fi/u/gosuto)\
**Post date:** [November 21, 2024, 4:31am UTC](https://forum.balancer.fi/t/bip-748-permissions-policy-update-request-5-eth-mainnet/6129/2 "2024-11-21T04:31:30Z")

</div>

# review summary

### permissions added:

- stkgho
  - approve(maverick\_router\_v2)
  - approve(cow\_relayer)
  - redeem(AVATAR)
  - cooldown()
  - claimRewards(AVATAR,\*)
  - stake(AVATAR, \*)

- wbtc.approve(aave\_pool\_v3)
- cow\_order\_signer
  - signOrder:
    - stkgho, gho → stkgho, gho
    - usds → dai, usdc, susds, usdt
    - oeth → wsteth, reth, steth, weth, eth
    - gho, dai, sdai, usdc, usdt, gyd → gho, dai, sdai, usdc, usdt, gyd
    - always with AVATAR as destination and fee \< 200bips

- curve\_gauge\_ethoeth
  - withdraw(\*, \*)
  - getReward(AVATAR, \*)
  - stake(\*)
  - withdrawAndUnwrap(\*, \*)

- oeth\_vault
  - claimWithdrawals(\*)
  - requestWithdrawal(\*)
  - claimWithdrawal(\*)

- angle\_distributor.claim([AVATAR], \*, \*, \*)
- gho.approve
  - stkgho
  - maverick\_router\_v2
  - aave\_pool\_v3
  - balancer\_vault
  - cow\_relayer

- gnosis\_xdai\_bridge
  - relayTokens(AVATAR, \*)
  - executeSignatures:
    - recipient: AVATAR
    - amount: \*
    - txHash: \*
    - contractAddress: gnosis\_xdai\_bridge

- gnosis\_amb\_bridge
  - safeExecuteSignaturesWithGasLimit
    - msgId: 00050000a7823d6f1e31569f51861e345b30c6bebf70ebe7xxxxxxxxxxxxxxxx
    - sender: gnosis\_xdai\_bridge (gno:0xca3e2a662d6dd1703c939c8ace2e268d88ad0951)
    - executor: 0x88ad09518695c6c3712ac10a214be5109a655671
    - dataType: 128
    - chainIds: [100, 1]
    - data: handleNativeTokens(gno, AVATAR, \*)

- curve\_zap
  - deposit\_and\_stake
    - deposit: curve\_pool\_ethoeth
    - lp\_token: curve\_pool\_ethoeth
    - gauge: curve\_gauge\_ethoeth
    - n\_coins: 2
    - coins: [eth, oeth]
    - use\_dynarray: 0

- maverick\_router\_v2
  - inputSingleWithTickLimit(AVATAR, maverick\_pool\_ghostkgho, \*, \*, \*, \*)

- gno.approve(gnosis\_omni\_bridge, \*)
- dai.approve
  - gnosis\_xdai\_bridge
  - sdai
  - dai\_sdai\_migrator

- oeth\_redeemer
  - swapExactTokensForTokens(oeth, eth, \*, \*, AVATAR)

- wsteth.approve(aave\_pool\_v3)
- sdai
  - approve
    - aave\_pool\_v3
    - balancer\_vault
    - cow\_relayer

  - deposit(\*, AVATAR)
  - withdraw(\*, AVATAR, AVATAR)
  - redeem(\*, AVATAR, AVATAR)

- oeth.approve
  - curve\_zap
  - oeth\_redeemer
  - curve\_pool\_ethoeth
  - cow\_relayer

- aave\_pool\_v3
  - repay(gho, \*, \*, AVATAR)
  - setUserUseReserveAsCollateral
    - wbtc
    - wsteth
    - sdai
    - usds
    - oseth

  - supply (AVATAR)
    - wbtc
    - wsteth
    - sdai
    - usds
    - oseth

  - withdraw (AVATAR)
    - wbtc
    - wsteth
    - sdai
    - usds
    - oseth

  - swapBorrowRateMode(gho, \*)
  - borrow(gho, \*, \*, \*, AVATAR)

