AlphaCOLLAB runs on GenesisL1 mainnet and has had no external audit. Use small amounts.Security notes

COLLAB

How COLLAB works

COLLAB has three parts: contracts on GenesisL1 that hold the assets and enforce the rules; a static website that reads the chain in your browser and sends transactions through your own wallet; and, optionally, a server kit that serves the site, keeps static copies of its pages fresh and gives the operator an admin page. This page explains each part, how they fit together, and whom you trust when you use them. It is for anyone who wants to understand what they rely on; developers will find the details on Architecture.

Part
Overview
Version
COLLAB 2.2.0
Updated
Reading time
7 min
View as Markdown
OverviewPages

Overview

On this page

The contracts

The factory and a DAO's six contracts

A DAO is created by a single transaction to COLLAB's factory, DAOFactory. That transaction creates six contracts as minimal clones (EIP-1167) of fixed implementation contracts, sets them up and wires them together, so there is no moment when a half-built DAO could be taken over. Their addresses are known in advance: they follow from the creator's account, a random number the creation wizard keeps, and each contract's role.

A DAO's six contracts, drawn as a molecule. The treasury at the centre holds the assets and is the DAO's address; the contracts bonded to it take its orders, and it acts only when the governor executes a passed proposal. The governor reads voting power from the shares and has the policy check every proposal.
ContractWhat it does
Treasury (DAOTreasury)The DAO's address and vault. It holds the assets and is the only account that acts for the DAO: when people say "the DAO", they mean this address.
Governor (DAOGovernor)Proposals, deposits, votes, tallies and execution.
Shares (ShareToken)The DAO's share token. Shares carry the votes.
Policy (DAOPolicy)The calls each proposal type may make, which need the critical rules, and the GL1F collections and CIPNFT contracts the DAO uses.
Profile (DAOProfile)The DAO's permanent name, its logo and description (kept in its own storage and rewritten in place), links, announcements, constitution versions and representatives.
Key vault (CipherVault)The DAO's seat in CIPNFT, the sealed-data protocol: key stewards, key epochs, reveals, declassifications and purchases.

The factory keeps the register of DAOs: each DAO's number, its six addresses, its creator and creation time, and its web address, which it looks up both ways. It reports its version as "COLLAB DAO v2.2.0".

None of these contracts has an owner, an admin key, an upgrade path or a pause switch held by anyone outside the DAO, and the factory has no admin either. The implementation contracts locked their own setup when they were deployed, so they can never be set up or used directly.

Protocol contracts shared by every DAO

Some contracts serve every DAO:

  • TextStore keeps texts on-chain, addressed by their keccak256 hash and never changed once written: constitutions, announcements, proposal descriptions and token logos. A text takes up to 64 parts of 24,000 bytes, stored as contract code.
  • CollabKeyring holds members' public encryption keys, for sealed data shared with them.
  • TokenLauncher creates the ERC-20 tokens DAOs issue (DAOToken), with their allocations and pools, and MemberDistributor runs member airdrops.
  • DeSciFi, COLLAB's exchange: DeSciFiFactory, DeSciFiPair, DeSciFiRouter, and LockFactory with its LockBox contracts.
  • PolicyBuilder writes the default call policy of every new DAO.
  • The lenses, DAOLens and MarketLens, are read-only contracts that gather what a page needs in one or two calls. They hold nothing and have only views.

Deploying COLLAB on a chain means creating 20 contracts: these, the six implementations and the factory. COLLAB also works with GenesisL1 contracts it does not control: wL1, the wrapped form of L1; CIPNFT for sealed data; and GL1F for machine-learning models. Each DAO chooses which GL1F collections and CIPNFT contracts it uses; see Integrations.

The website

Static files that read the chain

The website is a folder of static files: HTML, CSS and JavaScript, with no build step and no framework. Any web server can host it. There is no account to sign up for and no database behind it. Your browser reads GenesisL1 directly through a JSON-RPC endpoint, one of the site's or your own, and every number on a page comes from the chain at the moment it is shown. One file, config.js, tells the site which chain, endpoints, explorer, contract addresses and integrations to use. Your own settings stay in your browser; see Wallets, networks and settings.

