Reza Arap Oktovian
Polygon, a prominent scaling solution for the Ethereum blockchain, is facing significant criticism regarding the security and centralization of its core smart contract administration. The concerns, primarily voiced by Justin Bons, Founder & CIO of Cyber Capital, center on the Polygon smart contract multisignature (multisig) contract, which reportedly controls an admin key that governs over $5 billion in user funds. Bons alleges that the current security measures are lax, creating a substantial risk of a "hack or exit scam."
The Allegations of Insecurity and Centralization
At the heart of the controversy is the Polygon smart contract multisig contract. According to Bons’s detailed analysis, this contract requires a five-out-of-eight signature threshold to execute critical administrative actions. This structure, he argues, grants undue power to a small group, specifically pointing out that four of the eight signatories are founders of Polygon. This composition, in Bons’s view, means that the Polygon team, through collusion with just one of the four external parties, could potentially gain "complete control over Polygon."
"Polygon in its current state is insecure & centralized!" Bons stated in a widely shared tweet thread on February 12, 2022. "It would only take 5 people to compromise over $5B! 4 of those people are the founders of Poly! This is one of the largest hacks or exit scams just waiting to happen. Reckless & irresponsible, a warning to the wise."
The implications of such control are far-reaching. The admin key, as described, holds the power to alter the fundamental rules of the Polygon network. This could, theoretically, enable the draining of all funds held within the Polygon smart contract, a scenario that would devastate users and undermine the trust in the platform. Bons emphasized that the four external parties involved in the multisig are not independent but were selected by Polygon, rendering them "not exactly impartial." This lack of impartiality, coupled with the small number of required signatures, fuels concerns about potential collusion and a lack of robust checks and balances.
This is not the first time Polygon’s operational transparency has come under scrutiny. Chris Blec of DeFi Watch had previously sent a formal request to the Polygon team seeking clarity on their security protocols and governance structure. According to both Bons and Blec, Polygon did not provide a satisfactory response to Blec’s inquiry, further fueling perceptions of opacity.
Polygon’s Response: Acknowledgment and Future Plans
The Polygon team has not remained entirely silent on these recurring questions. Historically, they have published a multisig transparency report in an effort to address such concerns. In a direct response to Bons’s tweet thread, Mihailo Bjelic, co-founder of Polygon, acknowledged the validity of some of the multisig-related worries, stating that the team is "working towards removing them."
Bjelic elaborated in a subsequent tweet thread on February 14, 2022, explaining that multisigs were implemented during an "early phase" of development as a standard security practice for scaling and bridging solutions. "They [multisigs] are considered the optimal approach to secure user funds in the early phases of development and are used by almost every scaling and bridging project," he stated.
He further pointed to the transparency report as evidence of a "plan to improve and eventually remove multisigs." Bjelic aimed to counter the specific claims made by Bons, particularly the notion of an imminent "exit scam." He asserted that an exit scam is "not a realistic concern for Polygon" and that the multisig’s purpose is to protect users from external hacks, not to facilitate internal malfeasance.
Bjelic also addressed the composition of the multisig signatories. Countering Bons’s assertion that Polygon selected the four external parties, Bjelic clarified that these individuals represent "reputable Ethereum/Polygon projects and were not selected by Polygon; they decided to participate." He also defended the chosen multisig threshold, arguing that while it might seem low, increasing the number of signatories could hinder the network’s ability to react swiftly to critical issues. "The more signers, the harder it is to coordinate them in case an immediate reaction is required. We are trying to find the right balance here; we already have more signers than most of the other scaling projects," Bjelic explained.
Broader Implications and Proposed Solutions
The debate surrounding Polygon’s multisig structure highlights a critical tension within the blockchain ecosystem: the balance between development agility and decentralized security. As networks scale and accumulate substantial value, the mechanisms safeguarding those assets come under intense scrutiny.
Justin Bons, in his critique, outlined a clear path forward for Polygon. He advocated for a significant decentralization of governance, shifting control from the current DPoS (Delegated Proof of Stake) model, which he described as having a "low number of validators," to one directly influenced by Matic token holders. Data from Polygonscan, as of the past seven days preceding the article’s original publication, indicated that only four validators were responsible for mining a majority of blocks, underscoring Bons’s centralization concerns.
