Grant request: QRUCIAL_DAO.md

[sixTheDave]

Project Abstract

QRUCIAL DAO is a system for trustless audits, and certification using non-transferable NFTs, exogenous tooling and decentralized Consensus.

To us, it is ironic that web3 and trustless systems are trusting web2 auditors and legacy security companies to protect them from threat actors. This is the reason we want to build a system in which the community and the projects can trust that a security assessment has in fact been done professionally. Too often, security audits of web3 projects are performed in a way that relies on intransparency and blind trust in a company logo instead of a proof of computation as well as a proof that the auditor is knowledgeable of the task at hand. It seems that many auditing companies are not in security, but the PDF business. We want to change this.

For which grant level are you applying?

• Level 1: Up to $10,000, 2 approvals
• Level 2: Up to $50,000, 3 approvals
• Level 3: Unlimited, 5 approvals (for > $100k Web3 Foundation Council approval)

Application Checklist

• The application template has been copied, renamed ( project_name.md) and updated.
• I have read and understood the FAQs, application guidelines and announcement guidelines.
• A BTC, Ethereum (USDT/USDC/DAI) or Polkadot/Kusama (aUSD) address for the payment of the milestones is provided inside the application.
• I have read and acknowledge the terms and conditions.
• The software delivered for this grant will be released under an open-source license specified in the application.
• The initial PR contains only one commit (squash and force-push if needed).
• The grant will only be announced once the first milestone has been accepted.
• I prefer the discussion of this application to be in a private Element/Matrix channel. My username is: @hexff:matrix.org

How Did You Hear About our grants program?

• Social Media
• Hackathon
• Personal Recommendation
• Substrate Builders Program
• Investor/VC
• Online Search
• Other: _______

[CLAassistant]

All committers have signed the CLA.

[Noc2]

Thanks for the application. This sounds really interesting. But could you add a little bit more detailed (technical) information to the proposal. What kind of functions will ExoSys, ExoTool and HackRep support? In general it would be nice to introduce these as part of the proposal. Which programming language are you going to use? Additionally we usually ask teams to add the default deliveries of our template 0a-0d to each milestone. And your last milestone is usually something which we don’t support via grants (part of it can be integrated into the other milestone). In generally we don’t support the deployment of the project, but only the technical development, which is also helpful for others or might reused for other projects.

[sixTheDave]

@Noc2 Thank you for the feedback. We have updated our Grant Request based on your comment and added more details.

[Noc2]

Thanks for the update. I have a few follow-up questions:

• Don’t you need to implement the DAO itself or do you plan to use an existing pallet for this?
• Do you have any mock-ups or designs for the frontend, that you can share?
• My suggestion would also be to remove ExoTool - Slither at this stage and simply focus on the initial Poc for ink!/wasm smart contracts. After you finished the grant, you could for example apply for a soliditiy focused grant here: https://moonbeam.foundation/grants/

[sixTheDave]

Thanks for the update. I have a few follow-up questions:

* Don’t you need to implement the DAO itself or do you plan to use an existing pallet for this?

We plan to use the Governance pallet, similarly as Polkadot does, but tailored to QDAO's needs.

* Do you have any mock-ups or designs for the frontend, that you can share?

At the beginning we use PolkadotJS and later we plan to create a beautiful QDAO interface, based on our current design/colors: https://qrucial.io/

* My suggestion would also be to remove ExoTool - Slither at this stage and simply focus on the initial Poc for ink!/wasm smart contracts. After you finished the grant, you could for example apply for a soliditiy focused grant here: https://moonbeam.foundation/grants/

We seriously considered your suggestion and decided to focus our attention to ink!/wasm smart contract audits. Even though there are not so many tools available for automation here, we can build a core tool based on clippy/cargo-audit.
As a note, the cryptocurrency ecosystem requires EVM support on the long run, but we can do it after the core system is ready. Thank you for the suggestions, I am already in contact with Moonbeam Foundation regarding CCTF and we will also talk about QDAO's EVM extension.

[Noc2]

Thanks for updating the application. I have another follow-up question: The front-end that you deliver as part of this grant, will it be based on the substrate front-end template or is it already the “beautiful QDAO interface”?

[sixTheDave]

Thanks for updating the application. I have another follow-up question: The front-end that you deliver as part of this grant, will it be based on the substrate front-end template or is it already the “beautiful QDAO interface”?

We plan to use the substrate front-end template, but with out own design. Our designer team already prepared the looks, you can find it in the docs of QRUCIAL DAO: https://github.com/Qrucial/QRUCIAL-DAO/blob/main/docs/QRUCIAL%20DAO%20UI.png

[Noc2]

Thanks for the update. I’m happy to mark it as ready for review and share it with the rest of the team. However, I personally find an FTE of 0.7, 2 months and 20k relatively expensive. Would you be willing to reduce the price?

