S.10 Ep.13 The DAO Security Fund: Round 2 with Griff Green

0:00Welcome to the Green Pill podcast joining me today on the pod is Griff Green friend of the pod and repeat guest. He is a true OG in the space co-founder of Giveth and one of the earliest and most persistent builders of crypto native public goods funding tools. He's been deep in Ethereum since 2015 when he served as community manager for the Dow and led the Whitehack group that recovered hundreds of millions of dollars from 2016 to 2018 from the Dow hack and has since gone on to co-founding projects like DAP node token engineering commons qac giveth and more. He now leads the Dow security fund and is helping to steward the new chapter of the Dow as an enduring funding source for Ethereum security. So we did an episode with Griff to talk about the Dow's first funding round for Ethereum security and now they are announcing a second round of the Dow security fund which goes live today. So this is a podcast episode all about that new round if you want to get the details then Griff is dropping them on this podcast episode. So without further ado I give you

1:03Griff Green. All right hey Griff how's it going? That's great how are you all lucky? Pretty good. I'm transitioning into the new market and I got some things in the works but we'll unpack this on that one. Are you going to get out of the hair? Is it a bull market hair season? I'm waiting for the bull market and I'm told it's coming soon TM any minute now. Well we're here today to talk about the Dow security fund round two so why don't you take us down that rabbit hole? Round one was awesome. We did the Dow security fund is only existed for like eight months and we've already distributed almost two million dollars to different security initiatives of 136 different security initiatives. You can go to the transparency spot on the Dow.funds website to see all the groups that we funded mostly through the first round which was a quadratic funding round and quadratic

2:04funding rounds are great but they're you know sort of shallow and in impact and broad right which is which is awesome and has a lot of value especially for us because we were trying to bootstrap our network and you know start with the bang you know it's the viral the viral like the viral virality of of the QF is just beautiful but the next round we want to go hard and deep. We want to go like we want to take some serious initiatives that are really critical that can really move the needle but they might cost like you know half a million dollars even a million dollars to actually get something important done that will have the impact and make a theorem safer so we designed round two around that kind of concept and while the Dow gets a lot of money we actually earn around five ether a day of that we can use to fund the theorem security it's not quite enough to really

3:05move the needle so we're transitioning into becoming more like funding coordinators and we already had such a positive experience with that in round one where we put up around a million dollars and we just without really trying too hard we were able to get 600 over 600 thousand dollars from the community to support the first round so we want to double down on that and really focus on funding coordination trying to find the the wins that the ecosystem is willing to support and the most important initiatives that we can fund so that's that's the goal of round two there's there's a lot to talk about with it and I'm excited to dig in. I think this is super cool just to recap the Dow security fund is about funding Ethereum security you want to make Ethereum secure and the first thing that y'all did was activate the eth that was left over in the Dow and run a quadratic funding round off of the yield from that

4:09the quadratic funding round was really shallow but wide and that allowed you to have a cartography of the entire landscape of eth security projects and now y'all are going deep on funding major initiatives in the security space and so it feels like you kind of like hopped your head out did the cartography and the QF round served is that and then you're going deep in round two how's that does the summary? Yeah yeah I think that's that pretty much nails it. Okay well let's talk about the mechanics of round two what's the mechanism how does it work mechanistically how much money is involved it sounds like you're evolving into more of a shelling point for funding coordination as opposed to a funder yourself but you're also creating this like gravity well of funding eth security so take us deeper on the round two yeah so it's really funny because it's a full circle moment actually round two is structured very much like v1 of give it in 2016 so in 2016 we're

5:11building v6 of give it now to give some context so in 2016 we had milestones we had like a separate vault that was a smart contract for every single project and when people would put money in they would they would get tokens back and then the funds would actually be paid out in milestones and that's what we're doing now so every initiative which you can go out and actually create an initiative right now if you want it is gated I will review the initiatives with my team and we will figure out whether or not it needs some feedback and response but if you make an initiative as long as it's not garbage I'm sure it'll make it in you know like so we want a competition of ideas and each initiative will end up with its own multi-sig and that multi-sig is controlled by the the Dow security fund and give it and so then funds that are donated directly can just go in that multi-sig but the cool thing about that strategy that on-chain strategy is

