Cowrie Research

incident-response-lane-separation-and-exploit-tainted-vote-quarantine

14 min read

Incident-Response Lane Separation and Exploit-Tainted Vote Quarantine

  • Name: incident-response lane separation and exploit-tainted vote quarantine
  • Category: governance-design reference / incident-constitution checklist / positive-design companion to attack-funded governance extortion
  • Summary: Protocols should assume that an exploit can poison governance before anyone finishes calling it an exploit. If the same balances, delegates, or freshly purchased voting power influenced by the incident are allowed to decide restitution, treasury socialization, claims waivers, or attacker bounty treatment immediately, incident response becomes a second monetization leg of the attack. The healthy design target is twofold: first, cleanup decisions should run on a distinct constitutional lane from ordinary policy and treasury proposals; second, exploit-tainted voting power should be quarantined, discounted, or held outside decisive incident authority until forensic and restitution work is far enough along that the attacker is no longer bargaining through the electorate. This note exists to keep that positive design target explicit instead of leaving readers to infer it only by inverting post-exploit claims-waiver capture and Mango Markets.
  • Why this note exists:

What this note means by lane separation and tainted-vote quarantine

  • Incident-response lane separation means the protocol treats emergency user restitution, treasury backstop activation, claims preservation, legal / recovery posture, and attacker-facing settlement as distinct constitutional objects rather than one rushed recovery proposal bundle.
  • Exploit-tainted vote quarantine means balances plausibly touched by, bought with, economically downstream from, or operationally controlled through the incident do not immediately count as ordinary governance weight for those incident-response objects.
  • The useful question is not can the DAO still vote? It is who gets to decide cleanup while the exploit has not yet been neutralized?
  • This note is intentionally narrower than constitutional-electorate-bounding-and-threshold-independence-discipline. That note asks whether the constitution’s denominator stays mathematically reviewable; this one asks what should happen when the incident itself has already contaminated who might vote on the cleanup.

The main assumptions a healthy incident constitution should make explicit

1. Incident response is not ordinary governance traffic

  • A protocol should not treat emergency restitution, bad-debt socialization, claim waivers, non-pursuit promises, or bounty recognition as normal treasury or policy proposals.
  • Those actions decide how losses are allocated, what claims remain alive, and whether attacker coercion is ratified. They deserve a dedicated constitutional lane with stronger review and narrower authority combinations.
  • If a single generic proposal type can both reimburse users and release attacker pressure, governance is already too coarsely typed.

2. Exploit-tainted governance weight is a distinct risk class

  • Governance balances can become tainted in several ways:
    • directly stolen or retained governance tokens
    • voting power bought with exploit proceeds or manipulation profits
    • house-token inventory whose price was inflated by the same incident
    • delegated or wrapper-routed balances now effectively controlled by a compromised or attacker-aligned operator set
  • The protocol does not need perfect courtroom-grade attribution before it can quarantine incident-linked voting weight. It needs a precommitted rule for what evidence or proximity is enough to move those balances into a temporary review class.
  • If the only standard is prove final attribution beyond dispute first, the attacker usually gets to vote long before the standard is met.

3. User restitution and attacker release must be constitutionally separable

  • Return user funds quickly and waive claims / bless bounty / promise non-pursuit are different actions with different legitimacy requirements.
  • Healthy systems can activate user relief or treasury backstops without simultaneously deciding whether the attacker keeps a negotiated share.
  • A proposal that packages both is not merely efficient. It is merging victim protection with attacker leverage.

4. Emergency liquidity relief should not depend on attacker-shaped majorities

  • Insurance funds, reserve modules, recapitalization tools, or treasury backstops should have a path that protects users even if governance is temporarily contaminated.
  • If the protocol can only help users after the attacker-influenced electorate approves the bundle, the treasury becomes a hostage pot.
  • Fast relief lanes reduce the political force of take this coercive deal or users wait indefinitely.

5. Incident authority should be typed, narrow, and sunsetted

  • The emergency actor or lane should be able to do a small set of things very clearly: freeze tainted votes, activate preapproved relief, preserve claims, pause certain governance objects, or require higher review for settlement proposals.
  • It should not become an open-ended excuse for permanent council rule.
  • Narrow scope plus explicit sunset is what makes extraordinary incident authority legitimate enough to use.

6. Disclosure obligations are part of the lane design

  • Extraordinary settlement proposals should disclose exact returned assets, exact retained assets, exact treasury contribution, exact claims waived, exact legal promises made, and exact voting balances excluded or counted.
  • Emergency negotiation is not a reason to accept fuzzy accounting.
  • When those terms stay bundled or vague, voters are often being asked to ratify coercion they cannot actually price.

7. Re-entry to ordinary governance should be explicit

  • There should be a known transition from incident mode back to normal constitutional operation: what unfreezes tainted balances, who certifies forensic completion, which claims remain live, and when emergency committees lose their special powers.
  • Without a clean exit rule, either the attacker regains influence too early or the emergency lane hardens into indefinite exceptionalism.

