Grant Stack

The administrative privileges and multi-signature requirements for a grant program are fundamental to its security. Key considerations include:

• Program Owner(s): Who controls the smart contract and can upgrade logic or withdraw funds?
• Grant Reviewers/Managers: Who has the authority to approve applications and disburse funds? Are these roles decentralized or held by a core team?
• Multi-sig Thresholds: Critical actions like treasury transfers or program pausing should require multiple signatures to prevent single points of failure or malicious actions.

Grant Stack programs are built on smart contracts, inheriting their inherent risks.

• Audit Status: Has the core Grant Stack protocol and any custom round implementations been audited by reputable security firms?
• Upgradability: Is the contract upgradeable? If so, what is the governance process for upgrades, and is there a timelock to allow participants to react?
• Integration Risk: Grant programs often integrate with external protocols for voting, identity (like Gitcoin Passport), or token distribution, introducing dependency risks.

The processes for submitting applications and receiving funds must be secure and resistant to manipulation.

• Sybil Resistance: How does the program prevent fake or duplicate applications? Common methods include Gitcoin Passport, proof-of-personhood, or custom attestations.
• Disbursement Mechanism: Are funds sent via a secure, automated payout strategy (like Merkle distributors) or manual transfers? Automated strategies reduce admin error and fraud risk.
• Front-running & MEV: In rounds using on-chain voting, mechanisms must be designed to prevent bots from front-running profitable grant allocations.

Sustainable grant programs require clear operational frameworks.

• On-Chain Transparency: Are all applications, reviews, votes, and disbursements recorded on-chain or in verifiable, public records?
• KYC/AML Considerations: For large grants or specific jurisdictions, programs may need to collect Know Your Customer information, requiring secure, compliant data handling.
• Grant Agreement Enforcement: How are grant milestones and fund usage tracked? Are there clawback mechanisms for non-compliance, and how are they executed?

Safeguarding the funds allocated for grants is a primary operational concern.

• Custody Model: Are funds held in a multi-signature wallet, a smart contract vault, or with a custodian? Smart contract vaults can enforce programmatic rules for withdrawals.
• Asset Volatility: If the treasury holds volatile assets (e.g., ETH), programs face budgeting risk. Some use stablecoins or diversified treasuries to mitigate this.
• Streaming vs. Lump Sum: Disbursing funds via vesting schedules or streaming (e.g., using Superfluid) can enhance security by releasing funds gradually upon milestone completion.

For community-driven grant rounds, the voting mechanism's integrity is critical.

• Collusion & Bribery: Quadratic Funding and other mechanisms are designed to resist collusion, but sophisticated attacks are possible. Monitoring and circuit breakers are essential.
• Vote Buying: Can votes (e.g., delegated tokens) be easily bought or rented? This undermines the democratic intent.
• Minimum Viable Trust: The goal is to design a system that minimizes the need to trust any single actor, relying instead on cryptographic proofs and transparent, algorithmic rules.

A funding model where contributions to public goods are rewarded after their value has been proven, rather than through upfront grants. It leverages the wisdom of the crowd to identify which projects delivered the most impact.

• Mechanism: Projects are nominated and voted on by a community of badgeholders after a work period.
• Example: Optimism's RetroPGF rounds distribute millions in OP tokens to developers, educators, and toolmakers.

A democratic matching fund algorithm for crowdfunding public goods, where the amount of matching funds a project receives is based on the square of the sum of the square roots of contributions.

• Key Principle: It amplifies the number of contributors (broad support) over the size of contributions (wealth concentration).
• Application: Used in Gitcoin Grants rounds to allocate matching funds from a pool, making many small donations highly effective.

A Decentralized Autonomous Organization whose primary purpose is to manage a treasury and collectively decide on grant funding allocations.

• Governance: Members use governance tokens to propose projects, discuss, and vote on funding decisions.
• Examples: Uniswap Grants Program and Aave Grants DAO are community-led entities that fund ecosystem development.

A grant structure where funds are disbursed incrementally upon the successful completion of pre-defined milestones or deliverables.

• Purpose: Mitigates risk for grantors and ensures accountability from grantees.
• Process: Common in programs like the Ethereum Foundation's Ecosystem Support Program (ESP), where funding is tied to technical progress reports.

The set of mechanisms used to prevent a single entity from creating many fake identities (Sybil attacks) to unfairly influence a grant funding process.

• Critical For: Ensuring the integrity of Quadratic Funding and community voting.
• Solutions: Platforms use proof-of-personhood checks, bright ID, Gitcoin Passport, and stake-based requirements.