6:13actually it's really easy to track if people want to send money from exchanges they can just send money from exchanges to the address every multi-sig has its own address of course and every initiative then can raise funds in an easy way like people can just donate from Coinbase or Binance also we're enabling companies to just make a pledge so they don't even have to put the money up front they can just say hey this initiative will make my life a lot easier actually if I if this initiative passes maybe I've put in 20k but actually that will save me hundreds of thousands of dollars and actually be a big benefit to my users so I will put in 20k I get my logo on the initiative and boom you know I only have to actually pay that money if the initiative gets fully funded and then we will do kind of a fundraising rounds all the way from now it just started today just launched today when you're when you're watching this recording and now we'll keep funding

7:16until after DevCon so just be pure fundraising but then after DevCon we have an actual vote through the Dow security fund and this is where our round and mechanism comes in the amount of money that the Dow puts in the scope of what it will fund and a lot of details will come out later but the main long story short is that each security badge holders who are security experts without throughout the space all the big names Samsung and all the guys from Seal 9-1-1 Jordy Bellina all the all the big names and security are there even Vitalik as a badge holder they actually they get to vote and each badge holder will have a certain amount of money that they basically get to rate rank the security initiatives how they want and money will be allocated based off of their rankings we'll go into the mechanism of the vote later we have to actually just everything that we do has to get voted on and passed by the curators and we just haven't gone

8:17there yet to prevent or ratify some of the decisions so TBD on the voting mechanism but we're going to keep this round open until at least through the end of January where we're working with the ecosystem to fund these initiatives when an initiative gets funded we there's two types of initiatives there's grants and RFPs so RFPs are like kind of a wishless item it's like hey we need this solution we need someone to build you know for instance there's one that's like L2Beat for Opsack we need a radiance agency for teams Opsack abilities right like how well ops a lot of the hacks recently have come from Opsack problems operational security problems people not protecting their keys people not having correct multi-sake setups there are such things as Opsack audits but they don't sometimes teams do an Opsack audit the Opsack auditor gives recommendations and then the team is like I'm not going to do it because it's too much work or I

9:21don't really like those ideas or whatever you know and so this would be a way to keep those teams accountable for them to have a reason to if you don't do those recommendations then you don't go up on the list of great teams that have great operational security so who's going to do that work I don't know there will be a process once if it gets fully funded then if the market says this is a good idea and it gets fully funded then people can apply to say hey I'll do that work I will coordinate with the Opsack auditors and make a radiance agency and and make this happen and and then there will be milestone based payments and at the end of every milestone is an adoption milestone which needs to be somewhere between a third to half of the entire budget and this is because over the years in Ethereum we've seen many times builders love to build but they don't always do the BD work to get what they've built out there and used by people which is something I got to give

10:23you credit for Oarky like you've always taken the full mile you know it's like you build something awesome you see if it has product market fit if it doesn't you drop it you know and then you go on and we want to make that same incentive here you know we want to make sure that people have an incentive to be like build it okay we had the fun part we built it now we got to get people to use it and they can even pay people to use it because there'll be a big milestone at the end right and sometimes that's what you need to get the ecosystem more secure yeah well so that was the RFP process the grant process is almost the exact same so there's RFPs and grants grants if you are a security team you already have something pretty much built it's not all the way finished and you know it would be an amazing ecosystem project well you can propose it as a grant there won't be a competitive process for who's going to do the work it's a grant you're doing the work you said that you have when we were talking a pre-show you said that you have some software demo for

11:26us so maybe we could anchor some of these things in the actual software that people will be using to coordinate this round you want to share your screen and and walk us through sure let's do it and then for the audio listeners you'll just have to check out this I got this episode on YouTube if you want to see the demo here but for the next five or ten minutes we'll need to have video yeah yeah so this is fun dot the doubt out fun it basically has kind of you know the hero block up the top is just how much total of money has been raised and we already have some money raised even though we haven't launched yet this has been recorded like a few days before we launched so sorry for that and the website might change because vibe coding is so much fun so don't hold me to this design but we have we have we kind of have the total amount raised from the ecosystem in this project and this this initial amount is because actually this first grant from Solidity is already in progress and they already have some money committed to it they just can't finish it because they

