root

### Summary of JAM Proposal

- **JAM Protocol**: A decentralized, cryptoeconomic protocol proposed as a potential replacement for the Polkadot Relay-chain.
- **CoreJam**: An early version of the JAM protocol, proposed in Polkadot Fellowship RFC-31.
- **Responsibilities**: If approved, Polkadot Fellows would be responsible for ratifying the final JAM protocol, defining tests, and ensuring compatibility with the Polkadot Relay-chain.
- **Deployment**: The Polkadot Relay-chain would halt when the JAM chain and compatibility service are ready, after professional audits.
- **Remark Call**: Approval of the proposal signals community willingness for JAM supervision by the Technical Fellowship, but no on-chain changes will occur.

Executed

Polkadot Fellows propose JAM, a decentralized protocol that could replace Polkadot Relay-chain. The proposal aims to ratify and define conformance and performance tests for the Polkadot JAM Protocol, and develop and deploy a Polkadot-Relay-chain compatibility service on the JAM protocol. The Polkadot Relay-chain should halt when the JAM chain, compatibility service, and required system parachains are ready for launch. The proposal is a remark call, signaling the community's willingness to accept the ratification and supervision of JAM by the Technical Fellowship.

Proposal for JAM Ratification, Conformance, Performance by Polkadot Fellows

Starlay Finance experienced a hacking incident that compromised DOT and LDOT deposits. The hacker stole approximately 200,000 DOT. The exploit was due to an oversight in the USDC pool's liquidity index calculation, allowing the attacker to withdraw more than their initial deposit. The Polkadot community is asked to support transferring the stolen DOT from the hacker's account to Starlay's account.

TimedOut

This is a referendumV2 whose proposer address (14jLVudzMk7udKvBUdFwPpgQnFKPpE4GxAYRJpEpokBgdmKq) is shown in on-chain info below. Only this user can edit this description and the title. If you own this account, login and tell us more about your proposal.

# **Abstract/TLDR**

Following a significant hacking incident compromising Starlay Finance [https://twitter.com/starlay\_fi/status/1755605617421795560](https://twitter.com/starlay_fi/status/1755605617421795560 "Starlay hacking incident"), we are urgently seeking support from the Polkadot community. 

# **Details of the Request**

The gravity of this situation and its potential repercussions on our users and the broader ecosystem necessitate your immediate support. We aim to explore viable measures to transfer all the DOT from the hacker's account to Starlay's account.

-   **Amount at Risk:** Approximately 200k DOT
-   **Concerned Hacker’s Addresses on the Relay Chain:**

-   The hacker’s addresses are colored in red in the account  tab
    -   [https://docs.google.com/spreadsheets/d/11Xko-3xY40qhF9rkPMYgrl35QAoT2aVkjsNsKYp15ns/edit?usp=sharing](https://docs.google.com/spreadsheets/d/11Xko-3xY40qhF9rkPMYgrl35QAoT2aVkjsNsKYp15ns/edit?usp=sharing)

# **Situation: Hacking Details**

The hack compromised all DOT and LDOT deposits within the Starlay protocol, with significant activities traced to the account **`0xe6F6D3cd38e9BF1e118C8Fd1528D303d261BA4F7`**. The exploitation centered around the Starlay interest-bearing USDC (lUSDC) address, which can be reviewed [here](https://blockscout.acala.network/address/0x28A5AFACF605955e4c3aaF23b704C42Acd44EBb4/token-transfers#address-tabs).

## **Incident Summary**

The exploit was a result of anomalies within the USDC pool's liquidity index calculation, enabling the attacker to withdraw significantly more than their initial deposit after borrowing LDOT. This incident underscores a critical oversight in the pool's maintenance, particularly the failure to update the liquidity index due to prolonged inactivity.