The site checks what it reads before it shows it:

  • texts, logos and descriptions are shown only when they match the hash the chain records for them;
  • a proposal's actions are shown only when they match the fingerprint the governor stored, also through your wallet's network when a wallet is connected;
  • names and texts from the chain are shown as text, never as HTML, and Markdown is rendered with raw HTML and images switched off.

A strict Content Security Policy lets pages run only the site's own scripts and reach only the site's endpoints and price service; no third-party scripts, fonts or CDNs are loaded, and the libraries the site uses, such as ethers.js and markdown-it, are served from the site itself. The one exception is Google Analytics, on a site whose operator turns it on, and only after you accept it.

Your wallet signs

Every change is a transaction you sign in your own wallet. Before your wallet opens, COLLAB simulates the transaction, so a failure is explained before you pay for it; it reads the DAO's addresses again through your wallet's own network, and sends nothing if they differ from what the RPC endpoint reported; and it puts chain ID 29 into the transaction. The site never sees your keys.

What a COLLAB server adds

The release includes a server kit for Debian and Ubuntu (server/install.sh). An operator who installs it gets:

  • nginx with HTTPS. Let's Encrypt certificates, the main host name (by default collab.genesisl1.com) and its aliases redirecting to it (dao.genesisl1.com, collab.descifi.org and dao.descifi.org), with security headers and the Content Security Policy.
  • The admin page at /admin. From it the operator deploys COLLAB's contracts with a browser wallet and checks any deployment, and, signed in with the admin token, publishes the deployment to the site, edits the site settings (the alpha strip, an announcement, featured and hidden DAOs, verified and hidden tokens, texts for search engines, links, analytics, RPC endpoints and the explorer) and watches the server's status.
  • The prerender job, every 10 minutes and on request. It writes a static page for every DAO, at its web address, and for every token, for search engines and link previews; the sitemap and preview images; a copy of each DAO's on-chain logo and description under /data/, which browsers check against the hashes on chain before using it; the data behind the tokens list; and a snapshot of L1's price from CoinGecko, so that visitors' browsers need not contact CoinGecko for US dollar amounts.

The public site does not depend on any of this: if the admin service or the prerender job stops, pages still load and read the chain in your browser. Before the operator deploys the contracts, the site runs in an undeployed mode, in which every page loads and says "COLLAB is not deployed on this site yet".

What the server never does:

  • It holds no wallet keys and no funds. The deployment is signed in the operator's browser wallet, and visitors sign in theirs. The server's only secrets are the operator's admin token, two secrets of the admin service (one signs its sessions, one proves that a request came through nginx) and, as on any HTTPS server, its certificate's private key.
  • It keeps no visitor data. There are no accounts and no database of visitors. Like any web server, nginx sees requests for its files and keeps its usual access log.
  • It cannot change a DAO. The operator controls the website, such as what it lists or hides and its default endpoints, never the contracts. Hiding a DAO or a token on a site changes nothing on chain, and its pages stay reachable by their address.

The site also runs without the kit, on any static host; it then has no admin publishing, no prerendered pages and no price snapshot. Running a COLLAB site covers installing and running a server, and Hosting without the server kit the alternative.

The trust model in brief

What the contracts guarantee. Nobody, COLLAB's authors included, can change a DAO's code, freeze it or move its assets. Only the DAO's own passed proposals can, within the call policy the DAO set, and a passed proposal waits out its timelock in public before anyone can execute it.

What you still trust:

  • the DAO's members: a proposal that passes the critical rules can do anything, including moving the whole treasury, and the timelock is warning time, not a veto;
  • the key stewards, who can read the DAO's sealed data;
  • the administrators of the GL1F and CIPNFT contracts a DAO uses, who keep powers over those contracts;
  • the RPC endpoint, for what you see: it cannot sign for you, and COLLAB checks what matters through your wallet's network;
  • your wallet, for what you sign;
  • the site's operator, for the website's code and settings: use the site's real address.

Alpha. COLLAB 2.2 is new, and it runs on GenesisL1 mainnet with real L1: the alpha is tested in the real environment, not on a test network. Its reviews were AI-assisted and done apart from the implementation work, and there has been no external audit. Use small amounts. Security at a glance explains each point, and Security is the full security model with every finding.