Reza Arap Oktovian
Polygon, a prominent Layer-2 scaling solution for Ethereum, is facing significant scrutiny regarding its security infrastructure and governance model. The network, lauded for its ability to facilitate fast and low-fee transactions, has been accused of employing lax security measures, particularly concerning its smart contract multi-signature (multisig) contract, which controls an administrative key with the power to influence over $5 billion in user funds.
The controversy was ignited by Justin Bons, Founder and CIO of Cyber Capital, who articulated his concerns in a series of tweets on February 12, 2022. Bons posited that the current state of Polygon is "insecure & centralized," highlighting that a mere five individuals could potentially compromise assets exceeding $5 billion. He pointed out that four of these key holders are Polygon founders, raising alarms about the potential for a "hack or exit scam."
The Core of the Controversy: The Polygon Multisig Contract
At the heart of Bons’s critique lies Polygon’s smart contract admin key, which is managed by a five-out-of-eight multisignature contract. This mechanism requires at least five out of eight designated signers to approve any action. However, Bons argues that this configuration grants the Polygon team significant leverage.
"The Polygon smart contract admin key is controlled by a five out of eight multi-signature contract," Bons tweeted. "This means that the Polygon [team] can gain complete control over Polygon with only one of the four outside parties conspiring. The other four parties in the multisig were also selected by Polygon."
Bons elaborated that this arrangement implies the four external parties are not entirely impartial, as they were chosen by Polygon itself. He stressed that control over the admin key equates to the power to alter the network’s rules, opening the door to "anything becoming possible," including the potential emptying of the entire Polygon contract. This assertion suggests a fundamental vulnerability in the network’s design, particularly concerning the safeguarding of user assets.
Allegations of Opacity and Lack of Transparency
Adding to the criticism, Bons and others, including Chris Blec of DeFi Watch, have pointed to an alleged lack of transparency surrounding Polygon’s operations. Blec had previously sent a formal request to the Polygon team seeking clarity on their security and governance practices, a request that, according to both Bons and Blec, went unanswered. This perceived opaqueness exacerbates concerns among users and observers about the decision-making processes and security protocols governing the network.
The history of such inquiries suggests this is not an isolated incident. Critics argue that Polygon has not consistently provided sufficient public information regarding its security measures and administrative controls, leaving room for speculation and distrust.
Polygon’s Response: Acknowledgment and Future Plans
The Polygon team, however, has not remained entirely silent on these recurring questions. Previously, in May 2021, they had published a multisig transparency report aimed at clarifying the matter. In a direct response to Bons’s tweets, Mihailo Bjelic, co-founder of Polygon, acknowledged the validity of some concerns, stating that the team is "working towards removing them" (the multisigs).
Bjelic explained that multisig contracts were implemented during Polygon’s "early phase" of development, describing them as an "optimal approach to secure user funds in the early phases of development and are used by almost every scaling and bridging project." He referenced the transparency report, which outlines a "plan to improve and eventually remove multisigs."
Addressing the "Exit Scam" Concern and Multisig Rationale
Bjelic directly addressed the "exit scam" concern, deeming it "not a realistic concern for Polygon." He asserted that multisigs are primarily intended to protect users from hacks, and Polygon’s current implementation is a responsible measure, contrary to Bons’s accusations.
Bons’s critique argued that a five-out-of-eight multisig is "wholly insufficient" for safeguarding billions of dollars, especially when four of the signers were reportedly "given" to external parties selected by Polygon, potentially creating a risk of collusion.
Countering this, Bjelic clarified that the external parties are "reputable Ethereum/Polygon projects and were not selected by Polygon, they decided to participate." He further explained the delicate balance involved in multisig configurations: "The more signers, the harder it is to coordinate them in case an immediate reaction is required. We are trying to find the right balance here; we already have more signers than most of the other scaling projects."
Proposed Solutions and Decentralization Roadmap
Justin Bons also offered concrete suggestions for Polygon to enhance its security and decentralization. He proposed that Polygon should decentralize its governance structure, transitioning it to be based on MATIC token holders. Currently, the network operates on a Delegated Proof-of-Stake (DPoS) model with a relatively small number of validators. Data from Polygonscan as of February 12, 2022, indicated that only four validators had mined a majority of blocks in the preceding seven days, underscoring the centralized nature of block production.
Bons’s proposed roadmap involved transferring the smart contract admin key to MATIC token holders, effectively establishing a "Matic DAO" (Decentralized Autonomous Organization) that would govern the key. This would likely necessitate a migration to a new Polygon smart contract.
"This would obviously be very difficult and costly to do," Bons acknowledged. "However, that is the price to pay for not doing things right, to begin with. It is the price we pay for decentralization and the security that comes along with that. This is what cryptocurrency should be all about."
Mihailo Bjelic responded positively to this suggestion, stating that it "is definitely our goal, as described in the transparency report. However, this will increase the reaction time in case of a bug, so it will be implemented and activated gradually." This indicates a long-term commitment from Polygon to progressively decentralize its governance and security mechanisms.
Broader Implications for Layer-2 Solutions and the Crypto Ecosystem
The controversy surrounding Polygon’s multisig security and governance highlights a critical ongoing challenge within the broader cryptocurrency ecosystem, particularly for Layer-2 scaling solutions. As these networks grow in value and user base, the responsibility to implement robust and decentralized security measures becomes paramount.
The debate underscores the inherent tension between the need for rapid development and deployment of new technologies and the imperative for rigorous security audits and decentralized control. Early-stage projects often rely on centralized or semi-centralized mechanisms, such as multisigs, to ensure swift decision-making and operational agility. However, as these projects mature and attract substantial capital, the concentration of power within a small group of individuals or entities poses significant risks.
The criticisms leveled against Polygon, while specific to its architecture, resonate with broader concerns about centralization in the blockchain space. The ideal of decentralization, a cornerstone of cryptocurrency, is constantly tested as networks scale and accumulate value. The community’s vigilance in scrutinizing these aspects is crucial for fostering trust and ensuring the long-term viability of blockchain technology.
The Polygon team’s acknowledgment of the need for improvement and their stated commitment to gradual decentralization, as outlined in their transparency report, represent a step in the right direction. However, the effectiveness and timeline of these changes will be closely watched by the community. The ultimate success of Polygon, and indeed many other Layer-2 solutions, will depend on their ability to navigate the complex path from centralized control to a truly decentralized and secure governance model, thereby fulfilling the foundational promises of blockchain technology.
CryptoSlate reached out to Polygon for further comment but received no response by the time of publication. Some quotes were edited for clarity and conciseness to adhere to journalistic standards.