## **Incident Description**

The USDC pool remained devoid of funds for an extended period, approximately 20 to 25 days. This inactivity led to significant timestamp changes, resulting in an abnormally large newLiquidityIndex. The lToken (representative of a user’s share in the pool) balance calculation, which relies on the normalizedIncome derived from the liquidityIndex, became distorted. Consequently, an attacker capitalized on this miscalculation by depositing into the pool, which triggered an unexpected increase in the liquidityIndex to 1,350,009,778 \* 10^27. This inflated the attacker’s lToken balance well beyond their actual deposit. The formula used was: balanceOfLToken = rayMul(realDeposit, liquidityIndex) = (realDeposit \* liquidityIndex + 0.5 \* 10^27) / 10^27. With a real deposit of 20,000,000 (with 6 decimals), the balanceOfLToken escalated to 27,000,195,560,000,000,000. This discrepancy allowed the attacker to withdraw USDC funds after borrowing LDOT (or DOT), despite the initial deposit being significantly lower.

## **Initial Setup and oversight:**

At the launch of the Starlay protocol, three tokens were slated for listing: DOT, LDOT, and USDC. While DOT and LDOT were integrated through the Euphrates initiative, the USDC pool did not receive the necessary attention and remained unfunded. This neglect resulted in the liquidityIndex not being updated for an extended duration, setting the stage for the exploit.

We welcome any assistance, advice, or support you can offer. Together, we can overcome this adversity and strengthen our ecosystem against future threats.Thank you for your attention and solidarity.

WHO: Starlay Finance

WHAT: Seeking support from the Polkadot community to explore viable measures to transfer all the DOT from the hacker's account to Starlay's account, following a significant hacking incident compromising Starlay Finance.

PRICE/TIMEFRAME/RESOURCES: Not specified.

Request for transferring all the DOT from the hacker's account to the Starlay's account

- The Polkadot Ambassador Program helps promote Polkadot and introduce new people to it.
- There are four ranks in the program: Head Ambassador, Senior Ambassador, Ambassador, and Candidate Ambassador.
- Head Ambassadors are the top leaders and are responsible for representing Polkadot and making decisions.
- Senior Ambassadors help out and have proven their experience with Polkadot.
- Ambassadors support the community by teaching new users and creating tutorials.
- Candidates are new members who aim to become Ambassadors after approval.
- The program has its own budget, where Head Ambassadors get paid and others can request funds for projects.
- The Ambassador Program works to make Polkadot more popular and successful.

**WHO:** Polkadot network  
**WHAT:** Proposes an on-chain, rank-based, decentralized Polkadot Ambassador Program to represent Polkadot outside its existing sphere and bring new entrants into the ecosystem. The program will have four ranks: Head Ambassador, Senior Ambassador, Ambassador, and Candidate Ambassador. The Head Ambassador track will have up to 21 members, who will receive a salary of 10,000 USDT per month. The program will have an on-chain Treasury for salaries, events, and other expenses.  
**PRICE/TIMEFRAME/RESOURCES:** Not specified.

Polkadot Ambassador Program

USDT and USDC Acquisition for the Treasury

De-register parachain ID 2057

Error! Please vote NAY

**Proposal for Deregistration of Equilibrium Parachain**

- There are worries about a recent change from a project called Equilibrium, which may mislead investors.
- Equilibrium is suggesting a new token, called Q, which could harm current investors by reducing the value of their tokens.
- Only a small amount of the original tokens will be available to swap for the new Q tokens.
- The proposal claims that decisions are not clear or honest, affecting trust among investors.
- To fix these problems, the proposal suggests removing Equilibrium from being a Polkadot parachain and giving back funds to those who contributed to it.
- Polkadot token holders can vote on this proposal to help decide what happens next. 
- The goal is to protect everyone involved and keep the Polkadot ecosystem fair.

WHO: Polkadot token holders

WHAT: Proposing the deregistration of Equilibrium as a Polkadot parachain and early refund of crowdloaned funds due to concerns over a potentially deceptive tokenomics adjustment and lack of transparency in decision-making.