The proposed solution involves transferring the smart contract admin key to the Matic token holders, effectively creating a "Matic DAO" (Decentralized Autonomous Organization). Bons acknowledged that this would be a complex and costly undertaking, likely requiring a migration to a new Polygon smart contract. However, he posited it as an essential step for achieving true decentralization and security, which he views as the foundational principles of cryptocurrency. "This would obviously be very difficult and costly to do. However, that is the price to pay for not doing things right, to begin with. It is the price we pay for decentralization and the security that comes along with that. This is what cryptocurrency should be all about," Bons tweeted.
Mihailo Bjelic, in his response, confirmed that this decentralized governance model is indeed the long-term goal for Polygon, as outlined in their transparency report. However, he cautioned that a fully decentralized governance model might increase reaction times in emergency situations, suggesting a gradual implementation and activation of such changes.
Context and Background: Polygon’s Role in the Ecosystem
Polygon (MATIC) has emerged as a leading alternative for users seeking to conduct transactions with lower fees and higher speeds compared to direct engagement with the Ethereum mainnet (L1). Initially gaining prominence as a "sidechain" to Ethereum, Polygon operates as an Ethereum Virtual Machine (EVM) compatible blockchain with its own set of validator nodes. This architecture allows for seamless integration with the Ethereum ecosystem while offering distinct performance advantages.
Beyond its sidechain functionality, the Polygon team has also made substantial investments in pure Layer-2 scaling technologies. This includes the development of solutions like Miden, which leverages zk-STARKs (Zero-Knowledge Scalable Transparent ARguments of Knowledge) for enhanced scalability and privacy. This dual approach underscores Polygon’s ambition to be a comprehensive scaling platform for Ethereum.
The sheer volume of funds transacted and secured on the Polygon network underscores the critical importance of its security infrastructure. With billions of dollars in value flowing through its ecosystem, any perceived weakness in its core security mechanisms can have significant repercussions for its user base and the broader decentralized finance (DeFi) landscape.
Timeline of Events and Key Statements
- February 12, 2022: Justin Bons of Cyber Capital releases a series of tweets detailing his concerns about Polygon’s smart contract security and centralization, specifically referencing the multisig contract and the $5 billion in controlled funds.
- February 12, 2022: Bons reiterates his concerns, stating, "Polygon in its current state is insecure & centralized! It would only take 5 people to compromise over $5B!"
- February 14, 2022: Mihailo Bjelic, co-founder of Polygon, responds to Bons’s allegations with a tweet thread, acknowledging the use of multisigs and the ongoing efforts to remove them.
- February 14, 2022: Bjelic clarifies the role of external multisig participants and argues against the feasibility of an "exit scam" for Polygon.
- Ongoing: Chris Blec of DeFi Watch had previously raised transparency concerns with the Polygon team, reportedly without a satisfactory resolution prior to Bons’s public critique.
Analysis of Implications
The controversy surrounding Polygon’s multisig contract highlights a fundamental challenge in blockchain development: the transition from centralized control during early-stage development to a truly decentralized governance model. While multisigs are a common and effective tool for securing assets in nascent projects, their continued reliance on a small group of individuals, particularly when controlling substantial value, inevitably raises questions of trust and vulnerability.
Bons’s critique, while strong, is rooted in the core tenets of decentralization that underpin the cryptocurrency ethos. The proposal to empower Matic token holders through a DAO structure aligns with the vision of a community-governed network, where decision-making power is distributed among stakeholders.
Polygon’s acknowledgment of these concerns and its stated intention to work towards removing multisigs is a positive step. However, the pace and transparency of this transition will be crucial in rebuilding confidence among its users and the wider crypto community. The success of Polygon, and indeed many other scaling solutions, hinges on its ability to demonstrate robust security and a clear commitment to decentralization as it matures.
The network’s continued growth and adoption, despite these criticisms, suggest a degree of user confidence in its underlying technology and long-term vision. However, addressing these security and governance concerns proactively and transparently will be paramount for Polygon to solidify its position as a secure and reliable foundation for the decentralized future.
CryptoSlate reached out to Polygon for further comment but had not received a response at the time of publication. Some quotes have been edited for clarity and conciseness.