12:29don't have the full budget and so this money is committed by Argot who runs Solidity and they have this cool project called ETH debug and ETH debug allows developers to see line by line what like why is their contract failing what what happened in the in the you know the state that didn't work and it'll help make it easier for debugging contracts which just speeds up everybody's Solidity development so yeah it's it's a great grant the right team is working on it you can donate to it directly or you can you know even withdraw from an exchange so you can see that it's like these undone eating and also if you wanted to you can make a pledge so here's like the example of a pledge Argot Collective has already pledged 151k to this project and so you know we know that

13:29they're committed to doing this and hopefully that can attract other people to commit they don't have to put in that money right away that's the coolest part they just have to sign a deal with us and that says that they will commit it if we raise the full amount now in this case they're already doing it and they're already starting some of this work so they don't have to sign an agreement with us but for other initiatives they will now the coolest part in the part I really want it to put out there to the community is like you have had all have had experiences or you've lost money in crypto or where something didn't go well for you there's so much trauma in our collective intelligence around the problems of Ethereum security I would like to go head on into that trauma what can we do to fix it if you have an idea of something that you can do to fix it you can really easily make a guide make a proposal it's AI these days right so you can just

14:32copy this guide that's on the suggest initiative page throw that into your lllm of choice and just talk to them just talk to your talk to your AI it'll ask you questions it'll set you up and then you can just and then it'll spit out exactly what you want to paste into this thing you if you have an agent it can probably do this for you so you don't even have to execute it it'll fill this out for you so super easy to put up together initiative when initiatives are submitted they are reviewed by us it's not like every initiative goes up but this is really the the crux of the matter especially for this month like I said this round is going to go until the end of January so at the beginning of the round we're really focused on building I was telling some another crew like I don't want this to feel like a food court in the mall I want this to be like a bomb like a Thai food market where there's lots of great cheap options and you don't even know

15:36you can't you're gonna have to like buy a few things because there's so many good things you know and so to do that we need competition we need lots of good ideas we need lots of teams that are executing amazing ecosystem-wide initiatives that can make Ethereum safer and the only real requirement is that it's making Ethereum safer it's not improving privacy that's ETH systems right it's not like hardcore research that's ETH labs it's not just trying to make institutional adoption happen that's Ethereum institutional we're the Dow security fund right we're we're focused on security and we want to stay in our lane so bring us security focused initiatives that can help users save funds help builders build safe products and it will make it up here very cool I see also a Giveth is going white label here so this is all branded the Dow that fund

16:38not Giveth yes so maybe I can just talk about the relationship between Giveth and the Dow Security Fund because it's not super clear in our public come but basically the Dow security fund is the talc buterin jordy bilina taylor monahan pc syrachio who's running seal 911 i'll expand the sunday lansky from dot-node and me okay these are very busy people they're not they're really not able to execute on anything let's just be real all the they make all the decisions they are the curators of the Dow but they don't they don't have the energy to execute so Giveth is effectively the executor and and I really like this model and we talked about this before this model of having a board who has to kind of challenge the executors right so Giveth is a fix give it in me as the founder and CEO of Giveth we don't have a CEO title I don't

17:40know we never really did titles but I digress they you know I get challenged by these geniuses right and they have great ideas and I have to make my case for why we should do something and that really creates a great environment and so Giveth is the executor of the Dow Security Fund but the Dow Security Fund is its own brand it is doing its own thing it has a very different use case than Giveth it's trying to make Ethereum more secure well Giveth is trying to do a lot of other things build something better than governments support our donation application which is working on V6 you know they're very different work streams kind of different people but our work from the Dow actually helps us fund the more nonprofit direction that Giveth takes yeah super clear um yeah the structure that's sort of in my mind here is like a picturing an hour glass where you've got the ETH security badge holders the Dow the Dow fund badge holders excuse me they're

18:44focused on security they kind of have like a top down theory of change of what we need to do in order to make Ethereum more secure and then you've got this sort of like bottoms up structure where people can can propose grants or RFPs things that are going on in the community and so this hourglass sort of structure in which you've got like a top down theory of change and then you've got a bottoms up submissions from the community and I almost picture like Giveth or like the software that you're building as the substrate between the two I'm not sure if that's an accurate mental model but as far as the construction goes for making change in your specified domain which is making Ethereum more secure I think having like you know these really cracked developers at you know Vitalik Jordi or the ones you mentioned and then the bottoms up anyone can participate there's a certain like elegance uh between like that democracy and technocracy there and I'm curious to see how how that goes yeah and and the the one piece I want to add to that is market dynamics one of the things that's really important to us is that it's not just yes the Dow does have these 200

