At Reserve, we think decentralized governance is critical to the success of cryptocurrencies and to the broader Web 3.0 movement. Given this, it might come as a surprise to some that we haven’t solved this problem yet. In fact, we think nobody has. All existing decentralized governance models we have come across are fundamentally broken. In this post, we’ll lay out our views on decentralized governance and how we expect this mechanism-design space to evolve.

Top-down systems are generally effective at organizing themselves and acting to promote their self- interest. There’s a reason that startups, the entities facing the strongest form of selection pressure, are almost always centralized. Even “unstructured” models like the Ethereum development community tend towards centralization.

But while centralized structures may be able to function effectively, there are compelling reasons to seek out alternatives: Consolidation of power harms the individual; Single points of failure undermine security; And fewer decision-makers results in the consideration of a shrinking set of preferences.

In a decentralized governing body, a larger coalition of independent agents must reach consensus to sway a vote. This governance architecture incentivizes decision-making that offers the greatest good for the collective, while penalizing strategies that seek to benefit a small set of people without producing real communal value. This is the fundamental tradeoff that leads many to rightly conclude that decentralized governance is essential.

Still, decentralization does not automatically solve the aforementioned problems, and in fact, creates a great deal of complications of its own. Much work is needed to determine the precise mechanisms that will result in a sustainable model for decentralized governance.

The most common approach to the problem of decentralized governance in the blockchain ecosystem falls under the category of Token Voting. The idea is quite simple: Voters who hold more of a token have a larger incentive to vote in the interest of the system than those who hold less, so they should be assigned greater influence. On its face, this dynamic seems reasonable.

Let’s try applying naive Token Voting to Reserve. (If you’ve never read up on the Reserve protocol, you’re probably gonna have a bad time. Head here for the short version, and here for the longer one. We’ll give a brief overview below regardless).

Overview

In the Reserve protocol, we have three types of tokens:

1. RSV: Reserve, a fully collateralized stablecoin pegged to the dollar.
2. RSR: Reserve Rights, a volatile token that has its supply reduced when the system is doing well, and increased when it needs help.
3. Collateral tokens used to back the Reserve token (tokenized currencies, tokenized government debt, tokenized commodities, etc.)

Holders of the RSR token are those that are most invested in the health of the system, so let’s start with the assumption that RSR is the governance token.

An Attack!

Let’s suppose there are 10B RSV in circulation, backed by $10B in collateral, and that the holders of RSR are able to vote on changes to the economic protocol through a simple majority vote (for the sake of simplicity, let’s ignore the problem of non-voting). Suppose all of the RSR tokens are valued in the market at a rate of $5B.

You may already see the problem: How should we expect selfishly motivated RSR holders to vote on a proposal that decreases the collateralization ratio of the system? Well, if the collateralization ratio decreases, the protocol comes to believe it has more collateral than it needs for the current supply of RSV. It mints additional RSV, which it then puts on auction for RSR holders. RSR holders who purchase this excess RSV are then able to trade it in to the protocol for collateral tokens. They can do this until there is no more collateral left, rendering the original supply of the stablecoin completely unbacked. Since there is $10B in collateral available to steal, this maneuver is profitable for RSR holders to perform as long as they don’t have to spend more than that sum to acquire the RSR tokens. Since the market cap of RSR is $5B in our hypothetical, this is already the case. In fact, as long as the RSR market cap is less than the amount of collateral in the vault, RSR holders’ most direct incentive is to destabilize and exploit the system, rather than protect it.

(In fact, MakerDAO suffers from a related problem: If the MKR market cap falls significantly below the value of the collateral in the system, holders could be incentivized to vote to change the MakerDAO Governance variables in order to benefit from the large amount of collateral in the system. Currently, MakerDAO keeps an eye on this by maintaining an off-chain system for triggering Global Settlement.)

Why is it that naive Token Voting fails and what can we do to fix it? Here are a few ideas that might seem attractive, but are ultimately flawed.