[sixTheDave]

Thanks for the update. I’m happy to mark it as ready for review and share it with the rest of the team. However, I personally find an FTE of 0.7, 2 months and 20k relatively expensive. Would you be willing to reduce the price?

Thank you! We had a talk with our team and we could reduce the price somewhat. What would you consider appropriate?

[ashlink11]

@smilingSix Thank you for applying. I am happy to see the deep technical expertise of your team and trust in your ability to build security tools and substrate pallet, etc.

However, I am skeptical of your business model. Is there truly a supply of independent auditors who would use your product/service? To my knowledge, high-quality Polkadot eco security auditors are extremely scarce and either part of an established security team or successful independent contractors.

I think before building a business marketplace/DAO for independent security engineers, there are more fundamental problems to solve. I am happy to be proven wrong, however, and I would very much appreciate your team working on a valuable grant for w3f. Thank you again for your application!

[Ra33it0]

@cruikshankss thank you for challenging our business model, I am happy to address your concerns and explain you exactly what we are building.
It seems we could have done a better job at explaining our idea and the use cases.
What we are building is NOT a marketplace for independent auditors but a system for trustless and transparent on chain audits.
The auditor pool on this is only a part of our project.

We achieve this by running auditing tools on chain triggered through a blockchain transaction, the output of this security tools is then written into a non-transferable NFT which is bound to the audited smart contract itself.

Let me give you some usecases of who would use our tool.

Be it Independent auditors who want to make sure they get the agreed upon amount of money by a project for the work they have done.

Auditing companies who want to make sure their logo and reputation not used without permission by scam projects.

IT-security professionals who want to make sure they have a reproduceable environment with the right tools in the right configuration on every machine every time.

The community who wants to make sure their favorite project's audit is up-to-date.
Not everyone has the skills to verify that the audit on a project's website is up-to-date and is exactly the smart contract which currently deployed.
Since we bind the audit NFT to the smart contract itself and make it non-transferable it immediately becomes invalid if the smart contract is changed (eg. proxy setup).

Cryptoprojects who want to distinguish between good and bad auditors and showcase honesty and transparency.

The polkasama ecosystem.
The polkasma ecosystem would be the first to have real and trustless on chain security, which would help the security of all projects.

An additional point I want to add is currently we don't have a lot of rust auditors you are right on this, that is why we build our system to not just be compatible to rust/wasm but also to EVM/solidity we are starting out with Wasm though because @Noc2 recommended it to us, we originally wanted to start with EVM.
Regarding the auditor pool, I want to emphasize that we are organizing the CCTF in which cryptohackers solve rust and substrate based challenges. We want to be proactive and have rust/wasm auditors before even more large hacks happen.

[ashlink11]

Hi @Ra33it0,

Thank you very much for your detailed business model explanations.

I want to applaud and thank you for your plans to solve such complicated problems. If I understand correctly, you aim to solve security, identity, payments, deterministic compilation, education, and in general the evolution of smart contracts from (EVM/Solidity to ink!/wasm/Rust).

Firstly, I am glad you have all these ideals. I agree with @Noc2 that idealizing EVM/Solidity audits is likely short-sighted in blockchain evolution since wasm/Rust smart contracts seem to have the only true chance of being sustainably secure and evolvable.

However, I have low confidence in your step-by-step business plan. To even solve the first ideal I listed--security--you'd have to be Layer 0 experts. Layer 0 expertise involves expertise in blockchain engineering, the substrate runtime & pallet engineering, P2P networking, as well as Rust. Furthermore, each of those topics requires additional expertise in various types of complicated mathematics and engineering. I believe your team may have the expertise necessary, but you haven't explicitly convinced me so thus far.

In my opinion, to even considering working on the next ideal--identity--then you must first have solved security, otherwise a DAO & identity is fundamentally vulnerable.

I do agree that deterministic compilation and education could be mutually beneficial to solve in the same project, but those are highly complex problems and I have low confidence in your ability to solve them given the lack of information I have from you about your strategy. The fact that you wish to solve these problems as well as security and identity makes me think you underestimate the complexity of all these projects, which gives me low confidence in your current plan, but I am to help you refine this plan, since I am grateful for your team & I only wish to help. :) And perhaps I just don't have all the info necessary yet, but you've already thought of this. :)

An additional point: I believe the journey to transparent and trustless on-chain audits is a truly noble path, but I believe it takes a great deal of navigation of power dynamics and secrecy, given the discovery and disclosure of vulnerabilities is a very delicate process. What is your strategy regarding this?