19:49Ethereum security badge holders of which the curators are all part of that group and they do have like a lot of influence over what we do and what we say but I'm gonna butcher a quote from Ludovon Mises or paraphrase kind of a concept that he's really into which is uh Ludovon Mises is like I don't know a very famous guy who wrote human action and very deep and libertarian philosophy but he basically said that when people are using other people's money to fund other people's initiatives there's guaranteed to be waste and that's a that's just true you know it's hard when you have a market dynamic people have profit as an incentive they have uh their shareholders there's everyone's trying to make money and there's this like um elegance uh to the market dynamics but in public goods that's really hard to abide by because uh how do you provide free security for

20:52everyone uh with market dynamics so we're trying to figure out how we can bring in those market dynamics into it as much of what we do and so for this round for instance there's kind of a gate the Dow will fund a bunch of these projects with its funds but it will only fund the ones that have um some sort of market adoption from the ecosystem uh we're playing with these numbers so but so I don't have exact exact numbers yet but it'll be something like x percent of funds need to have come from you know some number of independent groups for the initiative before the Dow will fund it and uh there's probably also going to be a cap of how much funding one initiative can get from us so for instance we have a really great initiative uh from Viper formal verifying the Viper client it's something that would be so cool to have out there where you could actually you know formal verification is what they use for software and airplanes what they use for software in the military

21:56like things that cannot fail get formally verified and now with AI formal verification is something that you can legitimately do for a lot of software and if we could formally verify uh a client for you know um solidity or or or Viper then you can know for sure that there's not going to be some kind of compiler bug that just makes a lot of money vulnerable you you can't really you know if you audit your your code in your code could be safe but if there's a bug in the compiler then none of that code is safe if we can formally verify the Viper compiler that would be amazing but it costs like $600,000 and we might maybe we have a cap of like $200,000 for the Dow to put in so if we want that if the community wants that initiative to actually go through uh the Dow won't even touch it unless it raises like 400k now these 200k might not be the final number this is something the curators have to

22:59decide uh but you get what I'm saying there's there's like in what we're doing we're not just going to pick and choose the projects that we think are great we need to see the community overcome the tragedy the comments challenges and actually put down money and say you know as a for-profit company it is worth it to see this initiative come to pass because I'm willing to put shareholder money into this because it will make me more profitable it will create benefits and that's that's really important to me and I and I actually think it's really obvious like this is going to happen it's just I want to I want it to happen now um because it just makes sense but if you think of a part uh Ethereum is an apartment building and every project has their own apartment right now it feels like every project is like lining their apartment walls with steel and putting a big vault door in front and has a dude with a shotgun standing in front of their hotel their apartment door

23:59and you know they look to their side there's another dude with a shotgun over there and another dude with a shotgun over there but there's not even a door man on the apartment building you know maybe one project wants to put up cameras and another project wants to put up cameras another and so they all want to put up cameras and they all go to the camera guy and they all pay them a bunch of money but if we just all got together and those four projects instead like of paying the camera guy independently we just like have a camera system for the whole building I bet it would be cheaper the four projects would save money by actually just coordinating to buy a camera monitoring system uh for the whole building and everyone in the building would be safer so it's just there this is a clear win win we it's the same thing for Ethereum instead of monitoring just these smart contracts let's just monitor more you know uh so there's some really cool initiatives that just make sense to fund we just have to coordinate it and I hope that we can become a

25:00shelling point for funding coordination around security beautiful example this very pulp fiction of you uh everyone having their own security versus building common security and I think that what's beautiful there is that you're sort of building collective action around something where just with a little bit of coordination and creating a shelling point around um in your physical example and apartment buildings uh security system uh but in Ethereum's example like Viper form or formal verification um you just need to have people coordinated towards that shared uh outcome and then you get an economy of scale and everyone sort of saves money and gets the outcome that they want I think that's like a vital vital role the coordination that you're provided there yeah yeah and and and I think the coolest thing is people will save money by coordinating on security the economics of scale are ridiculous uh it we can we really got to stop funding the hackers I'll tell you right now like you know it's a it's a good business to be a black hat in Ethereum I mean now