Three incident-governance boundaries healthy protocols should keep distinct

  1. Tainted influence can be observed without being treated as ordinary constitutional weight

    • The protocol may be able to see that exploit-retained balances, exploit-funded spot accumulation, or compromised delegates now exist.
    • Healthy design does not jump from we can see those balances to those balances must vote normally right now.
    • This is where quarantine, delayed activation, discounting, or review-class routing lives.

  2. Counted incident-governance weight should still be narrower than ordinary governance weight

    • Even if some contaminated or uncertain balances remain visible for coordination, that does not mean they should reach the full incident menu.
    • A protocol can let a wider electorate observe, signal, or coordinate around incident status while still reserving restitution, treasury socialization, claims preservation, and attacker-facing settlement terms for a narrower lane.
    • Healthy design keeps counted for some emergency coordination separate from counted for coercive settlement objects.

  3. Incident authority should be able to protect users without also deciding attacker release

    • Restitution, liquidity relief, claims preservation, and treasury backstop activation should stay constitutionally separable from bounty relabeling, waiver, or non-pursuit promises.
    • This is the boundary that stops help users now from becoming the package that also ratifies the attacker’s negotiated share.
    • Healthy design keeps users can be protected and attacker terms can be blessed on different approval lanes.

What sound design looks like

  • The protocol can reimburse users, activate reserve support, or pause dangerous governance objects without simultaneously deciding whether the attacker gets amnesty or bounty treatment.
  • Exploit-tainted balances are moved into a temporary quarantine class quickly enough that the attacker cannot use crisis momentum to shape the cleanup vote.
  • Incident proposals are typed: restitution, treasury support, claims preservation, settlement negotiation, and legal release are not all jammed into one payload.
  • Incident vote counting is explicitly narrower than ordinary governance rights: newly acquired, exploit-linked, or review-class balances do not automatically inherit the same authority over restitution or settlement objects that they might hold in routine policy votes.
  • Emergency authority is narrow, reviewable, and sunsetted. It can interrupt coercive settlement bundles without becoming a standing substitute for governance.
  • Proposal review includes a public map of which voting balances were excluded, which remained live, and why.
  • The protocol has a defined path back to normal governance once restitution and forensic conditions are met.

Useful positive design shapes

1. Dual-lane incident governance

  • One lane handles immediate user protection: pauses, reserve use, bad-debt containment, claims preservation, and narrowly scoped liquidity relief.
  • A separate lane handles attacker-facing negotiations: bounty characterization, claims waivers, release terms, or recovery agreements.
  • The key property is that users can be helped without the attacker also getting their settlement vote at the same time.

2. Tainted-balance quarantine windows

  • The constitution can define a temporary incident-review period during which balances linked to exploit proceeds, exploit-retained governance inventory, or suspicious spot accumulation do not count toward extraordinary settlement decisions.
  • That window does not need perfect attribution. It needs a rulebook for what evidence is sufficient to suspend ordinary voting effect during the emergency.
  • Review-class treatment can include exclusion, discounting, delayed activation, or routing votes to a neutral sink until the incident closes.

3. Typed settlement objects with independent approvals

  • Treasury-funded restitution, claims waivers, legal non-pursuit language, and post hoc bounty treatment should each be distinct proposal objects or approval steps.
  • This prevents a single recovery package from smuggling in attacker releases under the emotional pressure of helping users.
  • Independent approvals also make it easier for a backstop or emergency committee to interrupt the attacker-facing part without blocking user relief.

4. Incident committee with bounded constitutional scope

  • A narrow emergency committee can freeze tainted votes, require proposal reclassification into the incident lane, or stop extraordinary settlement bundles pending disclosure.
  • The committee should not set long-term policy. Its job is to preserve bargaining integrity until the normal constitution can act on cleaner facts.
  • This is the incident-specific cousin of broader governance backstop design, not a replacement for it.

5. Relief-first treasury / insurance activation

  • Treasury or insurance modules should be able to absorb part of the loss, bridge liquidity, or protect users without making attacker amnesty the price of that assistance.
  • Relief-first design reduces the coercive potency of approve my terms or users stay trapped.
  • It also makes later settlement review more legible because user protection is no longer bundled with attacker bargaining.

6. Explicit normalization and vote restoration rules

  • The protocol should define how tainted balances are later reinstated, slashed, disregarded permanently, or handed to another process once the incident closes.
  • Review-class handling should be auditable enough that participants know emergency exclusion is tied to incident facts, not factional convenience.
  • Normalization criteria are part of legitimacy; without them, emergency quarantine will be politically harder to invoke when it is most needed.

