[GAP-3 Response] Enhanced Proposal for Conversion of Recovered ETH to ZK with Penalty Mechanisms
Summary
This proposal responds to GAP-3: Authorization for Security Council to Convert Recovered ETH into ZK, which seeks to authorize the ZKsync Security Council to convert 1,800 ETH, recovered from the April 2025 airdrop exploit, into ZK tokens for the benefit of the Token Assembly. While GAP-3 is a constructive step, it lacks mechanisms to address the security breach’s impact on community trust and to deter future vulnerabilities. This proposal supports the ETH-to-ZK conversion but enhances GAP-3 by adding: (1) a 5% burn of recovered ZK tokens (approximately 2.23 million ZK) and (2) a market buyback of 333 million ZK tokens (three times the stolen amount). These measures aim to restore trust, ensure accountability, and strengthen the ZKsync token economy.
Background
Incident: On April 15, 2025, a vulnerability in an admin wallet allowed the sweepUnclaimed() function in the airdrop contract to be exploited, resulting in the theft of 111 million ZK tokens.
Resolution: The ZKsync Security Council offered a 10% bounty and a 72-hour safe harbor period, recovering 90% of the stolen assets (44.6 million ZK tokens and 1,800 ETH).
GAP-3 Proposal: GAP-3 authorizes the Security Council to transfer the recovered ETH to ZKsync Era and convert it into ZK tokens at their discretion, aligning with the Token Assembly’s interests.
Current Status: The recovered assets are held by the Security Council (multisig: 0xBDFfCC71FE84020238F2990a6D2954e87355De0D), awaiting governance approval.
Problem
GAP-3 effectively addresses the disposition of recovered ETH but overlooks the broader implications of the breach. The admin wallet vulnerability undermined ZKsync’s credibility and community trust, as evidenced by a 2% drop in ZK token price post-recovery. As emphasized in the ZK Credo’s principles of trustlessness and reliability, a penalty mechanism is necessary to meet the community’s expectations for justice. Additionally, the absence of deterrent measures may weaken incentives to prevent future security lapses, potentially exposing the protocol to further exploits.
Proposal
This proposal endorses GAP-3’s intent to convert recovered ETH into ZK tokens but proposes two additional mechanisms to address the breach’s impact and enhance community trust:
- Conversion of ETH to ZK (Aligned with GAP-3):
- Support the Security Council’s authority to transfer 1,800 ETH to ZKsync Era and convert it into ZK tokens, as outlined in GAP-3.
- The conversion should be executed transparently via an on-chain mechanism (e.g., a DEX swap or the ZkCappedMinter contract: 0x5A7d6b2F92C77FAD6CCaBd7EE0624E64907Eaf3E), following a community-approved rate and timeline.
- Penalty Mechanism:
- ZK Token Burn : Burn 5% of the recovered 44.6 million ZK tokens (approximately 2.23 million ZK) to compensate for the community’s loss. This reduces token supply, supports ZK’s value, and signals accountability. The burn should be executed via an on-chain smart contract, audited for transparency.
- Market Buyback: Buy back 333 million ZK tokens (three times the stolen 111 million ZK) from the market to demonstrate ZKsync’s commitment to rectifying the breach. This should:
- Be funded by ZKsync’s reserve funds or future ecosystem revenues managed by the ZKsync Foundation.
- Occur gradually over 12-18 months to maintain market stability and liquidity.
- Allocate repurchased tokens to the community treasury for uses such as staking, developer grants, or ecosystem growth (e.g., Ignite Program).
- Future Safeguards:
- Enforce stricter multi-signature (multisig) requirements for admin wallets, requiring at least 9/12 signers for critical actions, as per the Security Council’s structure.
- Mandate regular security audits by third-party firms (e.g., Cantina, Code4rena), with public reports shared on the ZK Nation Forum.
- Community Engagement:
- Submit this proposal for voting on the ZKsync Governance Portal (https://vote.zknation.io) with a minimum 7-day discussion period.
- Encourage feedback from Token Holders, Delegates, Guardians, and the Security Council on the ZK Nation Forum to refine the burn rate, buyback scope, and funding strategy.
- Request that the Guardians evaluate this proposal against the ZK Credo to ensure alignment with community values.
Impact and Metrics
- Restoring Trust: The token burn and buyback address community demands for justice, reinforcing ZKsync’s commitment to the ZK Credo’s principles of trustlessness and reliability.
- Token Economy : Burning 2.23 million ZK reduces supply, potentially increasing token value. Buying back 333 million ZK could boost market demand and stabilize prices post-exploit.
- Security : Enhanced multisig requirements and audits reduce the risk of future breaches, aligning with the Security Council’s mandate to safeguard the protocol.
- Metrics : Monitor the amount of burned tokens, repurchased tokens, audit frequency, and voting participation rate on the Governance Portal.
Legal and Technical Considerations
- The proposed mechanisms must comply with Austrian law and be coordinated with the ZKsync Association.
- Smart contracts for ETH-ZK conversion, token burning, and buyback execution must be audited and publicly accessible to ensure transparency.
- The buyback’s funding feasibility should be assessed, potentially leveraging the ZKsync Foundation’s ecosystem initiative funds (capped minters).
Response to GAP-3
GAP-3 is a well-intentioned proposal that streamlines the handling of recovered ETH, ensuring benefits for the Token Assembly. However, it lacks a penalty mechanism to address the breach’s impact on community trust and to deter future vulnerabilities. The proposed 5% ZK token burn and 333 million ZK buyback complement GAP-3 by:
- Providing a tangible consequence for the security failure, aligning with community expectations for accountability.
- Strengthening the token economy through supply reduction and increased demand.
- Demonstrating ZKsync’s proactive stance on governance, as emphasized in the ZK Nation’s community-driven framework.
We urge the Security Council and Guardians to incorporate these mechanisms into GAP-3 or support this as an alternative proposal to ensure a balanced approach that prioritizes both recovery and accountability.
Conclusion
This enhanced proposal builds on GAP-3 by supporting the ETH-to-ZK conversion while introducing a 5% ZK token burn and a 333 million ZK market buyback to address the April 2025 exploit’s impact. These measures restore community trust, strengthen the token economy, and align with the ZK Credo’s values of trustlessness and reliability. Community feedback is essential to refine this proposal and ensure it reflects the Token Assembly’s priorities.
Discussion
Please share your feedback on the ZK Nation Forum. We welcome input on the proposed 5% burn rate, the feasibility and funding of the 333 million ZK buyback, alternative penalty mechanisms, and alignment with GAP-3. Let’s collaborate to strengthen ZKsync’s governance and resilience.
BR
Kai