- gnosis\_omni\_bridge.relayTokens(gno, AVATAR, \*)
- curve\_pool\_ethoeth
  - approve
    - curve\_gauge\_ethoeth
    - convex\_booster

  - add\*liquidity(\*, \*)
  - remove\_liquidity\_one\_coin(\*, \*, \*)
  - exchange(\*, \*, \*, \*)
  - remove\_liquidity(\*, \*)
  - remove\_liquidity\_imbalance(\*, \*)

- oeth\_zapper.deposit(\*)
- usdc.approve(balancer\_vault)
- susds
  - approve(cow\_relayer)
  - deposit(\*, AVATAR)
  - withdraw(\*, AVATAR, AVATAR)
  - redeem(\*, AVATAR, AVATAR)

- stakewise: genesis vault ([StakeWise | Vault](https://app.stakewise.io/vault/mainnet/0xac0f906e433d58fa868f936e8a43230473652885))
  - burnOsTokens(\*)
  - updateStateAndDeposit(AVATAR, \*, \*, \*)
  - updateState(\*)
  - mintOsTokens(AVATAR, \*, \*)
  - claimExitedAssets(\*, \*, \*)
  - enterExitQueue(\*, AVATAR)
  - deposit(AVATAR, \*)

- balancer\_vault.swap (always with sender and receiver as AVATAR)
  - ghousdcusdt: usdc OR usdt → gho
  - ghousdcusdt: gho → usdc OR usdt
  - sdaigyd: sdai OR gyd → sdai OR gyd
  - sdaigyd(2): sdai OR gyd → sdai OR gyd
  - ghogyd: gho OR gyd → gho OR gyd
  - usdcgyd: usdc OR gyd → usdc OR gyd
  - usdtgyd: usdt OR gyd → usdt OR gyd

- convex\_ethoeth.approve(convex\_gauge\_ethoeth)
- curve\_gauge\_ethoeth
  - withdraw(\*)
  - deposit(\*)
  - claim\_rewards()

- curve\_minter.mint(curve\_gauge\_ethoeth)
- usdt.approve(balancer\_vault)
- usds.approve
  - aave\_pool\_v3
  - susds
  - cow\_relayer
  - dai\_sdai\_migrator

- gyd.approve
  - balancer\_vault
  - cow\_relayer

- sgyd
  - deposit(\*, AVATAR)
  - redeem(\*, AVATAR, AVATAR)

- oseth.approve(aave\_pool\_v3)
- covex\_booster
  - deposit(ethoeth, \*, \*)
  - withdraw(ethoeth, \*)
  - depositAll(ethoeth, \*)

- dai\_sdai\_migrator
  - migrateDAIToSUSDS(AVATAR, \*)
  - downgradeUSDSToDAI(AVATAR, \*)
  - migrateDAIToUSDS(AVATAR, \*)

### permissions that were scoped that now become unscoped

- cow\_order\_signer
  - unsignOrder(\*)

### permissions removed

- uniswap\_nft
  - refundETH()
  - unwrapWETH9()
  - sweepToken()

# notes

- maverick\_pool\_ghostkgho is unverified on etherscan ([Maverick](https://app.mav.xyz/pool/0x9f274d28fedce05153f9c810b8070277eaf8c031?chain=1&f=true), [Address: 0x9f274d28...7eaf8c031 | Etherscan](https://etherscan.io/address/0x9f274d28fedce05153f9c810b8070277eaf8c031#code))
- why scope cow swap orders so granularly? eg why make it explicit that usds should be swappable to dai but not the other way around? i do not see the added value of this
- why scope the tokens for every balancer pool?
- why scope curve minter?
- why remove permissions already granted, such as the uniswap eth methods?
- for the amb bridge; expected value at shift 76 is `0101806401`, which for me translates to:
  - srcChainIdLength: 01 == 1
  - dstChainIdLength: 01 == 1
  - dataType: 80 == 128
  - sourceChainId: 64 == 100
  - destinationChainId: 01 == 1
  - do i understand correctly these are thus payloads to bridge from gnosis chain to mainnet? should it not be the other way around? or is this the claiming of a bridge initiated on the gnosis chain side?