PRICE/TIMEFRAME/RESOURCES: Not specified.

Proposal for the Deregistration of Equilibrium Parachain

- The Polkadot Technical Fellowship helps improve the Polkadot network.
- There is a need for better money planning for fellow salaries.
- A plan is suggested to change DOT (a type of crypto) into USDT (another type of crypto) regularly.
- This change will happen every day using something called the HydraDX Omnipool.
- The full plan has more details that can be read in a document.
- The plan involves special steps to make the changes happen smoothly.

Polkadot proposes to accumulate USDT for the Technical Fellowship's salary by placing DCA orders to swap DOT for USDT using the HydraDX Omnipool to establish a daily conversion. Full proposal details can be found in the provided link.

Polkadot Treasury USDT Acquisition

[Root] Referendum #208

Please vote against

Ameer Omar is part of the CryptoEQ team. Here are some key points about him and the company:

- CryptoEQ offers research and ratings for digital assets.
- They started in 2020 and help various clients, including companies and investors.
- Ameer is connecting with the Polkadot community to support their projects.
- They want to focus on three topics: XCMv3, OpenGov, and Blockspace.
- XCMv3 looks at how different blockchains can work together.
- OpenGov is about new ways of governance in Polkadot.
- Blockspace deals with how Polkadot creates high-quality blocks.
- Ameer shared resources to help explain their work better.

CryptoEQ proposes to provide comprehensive fundamental research on three topics to benefit the Polkadot ecosystem and the wider market. The topics include XCMv3, OpenGov, and Blockspace. The proposal's complete details are available at Polkadot | CryptoEQ Proposal. The proposal's resources include a deck showcasing reports, a DOT report, an example of a CORE+ report, and a one-pager providing an overview of the network. The proposal's value and commitment to long-term monitoring of the Polkadot ecosystem are compared to other proposals.

Featured Research Proposal: Empowering the Polkadot Ecosystem [CryptoEQ]

- Circle is a company that creates digital money called USDC.
- USDC is a stablecoin, meaning it's always worth the same as a real dollar.
- There are over $25 billion USDC coins being used right now.
- Circle checks and shares how much USDC is backed by real money every week and month.
- The company wants USDC to be used easily on a platform called Polkadot.
- This change would help more people use USDC and do transactions without needing other tokens.
- Making USDC easier to use could help Polkadot grow and attract new projects.

Circle requests Polkadot Relay Chain governance to make USDC sufficient on Polkadot, allowing it to be used to pay transaction fees and exist on accounts without DOT. This proposal can attract mainstream users and simplify user experience, expanding access to USDC liquidity and helping the ecosystem grow. No price/timeframe/resources mentioned.

Proposal for USDC Sufficiency on Polkadot Asset Hub

Untitled

Moonbeam's lease on the Polkadot network is set to expire in October 2023. To extend the lease through June 2025, a "swap" of lease periods is needed. The Moonbeam Foundation has secured a new parachain slot for lease periods 13 through 20, which is currently occupied by "Moonelement," a dummy parachain created by Moonbeam. To swap leases between Moonbeam and Moonelement, both parachains must authorize the swap. Moonbeam's referendum is expected to confirm this swap, but a misconfiguration in Moonelement's genesis head prevents it from starting. Therefore, the Moonbeam Foundation has created Polkadot OpenGov Referendum 139 to execute the swap on behalf of Moonelement. Once the swap is complete, Moonbeam will continue to operate without interruption for the full lease period.

**Abstract**

Moonbeam’s current lease period on the Polkadot network will expire in October 2023. In June 2023, the Moonbeam Foundation successfully secured a new parachain slot on Polkadot covering lease periods 13 through 20.

**This proposal is a necessary step to extending Moonbeam’s Polkadot lease period through June 2025 by executing a “swap” of lease periods.**

If the swap is not completed before October 2023, Moonbeam will not occupy an active parachain slot and would stop producing blocks.

