Tribute DAO Community Call #6 #531

fforbeck · 2022-03-22T17:37:10Z

fforbeck
Mar 22, 2022

Audit

We received the audit report from Sigma Prime, and we are currently working on the security fixes.
About 50% of the issues were already fixed. Once all issues get fixed we will schedule a retesting with the Sigma Prime team.
All the issues and including the audit report will be published at end of the audit round.

Ragequit

We will work on a new page on the tribute-ui project to enable the Ragequit operation.
Ragequit is basically the alternative you have to exit the DAO with your money if you decide to do so, for any reason. We currently have the adapter for that, but we still need to create the UI.

Deployer

We also want to build a deployment tool to make it easier to create Tribute DAOs. At the moment you have to run these scripts from the command line, and some people are not familiar with that, and it is error-prone. So the idea is to build out a decentralized app that lets you launch Tribute DAOs from your local environment without relying on a third-party API, or something like that. Of course, you still need to rely on Infura or Alchemy API to interact with the chain and deploy the contracts, but you can easily switch that to your own Ethereum node. The more important is that the DAO setup should be fully decentralized, and very easy. This is something that we will probably be working on after the audit process is finished.

Questions
Does the Tribute DAO framework interact with OpenSea contracts anyhow?

No. At the moment we do not have this integration. This is something that we already mapped out, but it is not part of the framework.

Is Tribute DAO framework SEC compliant?

The Tribute DAO framework is not SEC-compliant by default. It is legally agnostic. We have set up our own investor DAOs as SEC-compliant entities (for example https://reddao.xyz/) and we have also set up a DAO as a not-for-profit (for example https://muse0.xyz/) We advise seeking the advice of a qualified securities attorney.

How can we verify the users without the KYC service?

This is one issue that some community members already flagged, they want to use the KYC onboarding but we do not have it as an open-source project.
The idea is to map out the main features that we need for the Tribute DAO framework and create an API spec, so the community can build and maintain its own KYC API.

Feedback

The Tribute DAO tutorial has some instructions out of order.
Some deployment scripts do not work on Windows machines.
Creating a video tutorial on how to deploy the DAO.
The tutorial was very cool and easy to follow, but the DAO can't be used with the KYC Onboarding because there is no KYC service available for the community.

The KYC Onboarding basically allows the new members to join the DAO only if they were verified.
The verification process is done off-chain, but once the member is verified EIP-712 signature is created in the KYC API, so that signature can be retrieved by the TributeUI dapp, and submitted to the KYC Onboarding adapter when the member attempts to join the DAO.
If the signature is valid, the member will receive the DAO shares and will become a DAO member. If not, the transaction will fail.
Essentially, the signature is created using the address of the member that wants to join the DAO. An example of that can be found here: https://github.com/openlawteam/tribute-contracts/blob/master/test/adapters/kyc-onboarding.test.js#L139
The next step is to write down the spec and share that with the community, so they can build the KYC API and add that to the current DAO setup [@fforbeck].