Red flags that usually mean the incident constitution is unfinished

  • one generic proposal can reimburse users and waive claims against the attacker in the same step
  • exploit-retained or exploit-funded governance balances remain fully live during settlement votes
  • treasury or insurance support for users is available only if the attacker-influenced electorate approves the bundle
  • no actor can freeze, discount, or quarantine tainted voting power before a coercive proposal lands
  • settlement proposals describe partial return in detail but stay vague about what legal, recovery, or claims rights are being surrendered
  • incident powers exist socially but are not typed, scoped, or sunsetted in any legible rule set
  • the protocol has no public rule for when emergency governance ends and normal governance resumes

Design questions worth asking first

  • If an exploit happened today, which decisions could be taken without counting exploit-tainted balances?
  • Can the protocol help users before it decides whether to release claims or bless an attacker-retained share as a bounty?
  • What evidence is sufficient to quarantine voting weight as incident-linked, and who applies that rule?
  • Are settlement bundles typed cleanly enough that a backstop can interrupt attacker release without blocking restitution?
  • Could exploit proceeds or manipulated house-token inventory buy enough governance weight within the proposal window to shape cleanup?
  • What exact disclosures are mandatory before any extraordinary settlement vote can proceed?
  • When does incident mode end, and what happens to balances or delegates kept in the tainted-review class?

Failure-prevention checklist

  • Define an incident-governance lane before the exploit happens, with separate handling for restitution, treasury support, claims preservation, and attacker-facing settlement terms.
  • Precommit a tainted-vote review rule: which balances may be excluded, discounted, delayed, or neutralized during incident response, who makes that call, and under what evidence threshold.
  • Precommit when freshly acquired voting power becomes incident-eligible. Delayed activation windows, pre-incident snapshot rules, or separate emergency electorates all work better when decided before anyone is buying votes with exploit proceeds.
  • Keep user-protection proposals separate from amnesty, waiver, bounty, or non-pursuit proposals.
  • Give treasury and insurance mechanisms a relief-first path that does not depend on attacker cooperation or attacker-shaped voting coalitions.
  • Give a narrowly scoped backstop or committee power to freeze exploit-linked voting weight and stop coercive settlement bundles pending review.
  • Require exact disclosure for extraordinary incident proposals: assets returned, assets retained, treasury funds committed, claims waived, legal promises made, and voting balances counted or excluded.
  • Stress-test the governance token itself as incident leverage. Ask whether exploit proceeds, manipulated treasury inventory, or low-float market conditions could let the attacker influence cleanup before normal holders coordinate.
  • Define clear normalization rules for when incident mode ends and how temporarily quarantined votes are restored, ignored, or escalated into another process.
  • Drill the ugly scenario explicitly: the attacker now also influences governance. If the protocol has no typed response, the constitution is not finished.

Audit prompts

  • What exact incident-response objects can be approved without also deciding claims waivers, bounty treatment, or non-pursuit promises?
  • Could balances tied to the exploit still vote on cleanup today, and if not, what rule or actor stops them?
  • When does newly acquired voting power become eligible for incident decisions: immediately, after a delay, only from a pre-incident snapshot, or through some narrower emergency electorate?
  • How fast can the protocol quarantine tainted votes relative to the fastest credible coercive settlement proposal?
  • Are treasury relief and insurance activation legally or constitutionally separable from attacker release terms?
  • If a partial-return deal were proposed now, where would exact retained value, exact waived claims, and exact legal commitments be disclosed?
  • Does the protocol have a dedicated review path for settlement proposals that are economically downstream from attacker-controlled or attacker-influenced votes?
  • Could a protocol-native governance token manipulated during the incident become both the cause of the loss and the currency of the settlement vote?
  • What explicit condition returns the system from incident mode to ordinary governance, and who certifies that transition?

Lessons that should already be standard

  • An exploit should not get a second monetization leg through the cleanup vote.
  • Helping users and releasing the attacker are different constitutional acts. Packaging them together is governance coercion dressed up as pragmatic recovery.
  • Perfect attribution is not a prerequisite for temporary incident quarantine. Emergency constitutions need enough evidentiary rules to stop obvious attacker-influenced voting before the forensics memo is complete.
  • Treasury and insurance backstops should reduce hostage pressure, not become the ransom pool governance is pushed to spend under attacker-shaped terms.
  • Incident mode without typed proposal objects is an invitation to smuggle amnesty into restitution.
  • A governance token can become incident-contaminated faster than most DAOs can coordinate an ordinary vote. If there is no precommitted answer to that state, the constitution is unfinished.
  • The right time to decide how tainted votes are treated is before the exploit, not while delegates are being asked to ratify a partial-return ultimatum.

How to use this note with the exploit corpus

  • Start here when the sharper design question is how should a protocol separate user protection from attacker release once the incident itself can influence governance?
  • Use attack-funded governance extortion when the main task is classifying the negative family.
  • Use this note when the next task becomes what dedicated incident lane, tainted-vote rule, disclosure standard, and settlement typing should have existed before the attacker got to bargain through governance?
  • Pair with governance-backstop-scope-and-intervention-latency-discipline when the sharper follow-up is who should have been able to freeze tainted votes or stop coercive settlement bundles, and how fast.
  • Pair with treasury-governance-token-vote-neutrality-discipline when the sharper follow-up is that treasury-held or treasury-deployed governance inventory made the attacker-influenced electorate worse.
  • Pair with post-authentication-bounded-loss-design when the sharper lesson is that even after an exploit has achieved partial control or authentication, the protocol should still bound how much authority or value that temporary success can convert into.

Internal linkages

Control surface

Graph View

Backlinks