Cowrie Research

constitutional-electorate-bounding-and-threshold-independence-discipline

12 min read

Constitutional Electorate Bounding and Threshold-Independence Discipline

  • Name: constitutional electorate bounding and threshold-independence discipline
  • Category: governance-design reference / constitutional-liveness companion / positive-design companion to mutable threshold-state self-bricking
  • Summary: Healthy governance systems do not let monetary-policy math, reserve-accounting drift, share rescaling, or other nearby economic state decide whether the constitution itself still exists. Proposal thresholds, quorum, cancellation rights, proposer eligibility, and emergency-repair survivability should be anchored to a bounded constitutional electorate object that adjacent accounting code cannot silently rewrite. This note exists to keep the healthy-side target explicit after incidents like YAM: the right design is not merely fix the rebase bug faster, but separate who governs from the mutable denominators that economy-facing code can explode, and preserve a narrow liveness lane when that separation still comes under stress.
  • Why this note exists:
    • Mutable threshold-state self-bricking preserves the negative family where governance becomes mathematically unreachable because nearby accounting state corrupts quorum, proposal threshold, or proposer eligibility.
    • This note preserves the positive-design question one step later: what should a healthy constitutional electorate object look like, how should thresholds be derived from it, and what narrow emergency rails keep liveness alive if surrounding economic state fails anyway?
    • The core design move is not exotic cryptography or faster social consensus. It is to stop rebase logic, reserve mints, accounting syncs, and similar economy-facing machinery from being able to redefine the governor’s own arithmetic.

What this note means by constitutional electorate bounding

  • Constitutional electorate object means the bounded state object that answers governance-liveness questions: who may propose, what vote supply counts toward quorum, what makes a proposal cancelable, and what emergency-repair lane survives if the rest of the economy is on fire.
  • Threshold independence means those answers are not recomputed from mutable economic state like live rebasing supply, reserve balances, share price, reward indexes, or other denominators that adjacent subsystems can distort.
  • The practical question is not does governance read a number called totalSupply? It is can a non-governance subsystem accidentally or adversarially rewrite the arithmetic that says governance is still allowed to act?

The main healthy-side assumptions this discipline makes explicit

1. The governor should depend on a deliberately bounded electorate base, not on live economic supply

  • Monetary-policy state and constitutional state are different control surfaces.
  • Rebasing totals, reserve-backed claim supply, vault shares, rewards indexes, and migration-side accounting variables can all change for reasons that have nothing to do with constitutional legitimacy.
  • A healthy design creates or chooses a more stable governance denominator: snapshotted voting supply, separately minted governance units, bounded delegated balances, or another explicitly reviewed electorate base.

2. Proposal survival should not be re-priced by the same bug the proposal is trying to fix

  • A rescue proposal that was valid when admitted should not become trivially cancelable because the bug being fixed later inflated the denominator used for proposer qualification or cancellation.
  • Once a liveness-preserving proposal enters the emergency rail, its continued existence should depend on explicit emergency-lane rules rather than naive re-evaluation against broken economic state.
  • We found the bug and even queued the patch is not a meaningful safety story if later denominator drift can still arithmetic-away the rescue.

3. Timelock delay must not outrun constitutional half-life

  • Ordinary review delay is good only while the constitution remains reachable during that delay.
  • If the next scheduled rebase, reserve sweep, epoch roll, or accounting sync can destroy governance liveness first, then the protocol needs a narrower lane that can halt that transition or preserve the rescue path.
  • The healthy design question becomes what liveness-preserving actions bypass ordinary latency, under what triggers, and with what bounded scope?

4. Governance should be able to freeze economy-facing state transitions that threaten its own reachability

  • A protocol should be able to stop the next rebase, reserve mutation, or migration sync when that event would make constitutional repair impossible.
  • This is not the same as broad discretionary admin power. The narrow target is preserve the governor's ability to govern.
  • Good systems make that preservation path explicit before the incident rather than improvising it while thresholds are already blowing out.

5. Monitoring should treat threshold motion as a balance-sheet alarm, not mere governance metadata

  • Proposal threshold, quorum, proposer eligibility, and cancelability should not jump by absurd multiples without paging responders.
  • If operators only learn that governance became unreachable after a rescue fails, the protocol is observing constitutional liveness too late.
  • Threshold telemetry belongs beside reserve telemetry because threshold state determines whether repair remains possible.

