Hello!
I’ve taken a look at the Aura contracts, not from the point of view of an auditor nor looking for potential issues, but rather to check that:
- there’s a path towards decentralization and moving away from e.g. multisig setups
- there’s no obvious compatiblity issues with potential future requirements we might make of veBAL holders.
As of now, the VoterProxy contract has no controller setup, but my understanding is that said contract would be the Booster contract. None of the privileged accounts seem to be locked in, so any multisigs would be able to yield control to e.g. a voting solution if the Aura team decided to go in that direction.
Regarding compatibility, a concern I had was potential compatibility with on-chain governance the community may want to setup. This would likely be very similar to the Governor approach followed by Compound and many other teams, and now officially supported by the OpenZeppelin Contracts. Aura could work with such a solution if we simply modified the voting code to support EIP1271 signatures (which Aura supports) to delegate votes, a feature already present in this governance model.
With these vague requirements being met, and with the broad goal of being permissive at the beginning to bring actors into the system, perhaps a way to alleviate concerns would be to have an informal agreement where the team commits to moving towards a more decentralized solution by some date in the future.