26:04they're even calling themselves white hats I don't know if you saw a couple days ago there was this guy who hacked some bitcoin bridge basically and stole three hundred million dollars and decided to keep 50 million as a white hat bounty right I mean okay good luck with that dude that's not you know this is uh this how much better would it have been if there was just a bug bounty program there that for all of these bitcoin you know projects for instance now the Dow security fund is focused only on Ethereum but just as an example it's like it is there are so many hacks happening in there's so many problems in the security space that we need to solve if we won't real adoption in our space I think it's the main thing holding us back from mass from like mass market acceptance to be honest this gams the fraud so it's definitely one of them yeah do you think that uh you know if you're a quantify the goal of the Dow the Dow dot fund uh is the is the goal

27:10to reduce the volume and the amount of revenue that goes to black hats from hacks like over time I think that that number has been in the hundreds of millions in the past uh per year and it may even be in the billions but uh over time I think if you're successful that number would go down is that to reductionists to try to quantify it in that way? I honestly I like a more of a qualitative a goal but yes I think that would be that would be a total fair thing I think to some extent that's more of a a quantifiable goal for seal 9-1-1 for us we are mostly focused on funding and funding coordination so it's kind of like how how many it's going to be hard to contribute our work to preventing those hacks because there's a lot of other uh things to make you know um I feel like phishing scams and air drops air drop scams through phishing scams and address poisoning these courts

28:12sites uh sort of things it's like a lot of people losing a lot of money and to me that's even worse you know I want to like a vibe of do you think Ethereum is safe? uh some kind of metric there like for for me uh the qualitative goal of the Dow Security Fund is to make Ethereum safer than banks we can be safer than banks we we we can avoid one risk banks can't which is custodial risk so can we build infrastructure to make Ethereum safer than banks it's possible we have the tools we have the the foundational layer to do that let's do it and that's that's my like aspirational goal you know I want to see how many mortgages to quantify how many mortgages are done with banks versus done on Ethereum on people's houses you know that's that's something that I would like to see how many people are saving their life savings on Ethereum versus in a bank I think one profound thing that y'all are trying to do is

29:17take the security posture of the space and move it from reactive to proactive and what I mean by that is you know someone gets hacked they hit up Zach XBT or seal 911 and they're like help let me give my money back and that's like a reactive sort of posture but this is one of the first things that I've seen that is about getting Ethereum security to be more proactive and so my interpretation of that is that by creating these funding coordination shelling points you're actually able to put more defensive posture into the software and into the culture that prevents hacks and you know that old saying is that announcement prevention is worth a pound of cure is that a fair framing? Absolutely absolutely that is that is what we want to do I think that's like that's the core of it and then the way I would pitch it to companies is basically we spend too much on security we spend way too much on security audits on unlike you know monitoring software

30:19threat intelligence all these things you know working with three letter agencies around the world and managing all these different processes what if we just you know found systems that could if we all collectively throw in a little bit we don't have to spend so much up front to be secure all right well we have 10 minutes left I want to try something new before we wrap and that's a lightning round of questions are you ready? Let's do it yeah totally okay the biggest Ethereum security threat the incentives the incentives for being a bad guy are way better than the incentives for being a good guy Ouch okay what's the most underrated public good? I mean wow that's tough there's a lot I think it's probably shared infrastructure you know it maybe it's maybe it's a cop out because it's such a broad topic but it's like the solidity compiler you know like who cares about that who who's getting audits on that right you know water in your in your neighborhood you know having clean water come out of the tap you know you don't

31:22realize how great it is until it's gone you know so yeah shared infrastructure yeah best funding mechanism wow that is really tough so hard to choose one isn't it I do I mean I do have a special place in my heart for quadratic funding but I think there's there's I'm excited if the curators will let us experiment with participatory budgeting I think it's under explored in our in our space and we're gonna try to explore this round with the vote so that that will be really fun so I don't know I'm torn I think quadratic funding is my favorite though yeah are you bullish on dowels in 2026 yes or no no I'm sorry I just know I wish yeah I got the Dow shirt right the Dow is back okay well maybe 2027 I just I think it has such a bad name and there's almost no effort into it I do think that there is a place for collective action