6. Constitutional and economic objects should be reviewable independently

  • Reviewers should be able to answer two separate questions without hand-waving:
    • what economic state can change because of rebases, accounting syncs, reserve mints, or migrations?
    • what bounded state determines governance liveness and who can mutate it?
  • If the same answer appears in both places, the design should be presumed fragile until proven otherwise.

What sound design looks like

  • Governance thresholds are derived from a bounded electorate base

    • Proposal threshold, quorum, and proposer-eligibility rules reference a snapshotted or otherwise intentionally governed electorate object rather than live accounting denominators.

  • Emergency liveness actions sit on a narrower lane than ordinary policy changes

    • Pausing a rebase, freezing a reserve mutation path, preserving a queued repair, or migrating to a temporary governor can happen faster and with more constrained semantics than routine treasury or parameter governance.

  • Rescue proposals become durable once correctly admitted

    • If the system already recognized a proposal as the legitimate constitutional repair under pre-collapse conditions, later economic corruption does not silently erase that recognition.

  • Scheduled transitions can be halted when they threaten constitutional reachability

    • The protocol has an explicit answer for what if the next automatic state transition destroys our ability to fix the system?

  • Threshold observability is real-time and causal

    • Operators can see which state variables moved proposal threshold, quorum, or cancellation conditions and why.

  • Constitutional state changes are rare, named, and reviewable

    • The bounded electorate object changes through explicit governance or explicitly scoped emergency action, not as a side effect of ordinary economic machinery.

Useful positive design shapes

1. Snapshotted or separately bounded electorate base

  • Use a governance token or delegated voting-supply snapshot that does not automatically inherit rebasing or reserve-accounting movement.
  • If the economic token and governance token must remain related, make the conversion path explicit, rate-limited, and separately reviewable rather than automatically reusing live economic totals.
  • The point is not perfect immutability. The point is to keep ordinary accounting turbulence from becoming constitutional arithmetic.

2. Admission-time protection for emergency repair proposals

  • Once a proposal is admitted into a liveness-preserving emergency lane, later denominator explosions should not retroactively strip proposer qualification or make cancellation trivial.
  • Good designs treat validly admitted emergency repair as its own state object.
  • This is the constitutional analogue of not letting a bank run rewrite whether the fire exit still counts as an exit.

3. Narrow liveness-preserving pause rights

  • Give a narrowly scoped actor or mechanism authority to halt the specific state transitions that would destroy governance reachability: rebase execution, reserve-mint sweeps, epoch finalization, migration sync, or equivalent.
  • Scope matters. The authority should preserve repairability, not become an open-ended replacement governor.
  • Pair this with governance-backstop-scope-and-intervention-latency-discipline when the next question is which actor should hold that lane and how quickly it can act.

4. Threshold freeze or fallback semantics under detected denominator corruption

  • Define what happens if threshold state moves outside plausible ranges: freeze to the last known-good constitutional base, switch to a bounded emergency denominator, or activate an explicitly narrower repair constitution.
  • The key is to predefine the fail-closed semantics before the protocol is under pressure.
  • Keep recomputing from broken state is usually the worst option.

5. Causal threshold telemetry and invariant alarms

  • Emit or compute threshold-state changes in ways responders can reason about quickly.
  • Maintain alarms for impossible or near-impossible shifts in proposal threshold, quorum, proposer eligibility, or cancellation conditions.
  • Governance liveness should have operational telemetry, not only legal prose and static docs.

6. Deliberate separation between economic migrations and constitutional migrations

  • If a protocol migrates supply, claims, wrappers, or reserve accounting, it should not implicitly migrate the constitutional electorate by side effect.
  • Economic migration may need one schedule and safety model; constitutional migration may need another.
  • Joining them too tightly creates migration bug becomes governance death risk.

Red flags that usually mean threshold independence is mostly decorative

  • proposal threshold or quorum is a simple percentage of live rebasing totalSupply, initSupply, reserve balances, or another mechanically moving accounting denominator
  • proposer qualification or cancellation rights are re-evaluated against mutable broken state even after an emergency repair is already queued
  • the next scheduled rebase or sync can obviously worsen the bug, but there is no narrow way to halt it without full ordinary governance
  • responders cannot quickly explain why quorum or proposal threshold moved
  • emergency governance is discussed only socially, with no explicit rule for preserving liveness once economic state becomes suspect
  • economic migrations and governance-liveness state are changed through the same rollout without separate invariants or review

Design questions worth asking first

  • What exact bounded object determines proposal threshold, quorum, proposer eligibility, and cancellation rights today?
  • Which non-governance code paths can still mutate that object directly or mutate the denominator from which it is recomputed?
  • If the next automatic state transition fires while the system is already in a broken state, does governance become more or less able to repair the damage?
  • Once a rescue proposal is admitted, can the bug it is fixing later arithmetic-away the proposal’s survival conditions?
  • What narrow authority can halt the next liveness-destroying state transition without handing operators an open-ended replacement constitution?
  • If threshold telemetry jumped 10x in one block, would responders know which state change caused it and what fallback semantics apply?

