EIP-?: Zodiac - A composable design philosophy for DAOs

This is a long overdue post to discuss the Zodiac standard as an EIP.
You can keep track of this EIP’s progress at PR #5005 in the EIP repo.


eip: <to be assigned>
title: Zodiac
description: A composable design philosophy for DAOs.
author: Auryn Macmillan (@auryn-macmillan), Kei Kreutler (@keikreutler)
discussions-to: https://gnosisguild.mirror.xyz/OuhG5s2X5uSVBx1EK4tKPhnUc91Wh9YM0fwSnC8UNcg
status: Draft
type: Standards Track
category (*only required for Standards Track): ERC
created: 2022-04-14
requires (*optional): ERC-165

Abstract

Zodiac is a philosophy and open standard for composable and interoperable DAO tooling. The key insight is that by separating account (thing that holds tokens, controls systems, and is referenced by others) from the logic that controls it, and making the account agnostic to the logic that controls it, we can create a DAO ecosystem that is much more composable and interoperable, along with being compatible with the vast majority of existing DAO tooling. In short, Zodiac encourages DAOs to use an “avatar” contract (like the Gnosis Safe) as their account, and to then control that avatar with just about any combination of DAO tools and frameworks (Aragon, Colony, Compound/OZ Governor, DAOStack, Moloch, Orca, Tribute, etc).

Motivation

Currently, most DAO tools and frameworks are built as somewhat monolithic systems. Wherein account and control logic are coupled, either in the same contract or in a tightly bound system of contracts. This needlessly inhibits the future flexibility of organizations using these tools and encourages platform lock-in via extraordinarily high switching costs.

By using the Zodiac standard to decouple account and control logic, organizations are able to:

  1. Enable flexible, module-based control of programmable accounts
  2. Easily switch between frameworks without unnecessary overhead.
  3. Enable multiple control mechanism in parallel.
  4. Enable cross-chain / cross-layer governance.
  5. Progressively decentralize their governance as their project and community matures.

Specification

The key words “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”, “SHOULD NOT”, “RECOMMENDED”, “MAY”, and “OPTIONAL” in this document are to be interpreted as described in RFC 2119.

The Zodiac standard consists of four key concepts Avatars, Modules, Modifiers, and Guards:

  1. Avatars are programmable Ethereum accounts, like the Gnosis Safe. Avatars are the address that holds balances, owns systems, executes transaction, is referenced externally, and ultimately represents your DAO. Avatars MUST expose the IAvatar interface.
  2. Modules are contracts enabled by an Avatar that implement some control logic.
  3. Modifiers are contracts that sit between Modules and Avatars to modify the Module’s behavior. For example, they might enforce a delay on all functions a Module attempts to execute or limit the scope of transactions that can be initiated by the module. Modifiers MUST expose the IAvatar interface.
  4. Guards are contracts that can be enabled on Modules or Modifiers and implement pre- or post-checks on each transaction that the Module or Modifier they are enabled on executes. This allows Avatars to do things like limit the scope of addresses and functions that a Module or Modifier can call or ensure a certain state is never changed by a Module or Modifier. Guards should expose the IGuard interface. Modules, Modifiers, and Avatars that wish to be guardable MUST inherit Guardable, MUST call checkTransaction() before triggering execution on their target, and MUST call checkAfterExecution() after execution is complete.
/// @title Zodiac Avatar - A contract that manages modules that can execute transactions via this contract.

pragma solidity >=0.7.0 <0.9.0;

import "@gnosis.pm/safe-contracts/contracts/common/Enum.sol";


interface IAvatar {
    /// @dev Enables a module on the avatar.
    /// @notice Can only be called by the avatar.
    /// @notice Modules should be stored as a linked list.
    /// @notice Must emit EnabledModule(address module) if successful.
    /// @param module Module to be enabled.
    function enableModule(address module) external;

    /// @dev Disables a module on the avatar.
    /// @notice Can only be called by the avatar.
    /// @notice Must emit DisabledModule(address module) if successful.
    /// @param prevModule Address that pointed to the module to be removed in the linked list
    /// @param module Module to be removed.
    function disableModule(address prevModule, address module) external;

    /// @dev Allows a Module to execute a transaction.
    /// @notice Can only be called by an enabled module.
    /// @notice Must emit ExecutionFromModuleSuccess(address module) if successful.
    /// @notice Must emit ExecutionFromModuleFailure(address module) if unsuccessful.
    /// @param to Destination address of module transaction.
    /// @param value Ether value of module transaction.
    /// @param data Data payload of module transaction.
    /// @param operation Operation type of module transaction: 0 == call, 1 == delegate call.
    function execTransactionFromModule(
        address to,
        uint256 value,
        bytes memory data,
        Enum.Operation operation
    ) external returns (bool success);

