The Hidden Risk of Relying on Centralized Data Availability Committees

DACs are a security regression. They replace the robust, permissionless data verification of Ethereum's base layer with a permissioned multisig of known entities, reintroducing the trusted third parties blockchains were built to eliminate.

The risk is censorship, not theft. A malicious or coerced DAC does not steal funds but can freeze a rollup by withholding data, preventing users from proving asset ownership or forcing exits, as seen in early Arbitrum Nova and Mantle designs.

This creates systemic fragility. A compromised DAC for a major L2 like Optimism or zkSync would trigger a mass exit event, overwhelming Ethereum's base layer with fraud proofs and creating network-wide congestion and economic instability.

DACs are permissioned cartels. A Data Availability Committee is a pre-selected, whitelisted group of entities that sign attestations for data availability. This model, used by EigenDA and early Celestia rollups, replaces cryptographic guarantees with legal agreements and social consensus.

The security model regresses. Instead of relying on a decentralized network of nodes, security depends on the honesty of a few known parties. This is a step back from the cryptoeconomic security of proof-of-stake or proof-of-work, trading decentralization for temporary scalability.

Failure modes are opaque. If a DAC withholds data, the recourse is a social slashing process, not an automated cryptographic challenge. This creates a coordination burden and legal liability, mirroring the problems of traditional finance that crypto aimed to solve.

Evidence: EigenDA's initial committee includes entities like Figment and Nethermind. While reputable, this structure is a federated trust model, not a permissionless one. The system's liveness depends on these specific actors, not a global set of stakers.

DACs are liveness oracles. Their primary function is to attest to data availability, not to secure the chain. This creates a single point of liveness failure distinct from a single point of security failure. If the committee stops signing, the rollup halts, even if the underlying Ethereum network is fully operational.

This model inverts security assumptions. Validiums like ImmutableX or early StarkEx deployments rely on a DAC's liveness for user withdrawals. The security-liveness tradeoff is explicit: you trade Ethereum's data availability guarantee for lower cost, accepting that a small, known set of entities must remain online and cooperative for the system to function.

The failure mode is silent censorship. Unlike a malicious sequencer that can be forced via fraud proofs, a non-responsive DAC causes a silent halt. Users cannot prove fraud because data is unavailable by design; they can only prove the attestations are missing, which is a liveness fault the base layer cannot resolve.

Evidence: The StarkEx DAC, operated by entities like Nethermind and ConsenSys, must maintain >2/3 honest and online for liveness. This is a social recovery mechanism, not a cryptographic one. A coordinated legal attack or infrastructure outage against these few nodes would freeze all dependent applications.

Liveness failures create safety failures. A DAC that censors or goes offline prevents state updates, which freezes user funds. This is indistinguishable from a safety failure for the user.

The fallback mechanism is the system. The security model of a DAC-based L2 like Polygon Avail or a Celestia-powered rollup depends entirely on the DAC's honest majority. There is no cryptoeconomic slashing or fraud proof to punish liveness faults.

Centralization vectors are identical. The same governance capture or legal coercion that compromises a DAC's liveness also compromises its safety. The attack surface for both properties converges on the committee members.

Evidence: The Ethereum Foundation's Danksharding roadmap explicitly treats data availability as a safety property. Protocols like EigenDA and Avail market liveness guarantees but their failure modes create identical user harm as a malicious sequencer.

DACs are a temporary crutch, not a final solution. They trade decentralization for scalability, creating a single point of failure and censorship for the entire rollup. This model regresses to the trusted third-party problem that blockchains were built to solve.

The only viable endgame is cryptographic data availability. Solutions like EigenDA and Celestia use data availability sampling (DAS) and erasure coding to guarantee data is published without relying on a small committee's honesty. This is the prerequisite for a truly sovereign rollup.

Protocols built on DACs inherit their systemic risk. A compromised or malicious DAC can freeze assets or censor transactions for applications like Aave or Uniswap running on the layer 2. The security of billions in TVL should not depend on 7-of-10 signatures.

Evidence: The Ethereum Dencun upgrade and EIP-4844 (blobs) provide a canonical, scalable DA layer. Its adoption by Arbitrum and Optimism demonstrates the market's clear preference for credibly neutral infrastructure over trusted committees.