**Details**

The lease for periods 13 through 20 is currently occupied by “Moonelement” with parachain ID 3342, a dummy parachain runtime created by the Moonbeam team.

In order to complete a lease swap between Moonbeam (parachain 2004) and Moonelement (parachain 3342), a “handshake” must be completed whereby both parachains authorize the lease swap.

From the Moonbeam side, [Moonbeam OpenGov Referendum 11](https://forum.moonbeam.network/t/proposal-mb11-proposal-to-swap-lease-slots-with-parachain-id-3342/1165/) is expected to be confirmed in approximately 1 day (September 6, 2023). The passage of this referendum will cause an XCM message to be sent to the Polkadot relay chain calling the registrar.swap extrinsic. This extrinsic will authorize the swap from the Moonbeam side.

To complete the “swap” process, a similar swap authorization will be required to be made on behalf of the Moonelement parachain (ID 3342). The Moonbeam team had planned to start the Moonelement parachain and initiate a similar XCM message to be sent to the relay chain.

Unfortunately, there was a misconfiguration in the genesis head that was submitted along with the WASM when the parachain was initially registered. The Moonbeam technical team has determined that starting Moonelement will not be possible.

For this reason, the Moonbeam Foundation has created Polkadot OpenGov Referendum 139 which, when passed, will execute the registrar.swap extrinsic on behalf of the Moonelement parachain.

Using “Chopsticks”, the Moonbeam team has verified that the parachains will successfully swap leases once both the Moonbeam and Polkadot governance motions are passed and executed.

Once the parachains swap leases, the Moonbeam Network will be able to continue operation without interruption for the remainder of the full lease period (approximately 96 weeks from August 1, 2023).

**Links**

-   [Parachain Lease Extension (Polkadot Wiki)](https://wiki.polkadot.network/docs/learn-auction#parachain-lease-extension)
-   [Successful Auction Bid Announcement](https://moonbeam.foundation/news/moonbeam-new-parachain-slot-lease/)

Moonbeam proposes to extend its lease period on Polkadot network through June 2025 by executing a "swap" of lease periods with Moonelement. Moonbeam has created a referendum to authorize the swap from its side, and another referendum (Polkadot OpenGov Referendum 139) will execute the swap on behalf of Moonelement. The proposal needs to be completed before October 2023, and once the parachains swap leases, the Moonbeam Network will be able to continue operation without interruption for the remainder of the full lease period (approximately 96 weeks from August 1, 2023).

Moonbeam: Swap Leases with Parachain 3342

The Nodle Parachain stopped working after a recent upgrade failed. To fix this, the team proposes using a special function on Polkadot to restart the parachain quickly. They want to keep the current state of the parachain and not change any past transactions. The problem was caused by a part of the upgrade taking too long, making the parachain stop making new blocks. The team has made a new version of the code that should fix the problem. They tested this new code and it worked well. They also have a plan to prevent this kind of problem from happening again in the future.

Please check our post [here](https://medium.com/nodle-io/latest-parachain-upgrade-what-everyone-should-know-9d5563e97a70) describing the incident and its reasons. In this document we will be focused on a detailed description of the steps taken to resolve the issue.

**TL;DR**

The Nodle Parachain is bricked after its last upgrade failed. This proposal proposes to use the _forceSetCode_ functionality on Polkadot to ensure the prompt restart of the parachain.

**Solution**

The solution presented below intends to maintain the existing Parachain state, and not require to revert previously approved transactions which would break finality guarantees.

It appears everything in the recent upgrade was sound with all state transitions being correct and intended. However, _the migration code associated with the upgrade is taking too long and caused the proof of verification to grow beyond what the relay chain validators tolerates_. Because the migration happens right when the runtime is upgraded, this causes the parachain to halt block production as the next block would always be rejected by the Polkadot validators. _As such, the head of the parachain did not progress to any undesired state, and thus can be reused_.