To summarize, I applaud you for your idealism and vision, but I advise you provide a much more detailed business plan on which aspects of your project you would work on first. What's the foundation? Perhaps, where can your team be of use to the current Layer 0 efforts towards security? Where do you fit into the ecosystem and the current efforts towards each of the ideals you strive for?

I hope this critical feedback is received with only enthusiasm, because merely having this discussion is educational for me and I'm grateful for the work you've put in towards your application. I believe applications themselves are extremely valuable in the conception of ideals. My highest wish is to help you succeed and build the ideal web 3.0 technology stack together as an ecosystem. Thank you again!

[Noc2]

Sorry for the late reply. How about 30k in total?

[semuelle]

A few follow-up questions from my side as well. But I think my main concern is with auditing companies being interested in signing up for this. The ones I know seem to do well with providing PDFs with audit results to their clients, who in turn publish them as they please. Have you talked to any auditing firms whether they would be willing to use your platform as described?

The use of logos and reputation without permission would only be solved if it was known that the only legitimate Auditor X audit is published through your platform, which not every client might be excited about. They might wish to publish the report after fixing severe vulnerabilities.

Have you thought about making it possible to enable and reward responsible disclosure? It might not always be in the best interest of a project for an auditor to publish vulnerabilities on the spot.

[semuelle]

Can you provide a list of functions/functionalities that will be implemented under this?

[sixTheDave]

• Documentation will include everything needed to configure and run a QDAO node.
• Testing guide will allow the node operators test that all functionalities are working (eg. docker images are executing the requests, API is accessible, QDAO extrinsics succeed, etc)
• The docker images will take commands, arguments from ExoSys. Example: extrinsics call of cargo_audit() -> ExoSys notices the successful tx -> executes Docker -> takes output -> encrypts it -> publishes after delay.
• Docker images are to be provided by QRUCIAL at the start and later the governance will be able to add/remove/modify such images.
• We already put together our core runtime here: https://github.com/Qrucial/QRUCIAL-DAO/blob/main/rust/runtime/src/lib.rs

[semuelle]

Who provides this reputation? How do you prevent people from gaming this system?

[sixTheDave]

We use ELO rating system. At the first stage, CCTF top players and QRUCIAL auditors/contractors are automatically in the auditor pool, then as the project moves on ELO rating should be able to keep the system healthy.
This is experimental at this point. My guess is that we will need some moderators who verify PoC exploits in questionable cases (similarly as Polkadot Council works).

[semuelle]

According to the diagram above, this is part of the QRUCIAL node. Does that mean each request is executed on every node in the network? Or how do you choose which node runs the request?

[sixTheDave]

At this stage, all nodes are expected to run all tools, but on the long run we want to implement a more efficient system where nodes are selected randomly and are incentivized to be honest.
Notably, the docker images provided for automated tests can be run by anyone in the ecosystem and if there is a suspicion, it can be reported and taken care of QDAO governance.

[semuelle]

NFTs aren't mentioned in any of your deliverables. Is this already implemented, or not part of this grant?

[sixTheDave]

NFTs are not implemented yet. In this grant request we want get to the point where QDAO is working as an automated audit provider blockchain where manual auditors can finalize the NFT reports.
This does not include NFT designs, report designs, etc. so we left it out from the deliverables. However the tech/logic is part of the grant request. These NFTs are created on QDAO's chain at this point, later we want to do it cross-chain.

[sixTheDave]

Hello All,

My answer for cruikshankss:
I have to clarify that QDAO at this point does not focus on Layer 0 (though our team members built multiple blockchains from scratch and also audited a few), but static analyzer tools and mainly on smart contracts. We decided to go with rust/WASM because of your recommendations and we are aware that the numbers of capable people are very low in the world this time, but this is something that will likely change in the next years. After getting through our first milestones with QRUCIAL DAO, when the rust/WASM part is ready, it will be easy to implement the solidity/EVM system too. I believe this is not a question how many solidity hackers exist in the world and if they are enough or not. Just the statistics of CCTF show there is enough for us at the beginning.
Responsible disclosure is an interesting topic, but not technical. I saw many kind of practices since I started in infosec, but one of the best s Project Zero's version. Ours will be a very similar one: https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-faq.html
Please note that the policy is not part of the grant request, as this is less of a technical question. The grant request's topologies show our current logic.
Also kindly note that business plans are not to be discussed publicly. We are sure that our major competitors are reading these messages: not just QRUCIAL competatiors, but also other blockchain projects competing with Polkadot/Kusama. If you are interested in talking about it, we are happy to connect.