# resources

to be able to continue doing proper reviews, without it costing us too much time, i suggest that going forward the zodiac roles ui is updated to at least have:

- proper decoding for _all_ function selectors
- the option to use an (external) address book for labelling addresses (for example the same way the avatar is labelled as AVATAR). a tooltip or something like that could then show the original hex data

---

<div class="post-metadata">

**Author:** ![kpk](https://yyz1.discourse-cdn.com/flex027/user_avatar/forum.balancer.fi/kpk/32/3793_2.png) [@kpk](https://forum.balancer.fi/u/kpk)\
**Post date:** [November 22, 2024, 6:09pm UTC](https://forum.balancer.fi/t/bip-748-permissions-policy-update-request-5-eth-mainnet/6129/3 "2024-11-22T18:09:34Z")

</div>

Hey @Gosuto !   
  
We greatly appreciate the effort involved in auditing these payloads. We recognise that they are intricate and require substantial time to evaluate thoroughly.

As for your concerns:

1. Unverified Maverick contract on Etherscan.
  1. The deployer of this contract is [aavechan.eth](https://etherscan.io/address/0x329c54289ff5d6b7b7dae13592c6b1eda1543ed4), who are a recognized member of the Aave community. However, we will do our best to reach out to them and have the contract verified.

2. Why scope tokens allowed to swap on CoW and Balancer.  
2. We could remove restrictions on which tokens can be sold or purchased. However, this approach ensures the DAO has complete certainty that the managed treasury will never be exposed to undesired or illiquid assets.
3. Why scope curve minter?  
3. [oETH / ETH](https://curve.fi/#/ethereum/pools/factory-v2-298/deposit) is the only Curve pool we have allowlisted thus far for the managed treasury. Providing transparency on the actions we, as Asset Managers, are authorised to execute—and being able to easily identify the available actions for each gauge when more are introduced—is simply a matter of structure.
4. Why remove permissions already granted.  
4. Permissions are removed to streamline the payload, ensuring it reflects only the currently active permissions. As market conditions shift, contracts are upgraded, or the DAO decides to abandon a strategy, permissions are updated accordingly to simplify execution and auditing.  
5. We’ve disabled native ETH deposits in [Uniswap V3 Positions](https://etherscan.io/address/0xc36442b4a4522e871399cd717abdd847ab11fe88) to avoid complications that the Zodiac Pilot was facing, WETH deposits remain available and avoids these issues.
5. You are correct, the [Arbitrary Message Bridge](https://roles.gnosisguild.org/eth:0x13c61a25DB73e7a94a244bD2205aDba8b4a60F4a/roles/MANAGER/diff/6WhgTGie6QoelTwqaE6z8h0MqZa6UOkyZcwJif5sig#right-0x4c36d2919e407f0cc2ee3c993ccf8ac26d9ce64e) (AMB) is indeed a contract that allows receiving assets from Gnosis Chain on Mainnet. As this proposal was launched at the same time as the PUR#6 [[BIP 732](https://forum.balancer.fi/t/bip-732-permissions-policy-update-request-6-gnosis-chain/6130)] we thought it was prudent to add this functionality in both chains. You can read more about AMB contracts [here](https://docs.gnosischain.com/bridges/About%20Token%20Bridges/amb-bridge).

---

<div class="post-metadata">

**Author:** ![gosuto](https://yyz1.discourse-cdn.com/flex027/user_avatar/forum.balancer.fi/gosuto/32/2014_2.png) [@gosuto](https://forum.balancer.fi/u/gosuto)\
**Post date:** [November 24, 2024, 4:44am UTC](https://forum.balancer.fi/t/bip-748-permissions-policy-update-request-5-eth-mainnet/6129/4 "2024-11-24T04:44:07Z")

</div>

wonderful, lets see if that contract can still get verified. the rest of your comments make sense.

any feedback on my proposed changes for the zodiac roles ui?