    /// @dev Allows a Module to execute a transaction and return data
    /// @notice Can only be called by an enabled module.
    /// @notice Must emit ExecutionFromModuleSuccess(address module) if successful.
    /// @notice Must emit ExecutionFromModuleFailure(address module) if unsuccessful.
    /// @param to Destination address of module transaction.
    /// @param value Ether value of module transaction.
    /// @param data Data payload of module transaction.
    /// @param operation Operation type of module transaction: 0 == call, 1 == delegate call.
    function execTransactionFromModuleReturnData(
        address to,
        uint256 value,
        bytes memory data,
        Enum.Operation operation
    ) external returns (bool success, bytes memory returnData);

    /// @dev Returns if an module is enabled
    /// @return True if the module is enabled
    function isModuleEnabled(address module) external view returns (bool);

    /// @dev Returns array of modules.
    /// @param start Start of the page.
    /// @param pageSize Maximum number of modules that should be returned.
    /// @return array Array of modules.
    /// @return next Start of the next page.
    function getModulesPaginated(address start, uint256 pageSize)
        external
        view
        returns (address[] memory array, address next);
}
pragma solidity >=0.7.0 <0.9.0;

import "@gnosis.pm/safe-contracts/contracts/common/Enum.sol";

interface IGuard {
    function checkTransaction(
        address to,
        uint256 value,
        bytes memory data,
        Enum.Operation operation,
        uint256 safeTxGas,
        uint256 baseGas,
        uint256 gasPrice,
        address gasToken,
        address payable refundReceiver,
        bytes memory signatures,
        address msgSender
    ) external;

    function checkAfterExecution(bytes32 txHash, bool success) external;
}

pragma solidity >=0.7.0 <0.9.0;

import "@gnosis.pm/safe-contracts/contracts/common/Enum.sol";
import "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
import "./BaseGuard.sol";

/// @title Guardable - A contract that manages fallback calls made to this contract
contract Guardable is OwnableUpgradeable {
    address public guard;

    event ChangedGuard(address guard);

    /// `guard_` does not implement IERC165.
    error NotIERC165Compliant(address guard_);

    /// @dev Set a guard that checks transactions before execution.
    /// @param _guard The address of the guard to be used or the 0 address to disable the guard.
    function setGuard(address _guard) external onlyOwner {
        if (_guard != address(0)) {
            if (!BaseGuard(_guard).supportsInterface(type(IGuard).interfaceId))
                revert NotIERC165Compliant(_guard);
        }
        guard = _guard;
        emit ChangedGuard(guard);
    }

    function getGuard() external view returns (address _guard) {
        return guard;
    }
}

Rationale

In designing the Zodiac standard, we inevitably needed to define a standard interface for modular programmable accounts (avatars). Rather than writing this from scratch, we elected to use the existing interfaces from the Gnosis Safe’s Module Manager and from the Gnosis Safe’s Guard Manager, since the Gnosis Safe is by far the most widely used programmable account for DAOs, other organizations, and individuals.

Backwards Compatibility

No backward compatibility issues are introduced by this standard.

Security Considerations

Zodiac primarily leverages the existing ModuleManager interface from the Gnosis Safe, which has been in running securely in production for several years. That said, there are some considerations that module developers and users should take into account.

  1. Modules have unilateral control: Modules have unilateral control over any avatar on which they are enabled, so any module implementation should be treated as security critical and users should be vary cautious about enabling new modules. ONLY ENABLE MODULES THAT YOU TRUST WITH THE FULL VALUE OF THE AVATAR.
  2. Race conditions: A given avatar may have any number of modules enabled, each with unilateral control over the safe. In such cases, there may be race conditions between different modules (and other control mechanisms, like the multisig mechanism on a Gnosis Safe).
  3. Don’t brick your avatar: Be warned, there are no safe guards to stop you adding or removing modules. If you remove all of the modules that let you control an avatar, the avatar will cease to function and all funds will be stuck.

Copyright

Copyright and related rights waived via CC0.

5 Likes

What makes me uneasy about reading this EIP is that much for the terminology isn’t borrowed from past EIPs but that it is rather copied from Gnosis software and other places of the web.

I’d have no problem with this EIP if its language was either self-referentially defined or pointing back to prior EIPs.

I guess here’s a norm: Consider boardind a flight and only downloading ethereum/EIPs. There’s no WIFI, can you understand the document inflight (e.g. reading other EIPs is fine)?

IMO this document wouldn’t pass the test. E.g. what is a “Gnosis Safe,” a “Zodiac?” What is this philosophy?