This means that it should be possible to unbrick the parachain by force setting the current code to a new runtime that is very similar to the stored runtime. As such, [a new runtime has been prepared](https://github.com/NodleCode/chain/releases/tag/2.2.2-hotfix) with the changes below:

-   Identical spec version than initially deployed
-   Keeps the uniques pallet at the same storage prefix
-   Remove the migration
-   Remove the new pallet associated to the migration

When this code is forced on the relay chain then collators can use the _\--wasm-runtime-overrides_ flag to force their nodes to use the appropriate wasm code that is recognized by the relay chain.

**Testing and verification**

Here are the steps we took to test this proposal:

1.  We used _polkadot-launch_ and ran a local rococo relay chain with a few validators and a collator of our _eden-dev_ parachain. All with fresh states starting from scratch. For the relay chain binary we used _Polkadot-0.9.42_ and for our parachain we used _nodle-2.0.30_ which is the previously published image for our nodes and contains the exact same runtime as it was on our chain right before the problematic upgrade.
2.  We made runtime wasm out of [code](https://github.com/NodleCode/chain/blob/sample-failure/runtimes/eden/src/migrations.rs#L25-L26) that could easily induce the heavy migration step for a local test. We selected the integration of an infinite loop as the fastest way to reproduce the conditions of the issue.
3.  We upgraded the local collators runtime with the runtime wasm which had the intentional failure in its migration. We noticed the node indeed stopped producing blocks with the exact same message as we had seen on our collator “Discarding proposal …took too long“. _This confirms correct reproduction of the current issue_.
4.  We then used Sudo on the local rococo relay chain and called _forceSetCurrentCode_ with the [runtime wasm](https://github.com/NodleCode/chain/releases/tag/2.2.2-hotfix) that we are going to use in our proposal. Let’s refer to that as the good runtime. We already have discussed the idea behind this code change in the Solution section above.
5.  We then stopped the collator and re-ran it using _\--wasm-runtime-overrides_ and setting it to the folder that contained the good runtime. The storage of the collator was maintained and no modification was made there. After the restart the collator started producing blocks and the relay chain backed and included them.

**Proposal Preimage**

Our proposal is _paras -> forceSetCurrentCode(para: 2026, newCode: \[our good runtime\]_, leading to the preimage hash of “_0xbdeb173184c3a932473b7921c0feb233900bbe9228c54dc346239a93b186e9cc_” and preimage length of _1216833_ as shown in the following screenshot:

![](https://i.ibb.co/p4jJth8/Screenshot-2023-08-24-at-2-05-52-PM.png)

**Prevention Strategy**

We intend to work with the Polkadot community to improve existing testing tools to detect similar issues to the one being fixed today. Namely, we would like to extend _try-runtime_ to at least show if the PoV for a runtime upgrade is growing beyond the 5MB limit that is set for validators. Alternatively, this could also take the form of an independent test tool as well.

Regardless of what tool is developed, we will enforce the benchmarking of any migration code in our upgrade process.

Additionally, we would like to investigate whether some patches could be contributed to the Polkadot codebase to optimize for the liveness of parachains by falling back to the last known good runtime in case of upgrade or migration failures. Because this sounds like a much bigger effort given our team expertise, we will need further discussions on this topic.

Nodle's Parachain is bricked after a failed upgrade. Proposal to use forceSetCode functionality on Polkadot to restart it. A new runtime has been prepared and tested. Prevention strategy includes improving testing tools and enforcing benchmarking of migration code.

Unbrick Nodle

Women in Blockchain Canada has proposed a project to develop a proof-of-concept machine learning tool for network-level security in the Polkadot network. The tool will use artificial intelligence to detect anomalies and enable early warning systems for security issues. The team has experience in web and application integration, with a lead developer who has worked on artificial intelligence for NASA and Citi bank. They are also working on a web3-enabled website for the Stellar Foundation. The requested budget for the project is approximately 35,000 USD.

