CIP-210: Formalize Communication Channels to Mitigate Future Hacks

I propose a mandate for the council to propose updates to the CityDAO Charter to formalize rules around where and how certain categories of information are shared related to the DAO, and broadly share that information, to reduce risk of financial loss of citizens.

CityDAO has suffered from two major security events that has led to financial loss of citizens. In both instances, an admin Discord account was compromised which allowed the hacker to phish citizens, steal from their wallets, and silence anyone in the channel trying to stop the attack.

Proposed Solution
I propose that we formalize the channels that certain types of official communication come from, and share that information broadly to all citizens, to mitigate the risk of future attacks.

Specifically, I believe we should formalize rules around communication of any CityDAO activities that require connecting a wallet. This includes airdrops, claims, voting, etc. My proposal is for the council to consider the risk profile of various communication channels, including the forum, Discord, X, and the website, and decide which channels are acceptable to communicate different types of information. As an example, it is clear that Discord should never be used to communicate anything that requires a citizen to connect their wallet, and I expect X to be similar.

After deciding on where and how these types of communications are shared, this should be shared broadly and reinforced. Examples would include statements in the Discord welcome flow, the X profile, etc. warning which types of communication an official communication will and will not come from. To this end, if Discord is compromised again, all citizens should be informed that the messages trying to get them to claim an airdrop could not possibly be valid, as that would be against the charter.

The mandate of this CIP is not specific rules outlined within the CIP, but rather for the Council to deliberate on what specific rules should be proposed, outline them, and propose a follow-up CIP to be voted on with the specific language to be added to the charter. These rules should be proposed not more than 30 days after the passage of this CIP. This follow-on CIP should be automatically brought to a vote if this CIP passes.

The purpose of this is that I believe thinking through the specific solution here should be a collaborative effort, rather than something one person proposes in a forum post.

I am not requesting any funds for this CIP.


Hello! Security in the discord is something that has been on the mind of the council.

Coincidentally, I just had a brief meeting with the folks from webacy, a wallet risk assessment firm. They are about one or two quarters away from beta testing a website/link scanner that could be connected to discord. This may hopefully allow a scoring system to be given with any link posted, giving a visual signal to folks about the status of the link they are about to post.

But with discord suffering it’s second hack, I do believe it is imperative for us to enhance security around it.



I love the idea of using a tool like this, would be great to test and implement.

1 Like

I like this idea, but believe getting it right would take a 24-hour governance sprint by the whole community, not just “Council.” I think the Council should bring the proposed changes to a 24-hour governance sprint. If the governance sprint can only be digital - that is better than no sprint.


Yes I agree that the more people from the community who are involved, the better. I believe it is important this gets done, and quickly. So if the governance sprint happens then it would be a good place for the details to be worked out, but if that effort doesn’t materialize or is delayed, I wouldn’t want these changes to be dependent on that.

1 Like