My answer to everyone in this discussion:
Please note that we chose to request this grant because Parity and W3F members encouraged us to do so, after we told them what we want to build. Otherwise we probably wouldn't even have started, nor spent many hours and nearly 10k to kickstart it from QRUCIAL funds.
We believe in Polkadot's values and want to implement our systems in its ecosystem, using Substrate. This however needs support and we hope to get our early fund from there and not external investors/VCs who are less interested in creating a great ecosystem, but to get some Xs.
I personally believe this is a capable project and proactivity is key for a successful Web3 future. This is the time to be proactive security-wise. I've seen many projects/system who only learned after failing hard. Some of them are not here anymore. A fully transparent auditing system is something in Web3 that surely has future: only question is who will build it and when? We hope to be supported and to be the first one.
We are not requesting this grant for the full ecosystem, but for the core system. We were advised to go with Substrate Builders program too, however this can only happen if we succeed here.

Answer for @Noc2:
We calculated 40k as a minimal cost, but if you agree only with a smaller amount, our enthusiasm might compensate the missing coins and the project can move on.

[Noc2]

Thanks for the update. I still think that 0.7 FTE for 10k per month is really expensive, but I also know that audit companies in this space are insanely expensive at the moment, so I’m willing to go ahead with it.

[laboon]

I discussed this with the Qrucial DAO team at Polkadot Decoded. It seems like a very useful idea for our ecosystem.

[ashlink11]

Thank you for your detailed reply. I am approving this (one approval).

Some Rust/wasm work can be considered part of Layer 0. If in the course of your project, you find it necessary to work on Layer 0, feel free to keep us updated. If you don't find it necessary to work on Layer 0, I see the potential value for your core system in the other layer(s) of course. Thank you again for applying!

[github-actions]

Congratulations and welcome to the Web3 Foundation Grants Program! Please refer to our Milestone Delivery repository for instructions on how to submit milestones and invoices, our FAQ for frequently asked questions and the support section of our README for more ways to find answers to your questions.

Before you start, take a moment to read through our announcement guidelines for all communications related to the grant or make them known to the right person in your organisation. In particular, please don't announce the grant publicly before at least the first milestone of your project has been approved. At that point or shortly before, you can get in touch with us at [email protected] and we'll be happy to collaborate on an announcement about the work you’re doing.

Lastly, please remember to let us know in case you run into any delays or deviate from the deliverables in your application. You can either leave a comment here or directly request to amend your application via PR. We wish you luck with your project! 🚀

[sixTheDave]

Thank you all for approving it and also for challenging us with very helpful questions, recommendations!

We are already in the process of development (20%) and we plan to deliver everything written in milestone 1 by the end of August. After this, milestone 2 is planned to be finished by the end of October.

[Noc2]

Thanks for the update

[sixTheDave]

Hello,
Update: We are working on Milestone 2 and have an addition to the team. Keleti Ildiko is a frontend developer and she is helping us to create the frontend. As we had some delays in December, we plan to deliver this milestone by March.

[keeganquigley]

Thanks for the update @sixTheDave, sounds good. If you think it will be significantly delayed from beginning of March please consider submitting an amendment to extend the timeline. Thanks!

[sixTheDave]

Thanks for the update @sixTheDave, sounds good. If you think it will be significantly delayed from beginning of March please consider submitting an amendment to extend the timeline. Thanks!

Thank you. Our realistic deadline is end of March/April.

Should we submit an "amendment"? Does that mean we should make an update (PR) to the proposal with the deadline?

[keeganquigley]

@sixTheDave exactly yep, you can update the original proposal by creating a PR for us to approve. It's usually relatively easy to get it approved if just changing the timeline. You'll just need the same amount of approvals that was needed originally, although please note that under current levels your grant now falls under level 3, meaning it will need 5 approvals.

[sixTheDave]

@sixTheDave exactly yep, you can update the original proposal by creating a PR for us to approve. It's usually relatively easy to get it approved if just changing the timeline. You'll just need the same amount of approvals that was needed originally, although please note that under current levels your grant now falls under level 3, meaning it will need 5 approvals.

No problem, we send the PR. Thank you for helping us.

[sixTheDave]

@Noc2 @keeganquigley I have created an update about the project, including the final deadline:
#1662

Please review the PR and thank you for your patience.

[sixTheDave]

Hello,

A short update on the state: we are about to send M2 delivery in the next days and preparing now https://qrucial.io/ to host a testnet node. You will be able to see and test the main features of QDAO through the app site.

[sixTheDave]

Hello,

A short update on the state: we are about to send M2 delivery in the next days and preparing now https://qrucial.io/ to host a testnet node. You will be able to see and test the main features of QDAO through the app site.

Testnet is live: https://qrucial.io/

We will make some improvements and send the M2 delivery.

[keeganquigley]

Hi @sixTheDave any updates?

[sixTheDave]

Hi @sixTheDave any updates?

Hi, thank you! We were super busy with our Decoded 2023 participation!

I just sent the PR: w3f/Grant-Milestone-Delivery#899