Renew Guardian Module Mandate & Re-confirm Guardian Set

The guardian cancellation path was the only defence that worked, because the attack was specifically designed to neutralize the Timelock. The report's conclusion is the argument for this SIP in one line: that defence existed only because of a prior governance decision, made before it was needed.

2.3 Measured performance to date

From the https://forum.summer.fi/t/guardian-multisig-transparency-reporting-thread/787, time from transaction creation to execution:

2.4 Why renewal is correct under either strategic direction

The DAO is deciding its future in https://forum.summer.fi/t/rfc-determining-the-future-direction-of-lazy-summer-dao/868. Renewal is the right action under both branches:

• Option A (Continue Building): a protocol rebuilding after an exploit needs its emergency brake more than a stable one does.
• Option B (Orderly Wind-Down): The RFC explicitly lists maintaining governance security while treasury decisions are finalized. A DAO consolidating a treasury is a more attractive governance-attack target, not less; and the April attempt shows the cost of attempting one is trivial. Letting the brake lapse precisely while assets are being moved would be the single worst-sequenced decision available.

3. Specification:

3.1 Summary of actions

3.2 Onchain execution to extend guardian expiration

Function (ProtocolAccessManager, per SIP0.2):

function setGuardianExpiration(address account, uint256 expiration)

Target contracts:

{
"base":     "0xf389BCEa078acD9516414F5dabE3dDd5f7e39694",
"mainnet":  "0xf389BCEa078acD9516414F5dabE3dDd5f7e39694",
"arbitrum": "0xf389BCEa078acD9516414F5dabE3dDd5f7e39694",
"sonic":    "0xAFb8a8beA8F7CdB4b65437b0c5963dc7Cd270bC6",
}

account parameter is the Guardian Safe:

0x91E4482CF58aC14d8DC25290d828b2A4D9492BA4

expiration parameter proposed value:

1800000000

Cross-chain routing. Governance executes on Base and propagates via LayerZero. The April attack analysis confirms live LayerZero routes to Ethereum, Arbitrum, and Sonic, if the governor cannot reach those ProtocolAccessManager instances via the standard dispatch, this SIP must specify an alternative path (e.g. Foundation execution instruction, as used in SIP5.17) rather than silently leaving chain unguarded.

3.3 Proposed transaction set

Assuming role-on-Safe and LayerZero reachability, the Base proposal contains:

3.4 Guardian set and threshold

Powers are unchanged. This SIP renews the SIP0.2 mandate verbatim: vault pause, deposit-cap override to 0, and proposal cancellation; no fund movement, no parameter tuning, no strategy onboarding; reactive use only, under the SIP0.2 trigger thresholds (≥4% realized or projected loss at fleet/ark level, active or credible exploit, severe oracle failure, or external protocol failure materially impacting vault safety). No expansion of authority is proposed or implied. Signer re-confirmation. All eight guardians are asked to re-confirm in-thread before the vote opens, explicitly acknowledging continued availability:

3.5 Compensation is dormant, and stated plainly

SIP0.2 allocated 15% of DAO-managed vault income to a guardian compensation pool, distributed only while guardian powers are active. With vaults paused, this income is effectively zero, and guardians are therefore serving unpaid. This SIP proposes no new compensation and makes no claim on the treasury. It is recorded here so the DAO understands what it is asking: eight people to remain on call, retain key custody, and accept public accountability for emergency actions, with no compensation, during a wind-down. That is a reasonable ask given the stakes, but it should be an acknowledged one, not an assumed one, and it is a further reason to expect and accommodate rotation.

3.6 Timing

4. Risk Assessment:

4.1 Risk of not renewing (the primary risk).

The DAO loses vault pause, cap override, and proposal cancellation. A governance attack on this DAO costs roughly $30 (22/07/2026) to attempt; and therefore the Timelock alone is insufficient, the April attack was purpose-built to strip CANCELLER_ROLE. An unguarded window during treasury consolidation is the highest-risk configuration available to the DAO.

4.2 Centralization of emergency power.

Unchanged from SIP0.2 and mitigated identically: narrowly enumerated powers, no fund movement, 75% threshold, expiry-based renewal, mandatory transparency reporting. This SIP expands nothing.

4.3 Guardian inactivity or capture.

Mitigated by re-confirmation, and rotation to identified backups. Residual risk: signers are unpaid during a wind-down, which may degrade responsiveness over the renewal period. The liveness check is the detection mechanism.

4.4 Governance capture preventing renewal / conflict of interest.

I am a guardian and Safe signer. The mitigation is procedural: no expansion of powers is sought, no compensation is requested, the full signer set is subject to re-confirmation and rotation, calldata is published for independent verification, and delegates are explicitly invited to contest the threshold recommendation.

4.5 Renewal fatigue.

A fixed January 2027 expiry creates another cliff. If the DAO winds down and governance participation thins, a future renewal may struggle to reach quorum. The DAO should treat the January date as a hard calendar item and (if Option B proceeds) decide deliberately how the guardian function terminates, rather than letting it lapse by inattention.

5. Voting:

If YES - Renew the Guardian Module mandate: extend guardian expiration to January 2027 across Base, Ethereum, Arbitrum, and Sonic; re-confirm the guardian set unchanged from SIP0.2. If NO - Do not renew. Guardian powers lapse on ~9 August 2026, and the DAO returns to a governance-only emergency posture with no proposal-cancellation path.

Tagging @Recognized_Delegates for review ahead of the onchain vote, and all current guardians for re-confirmation: @blockful, @Raphael_Anode, @halaprix, @MasterMojo, @JavierD, @chrisb, @Sixty. Backups: @Thomas, @TokenBrice, @Meta. --jensei