32:29and we got to keep experimenting to make it better but Dow has such a bad name it's gonna take a couple more years yeah that's fair what trends in technology and society are you excited about right now what's the most underrated underrated underrated and probably most popular AI I mean it's just incredible what what we're doing what is happening what I can do with like integrating AI into this application is so interesting like the search the search bar is not a page rank looking for algorithm looking for words just you type whatever you want we have a deep seek API it costs like not even a penny for like 10 searches and then it'll it'll take the words that you're thinking of and try to like pick the top three projects that relate to what you're looking at instant when people make comments you know when people submit initiatives I have an AI agent reviewing it right away

33:31and giving me some feedback when people are making comments because you can actually comments on the different initiatives we have auto AI moderation I don't think that we've seen AI really come into the like maybe yeah yeah when you go to Google you get like an AI chat bot like response but integrating AI and then robotics oh my god like like this is another reason why I just can't really be so excited about Dow's because like AI is gonna totally flip Dow's on their head we're gonna we're gonna have real Dow's with AI either in the middle or on the edges and then they just haven't been built yet okay so now that you said AI is the underrated trend now I'm curious to to lob this next one at you what's the most overrated trend to me I mean this is maybe it's a crypto focused trend and you know this might hurt my fundraising abilities but I think like tradify in crypto is like the most overrated bullshit like I'm just yeah I just

34:33get so frustrated and disappointed in the space when people are like but look you know like we have an ETF or oh you know this bank is now going to issue a stable coin it's like oh great I don't care that's very just like I'm glad that they use it but why is that the news you know why I don't care you know I like tokenized stocks and tokenized real world assets I think that's super cool but like just like oh look PayPal has PY USD okay well they can still freeze my account it doesn't matter if I have PY USD or they're little you know database balance no offense PayPal please support the Dallas security round it is it is kind of interesting to think about how so many people in this space got in this space because they have an anti institutional bent and now all

35:34the podcasts have banks on them and the institutions are who everyone's selling to because that's what the money is sorry I don't know it's an interesting either maturation or turn about yeah I mean I'm torn because I don't it's not that I'm I'm not I want them to play with crypto I do I really want them to but it feels like that's taken over so much of the narrative that it's like we forgot what we're trying to do here yeah okay well that's all the lightning round questions that I had anything that I didn't ask that you want to say before we wrap Griff I think we covered it all I just want to put it out there one more time like please go out there and tell us the security initiatives that you need to see there there's so much offer to me to coordinate around securing the Ethereum space there's so many things that can benefit us all and if we can just come together and and support them we will be better off you know I talked to a few people they're they're like you know there's one initiative and I was talking to a badge holder about it and he's like that's way

36:39too much money for that and it's like maybe maybe it is too much money for this one initiative but actually the value it will create will will be like 10 20x that cost maybe it seems like it's too much money but if it's so if it creates a lot of impact it's worth it it's absolutely worth it because that impact scales there's so many low-hanging fruit in the security space there's so much there's so much we can do especially integrating AI and if we don't do it on on the good guy side the bad guys are going to take advantage of it so we have to we have this cat and mouse we have this AI race we need to start applying these AI models in really interesting ways to secure Ethereum I want to see more ideas about that suggest an initiative even if you have no basis for it tell us your problems come into this come into the Dow security fund let's build a community who cares about security and Ethereum and and I'm happy to support you in making that initiative great

37:45so that we can actually make it a reality and it'll be really fun it'll be really fun so I hope you guys can join us if you're watching this like don't be don't be shy about spending like 10 to 30 minutes just talking with an LLM to come up with an initiative our goal is to have around like at least 50 to even 150 initiatives on this board so that we can have a true market competition of ideas and let the best ideas win and then let's let's fund it together well I think that's a beautiful place to wrap if you're listening check out the dow.fund and get involved in the dow fund round that was just announced today Griff thanks so much for joining the podcast thanks for having me already we just heard from Griff Green I am really inspired by the Dow security fund I think it is a public good that Ethereum store really needs to be more secure and to pool funds to create more security for everyone to create more defensiveness against hackers and I think the Dow security

38:48fund is doing some of the most interesting work and experiments in on chain coordination in the 2026 cycle so if you're a security researcher builder company or community member with an initiative that can make Ethereum safer check out the dow.fund or tag them on x at the dow fund all right if you enjoyed this episode I hope you keep coming back from our greentails talk to you soon bye you