\*\*Proponent: \[Women in Blockchain Canada\] Date: \[28.07.2023\] Requested DOT: \[Approximate amount 35,000 USD - 6,686 - on July 29th \] Short description: \[Artificial Intelligence for security on a network level \] Project Category/Type: Software Development - Security Previous treasury proposals: Education https://polkadot.polkassembly.io/motion/206 \*\* Context of the proposal Our goal is to first build a proof-of-concept machine learning tool that conducts research and analysis on the network level which is able to find anomalies and enable early warning systems for security issues that start occurring. We would utilize adaptive A.I. and unsupervised machine learning algorithms to gather and process the incoming data in real time. Our system would ascertain baseline behavior and then auto-detect any changes that deviate from it in order to assess whether a warning signal is warranted. Once the system would identify real issues, we would create an early warning system that would flag the issues as they start occurring to those in the Polkadot network. This following document contains the background, rationale and development steps elaborating on reaching we will conduct in order to develop the PoC machine learning tool. Full proposal link: https://docs.google.com/document/d/1GBc8xCEFfxA\_hGNCsmznwjgZ3YWtA4wislE6VlNIUJA/edit Project Team We have a distributed team of frontend and backend developers along with a project manager. Our lead developer handles the primary workload as well as one full time developer working under him. The team has a combined 60+ years of experience with web and application integration. Our team is currently working on a web3 enabled website that uses the learn and earn model for the Stellar Foundation (Learnweb3.network). Please note that Danny Kovach has developed his own artificial intelligence as well as has over a decade of experience working in the field for both NASA and Citi bank. Please checkout https://github.com/quant-guy and https://github.com/0x0000d3ad for his work. This is Daniel Kovach’s academic work. https://www.researchgate.net/profile/Daniel-Kovach

Women in Blockchain Canada requests approximately 35,000 USD on July 29th, 2023 to develop a proof-of-concept machine learning tool for security on a network level using adaptive A.I. and unsupervised machine learning algorithms. The project team includes frontend and backend developers, a project manager, and a lead developer with experience in artificial intelligence.

Proposal: Artificial Intelligence for security monitoring on a network level 

DrCAO proposes to build an AIWeb3 Chinese community unit to support Chinese content creators in Dotsama, build connections for different parachain projects, and provide the latest information. The proposal has received positive feedback and is open for further community discussion and feedback.

- This proposal is about fixing the size limit for codes in Polkadot.
- The current on-chain size limit for codes is 10 MiB, but it should be 3 MiB.
- Keeping it at 10 MiB causes issues with consistency checks in the system.
- The proposal suggests changing the limit back to 3 MiB to prevent problems.
- Parachain and Parathread developers need to make sure their code sizes are under 3 MiB.
- Current checks show that most code sizes are already below this limit.

WHO: Polkadot network

WHAT: Modify the on-chain configuration to set the `max_code_size` to 3 MiB from the current 10 MiB.

PRICE/TIMEFRAME/RESOURCES: Not specified.

Fix HostConfiguration

whitelisted_caller

wish_for_change

staking_admin

treasurer

lease_admin

fellowship_admin

general_admin

auction_admin

referendum_canceller

referendum_killer

small_tipper

big_tipper

small_spender

medium_spender

big_spender

Referenda Root

Origin able to dispatch a whitelisted call.

Origin for signaling that the network wishes for some change

Origin able to cancel slashes and manage minimum commission.

Origin for spending up to 10,000,000 DOT from the treasury as well as generally administering it.

Origin for managing the composition of the fellowship.

Origin able to spend around 250 DOT from the treasury at once.

Origin able to spend around 1,000 DOT from the treasury at once.

Origin able to spend around 10,000 DOT from the treasury at once.

Origin able to spend around 100,000 DOT from the treasury at once.

Origin able to spend up to 1,000,000 DOT from the treasury at once.

[0] Origin: Root