Negative exemplar cluster: what broken threshold independence looks like

  • [[../incidents/governance-admin-upgrades/yam-finance-rebase-totalsupply-inflation-governance-bricking-2020-08-13|YAM Finance rebase totalSupply inflation / governance bricking (2020-08-13)]] is the canonical denominator-collapse exemplar: a rebase arithmetic bug first corrupted totalSupply, then initSupply, and the same poisoned state blew out proposal threshold and quorum before the queued fix could clear GovernorAlpha’s delay.
  • Mutable threshold-state self-bricking is the negative pattern companion when the analytical task is classifying the failure family before moving back into healthy-side design.
  • Governance backstop scope and intervention-latency discipline is the response-lane companion when the sharper question becomes which narrower emergency rail should have preserved constitutional liveness before the ordinary governor died.

Failure-prevention checklist

  • Derive proposal threshold, quorum, proposer eligibility, and cancellation rights from a bounded constitutional electorate object rather than live economic-accounting denominators.
  • Inventory every non-governance code path that can still influence governance-liveness arithmetic, including rebases, reserve mints, reward syncs, supply migrations, share rescalings, and epoch finalization.
  • Add a narrow liveness-preserving rail that can halt the next state transition likely to destroy governance reachability.
  • Make admitted emergency-repair proposals durable against later denominator corruption; do not let the bug being fixed retroactively erase the fix path.
  • Define fail-closed threshold semantics for denominator corruption: threshold freeze, last-known-good base, or bounded emergency electorate.
  • Add real-time monitoring and alerting for threshold blowouts, impossible denominator changes, and sudden proposer-eligibility shifts.
  • Separate economic-migration review from constitutional-migration review; do not assume one safe rollout implies the other.
  • Rehearse bug discovered before next automatic transition scenarios until operators can name both the liveness-preserving action and the exact authority that can take it.

Audit prompts

  • What exact object currently defines who can still govern if economic state becomes wrong tomorrow?
  • Can any rebase, reserve, reward, migration, or accounting path mutate the variables from which governance thresholds are derived?
  • If an emergency repair proposal is valid today, what future state changes could make it cancelable or non-viable before execution?
  • What action can halt the next automatic state transition if it would otherwise destroy constitutional reachability?
  • Are constitutional threshold changes observable as first-class events with causal attribution, or only inferable after governance fails?
  • If economic supply inflated by orders of magnitude in one block, what bounded constitutional denominator would the protocol fall back to?
  • Does the protocol intentionally separate economic and constitutional migrations, or can one buggy rollout rewrite both at once?

Lessons that should already be standard

  • A governor is only as real as the arithmetic that says it still exists.
  • Live economic supply is usually a bad constitutional denominator.
  • A rescue proposal that can be arithmetic-canceled by the same bug it fixes is not a rescue path.
  • Timelock safety ends where constitutional half-life begins.
  • Threshold telemetry is incident-response telemetry, not governance trivia.
  • Monetary-policy review and constitutional review should be separate workstreams even when they touch related tokens.
  • The healthy question is blunt: if accounting breaks right now, what keeps the constitution from disappearing before the patch lands?

How to use this note with the exploit corpus

  • Start here when the sharper design question is what bounded electorate object and threshold semantics should have kept governance alive even if nearby accounting state broke first?
  • Use mutable threshold-state self-bricking when the first task is classifying the negative exploit family.
  • Use this note when the next task becomes what should the constitutional denominator have been, how should emergency repair survive denominator drift, and what narrow lane halts the next liveness-killing transition?
  • Pair with governance-backstop-scope-and-intervention-latency-discipline when the sharper follow-up is which actor or rail should preserve constitutional liveness operationally.
  • Pair with timelock-action-bundle-commitment when the sharper follow-up is whether ordinary delayed governance could ever have landed before the fatal next state transition.

Internal linkages

Control surface

Graph View

Backlinks