What are Polymaths plans for Sudo and Bridge Admins?

Answered

FOB

August 28, 2021 09:58

• 
• 
• 
• 

The Sudo pallet gives the sudo key holder unrestricted ability to call permissioned onchain function. This user can bypass governance and if the key is compromised or the holder acts maliciously has potential to do a lot of damage. Sudo is a centralized vulnerability for the blockchain. I can appreciate why this pallet may be required when launching to avoid Governance for initial tweeks that may be needed but is there a plan by Polymath to relinquish control of the sudo account or remove the Sudo pallet through a runtime upgrade through the governance process (as was done on Polkadot) once the Governance council and committees are established? Similarly the Bridge admin (same key as Sudo on ITN) has unrestricted ability to mint POLYX he can bypass the bridge multisig and even take control of the multisig (he doesn't need to as he already has privileges that allow him to propose bridge transactions. The bridge is planned to be open for "at least 1 year" post mainnet launch. What steps are being take to limit this single point vulnerability during this period. Post the 1+ year period is it planned to remove the bridge pallet through a runtime upgrade to eliminate the ability for new POLYX to be minted? Clarity about these points as we approach mainnet launch would be greatly appreciated.

0

• Official comment

  

  Csaba

  October 04, 2021 14:30

  Hey FOB,

  Thank you for your question.

  Please refer to the answer below:

  --------------------------------------------------------------------------------

  Both the Sudo and Bridge Admin keys are temporary in nature, under the control of the Polymesh Association and meant to be used in exceptional and unforeseeable circumstances as a last resort in order to stabilize the protocol or application, as applicable. It should also be noted that the usage of both the sudo and bridge admin keys are fully transparent on-chain, so can be audited externally by any user or member of the public. Below are additional details for each of two keys.

  Sudo admin key

  During the initial stages of the chain launch the Sudo permission will be controlled by the Polymesh Association and used only to ensure network stability as a last resort. The Sudo key will be rotated to a multisig secured by hardware wallets to ensure good governance and security for this important key. This will be done after the chain launches, but before public onboarding begins. The intention is that the Polymesh Association will revoke access to this key (i.e. by removing the Sudo pallet, or setting the Sudo key to a known unreachable key) within 90 days of the chain launching, assuming the chain is stable by then.

   

  Bridge admin key

  This key allows Polymesh Association to manage the bridge controller multisig, for example rotating the signers of the multisig, and implicitly therefore can arbitrarily mint POLYX on-chain. This key will also be rotated to a multisig secured by hardware wallets to ensure good governance and security after the chain launches, but before the chain is opened up for public onboarding. This key will need to be maintained for the lifetime of the bridge, after which the bridge module will be removed or decommissioned. There isn’t currently a hard deadline for when the bridge will be removed, although Polymath has estimated that it will run for at least one year. The Polymesh Association will determine the eventual sunsetting of the bridge based on current circumstances and data.

  --------------------------------------------------------------------------------

  All the best,

  Polymath Team

Please sign in to leave a comment.