Voting with RSV + RSR

One idea to improve upon the failure scenario we describe above might be to include RSV as a voting token. Perhaps voting should occur with the sum-dollar total of RSV + RSR tokens. Would this work?

Since stablecoin holders want the collateralization ratio to remain high, they will likely vote against any proposal to reduce it. And since there is $10B of RSV but only $5B of RSR, they should be able to overrule selfish RSR holders in an outright vote. Putting aside issues of non-voting, this seems like a pretty good situation.

The problem is that RSR holders can also purchase RSV! If $7.5B of tokens is required to tip the vote, this means that RSR holders only need to purchase an additional $2.5B of RSV. Thus, selfish RSR holders can game the system by purchasing RSV on the open market to finance their attack. Similar to before, when the market cap of RSR is below that of RSV, selfish RSR holders can profit from an attack.

Note: This analysis ignores the complexities of order books and price elasticity, but still illustrates the underlying problem. In reality, it’s likely the increased demand for RSV would result in some amount of minting, so we shouldn’t be taking the RSV supply as constant.

Quadratic Voting

In the examples we have discussed so far, we have considered cases where many RSR holders take an action in their collective interest, but to the detriment of the system, such as lowering the collateralization ratio.

In the next example, we’ll pretend that RSR holders are value-aligned with the system rather than selfishly motivated. That is, we’ll assume most RSR holders care more about the stability of the system than their own profits. These “good” RSR holders find themselves in opposition to a single malicious actor, who is scheming to profit by decreasing the collateralization ratio.

One creative idea to mitigate the threat of a single malicious actor is to use a technique called Quadratic Voting (QV). In QV, we allow holders to purchase votes on a proposal for a cost equal to the square of the number of votes they wish to purchase. So, in order to receive a single vote, someone would have to hold 1 token, while in order to receive two votes someone would have to hold 4 tokens, and so on. Squares grow rapidly, meaning the number of votes the malicious actor would receive could be drastically reduced. Equivalently, we can think of this as assigning influence to an individual equal to the square root of their token balance.

Quadratic Voting is interesting. And to be clear, it’s innovative ideas like these that excite us the most. Unfortunately, QV has its own set of problems.

If I’m the malicious actor, I can cheat QV governance by spreading my tokens out across many private keys. In the worst case, I can open as many accounts as I have tokens and receive no penalty from QV. Instead, the smart contract misperceives the malicious actor’s accounts to be a large number of single actors, failing to distinguish them from the large number of value-aligned actors. Vitalik explains this principle more clearly:

Any mechanism that can help genuinely under-coordinated parties coordinate will, without the right safeguards, also help already coordinated parties (such as many accounts controlled by the same person) over-coordinate, extracting money from the system.

(From On Collusion)

If we combined QV with strong decentralized identity (which is its own challenge), we could achieve a better result. But even then, that type of system is vulnerable to the selling/swapping of votes, and more generally, empowers voter groups that are able to coordinate effectively over those that are not. Due to the mere fact that there are many possible levels of organization, there does not seem to be a one-size-fits-all approach. Every token-voting design makes a tradeoff, and they all have problems.

The key takeaway from this overview is that decentralized governance is extremely difficult. The current systems are fundamentally broken, and each improvement we discover creates a new set of problems. That said, there are some basic principles that we believe will guide and shape the development of a viable decentralized governance system.

• Decentralized identity may be necessary for token voting to be useful, and even then, token voting has significant problems.
• Resources that are easily tradable are likely to be poor indicators of who should have influence/voting power. A good resource is likely one that is costly to acquire and hard to trade.
• We think more robust solutions are likely to involve adaptations of more traditional social technologies such as reputation-scoring. This would require a longer post to justify, but briefly: humans have politicked for ages, and in some sense, we were made to politic. So it wouldn’t be too surprising if the social technologies we instinctively use day-to-day are a part of the answer.

Meanwhile, we continue to follow ongoing experiments in the space with keen interest. Projects like Aragon, MolochDAO, DAOstack, Gnosis, and the various early QV experimenters provide valuable feedback that is important not just for Reserve, but for the success of the entire movement.