---

<div class="post-metadata">

**Author:** ![kpk](https://yyz1.discourse-cdn.com/flex027/user_avatar/forum.balancer.fi/kpk/32/3793_2.png) [@kpk](https://forum.balancer.fi/u/kpk)\
**Post date:** [November 25, 2024, 6:20pm UTC](https://forum.balancer.fi/t/bip-748-permissions-policy-update-request-5-eth-mainnet/6129/5 "2024-11-25T18:20:15Z")

</div>

We are collaborating closely with the [Gnosis Guild team](https://www.gnosisguild.org/) to ensure the Roles Modifier is both easy to audit and highly functional. The suggestion to toggle between labelled addresses and their original hex data is valuable feedback. However, decoding all function selectors may present technical challenges, especially for new strategies or contracts.

We aim to implement these improvements as quickly as possible and appreciate the suggestions.

---

<div class="post-metadata">

**Author:** ![kpk](https://yyz1.discourse-cdn.com/flex027/user_avatar/forum.balancer.fi/kpk/32/3793_2.png) [@kpk](https://forum.balancer.fi/u/kpk)\
**Post date:** [December 12, 2024, 5:37pm UTC](https://forum.balancer.fi/t/bip-748-permissions-policy-update-request-5-eth-mainnet/6129/6 "2024-12-12T17:37:49Z")

</div>

# UPD: 18.12.2024

We have updated the proposal by removing the Maverick pool from the permissions list. This change was necessary because the Maverick pool contract is not verified, which means we cannot ensure it meets our risk management standards.

The permissions diff page has been updated accordingly, and all related contracts have been removed from the payload.

We are duplicating the updated pages here for your convenience:

- [Permissions Page](https://roles.gnosisguild.org/permissions/eth/NfctZijIdCdch4Wvjsp4OPQHuFbclUBGqULuE8bI)
- [Diff Page](https://roles.gnosisguild.org/eth:0x13c61a25DB73e7a94a244bD2205aDba8b4a60F4a/roles/MANAGER/diff/NfctZijIdCdch4Wvjsp4OPQHuFbclUBGqULuE8bI)
- [Updated PR with payload](https://github.com/BalancerMaxis/multisig-ops/pull/1601)

---

<div class="post-metadata">

**Author:** ![gosuto](https://yyz1.discourse-cdn.com/flex027/user_avatar/forum.balancer.fi/gosuto/32/2014_2.png) [@gosuto](https://forum.balancer.fi/u/gosuto)\
**Post date:** [December 18, 2024, 5:17pm UTC](https://forum.balancer.fi/t/bip-748-permissions-policy-update-request-5-eth-mainnet/6129/7 "2024-12-18T17:17:56Z")

</div>

confirming that the payload was changed to remove the references to the unverified maverick pool; details here: [[BIP-748] Permissions Policy Update Request #5 (Ethereum) by dk57 · Pull Request #1601 · BalancerMaxis/multisig-ops · GitHub](https://github.com/BalancerMaxis/multisig-ops/pull/1601#pullrequestreview-2512312199)

ready for snapshot!

---

<div class="post-metadata">

**Author:** ![Xeonus](https://yyz1.discourse-cdn.com/flex027/user_avatar/forum.balancer.fi/xeonus/32/3621_2.png) [@Xeonus](https://forum.balancer.fi/u/Xeonus)\
**Post date:** [December 18, 2024, 6:17pm UTC](https://forum.balancer.fi/t/bip-748-permissions-policy-update-request-5-eth-mainnet/6129/8 "2024-12-18T18:17:53Z")

</div>

[https://snapshot.box/#/s:balancer.eth/proposal/0x84717624ecb0c5f965252f4d5aef06722bcd607c6867443ccf8b85771f623c41](https://snapshot.box/#/s:balancer.eth/proposal/0x84717624ecb0c5f965252f4d5aef06722bcd607c6867443ccf8b85771f623c41)