# Lido tiebreaker committee (one pager)
![upload_ad0527e76089dfa79d23c49d5cf120b3](https://hackmd.io/_uploads/SJPZKfPAT.png)
## What is dual governance?
Dual governance is an important step towards mitigating Lido protocol governance risk. It represents a move away from shareholder capitalism to stakeholder capitalism. And provides a practical way for Ethereum stakers to have a say in Lido protocol changes.
The main goal is to prevent LDO holders from changing the social contract between the protocol and stETH holders without their consent. Today LDO holders have important powers over the protocol that can result in important changes to this social contract. These include:
- Upgrading the Ethereum liquid staking protocol code.
- Managing the list of the Ethereum consensus layer oracle committee members.
Changing how the stake is distributed between node operators in a potentially harmful or unexpected way (e.g. adding or removing whitelisted Ethereum node operators).
- Changing the governance structure in an unexpected or potentially harmful way (e.g. minting or burning LDO, changing the parameters of voting systems).
Changing the total fee percentage of the Ethereum liquid staking protocol outside of the agreed boundaries (as well as defining these boundaries).
Deciding on how to spend the treasury
All of these powers, apart from treasury spends, directly affect stakers. Dual governance v1 allows stETH holders to veto most of the above changes to the Lido protocol, in a way which does not introduce new attack vectors, or overburden stETH holders with politics.
## What is the tiebreaker committee?
The tiebreaker committee is a complex multisig that has the ability, under very specific conditions, to execute decisions that were proposed and approved by LDO holders but subsequently blocked by stETH holders.
Note that it only obtains this right under a potentially catastrophic edge case in which the gateseal committee has paused withdrawals post veto. If this power didn't exist, then stETH holders who are in the middle of rage quitting could be prevented from withdrawing indefinitely.
While the gateseal committee (see below) is optimized for speed of reaction, the Tiebreaker committee is designed for maximum security and wider ecosystem alignment: It is expected to composed of 3 or 4 sub-committees (some of which are expected to be fully-fledged DAOs). Each of these subcommittees represents a distinct interest group within the ecosystem. Any decision it makes needs to be approved by a majority (2/3 or 3/4) of sub-committees. And for each individual sub-committee to approve a decision, the latter should be supported by the supermajority of the sub-committee members. Note that no sub-committee may share members with the Gate Seal committee.
## How should the tiebreaker committee be structured?
There are many ways the committee can be structured. For example, we could have 5 subcommittees consisting of:
1. DAOs: Maker, Curve, Aave, Compound, Safe
2. Representatives from the L2s and the x-chain ecosystem
3. Representatives from the EF
4. Node operators
5. Cypherpunks / OGs / trustworthy community members
Any feedback / ideas are welcome at this stage
## How fast does the tiebreaker committee reaction time need to be?
Since the worst case is the DAO essentially being frozen, there is no need for a quick reaction time. In fact, it's ok for the process to take on the order of several months. **Note that this committee is never expected to be used. It's really a last resort to deal with an extremely unlikely edge case.**
## What is the gateseal committee?
The gateseal committee is a 3/6 multisig that has the power to pause stETH to ETH withdrawals for 6 days. You can think of it as a safeguard against a withdrawal vulnerability being exploited by an attacker.
The pause lasts for 6 days or, in the case that DAO decisions are blocked by stETH holders, until the execution of DAO decisions is unblocked.
Importantly, the gateseal committee can only enact a pause once before losing its power (it has to be re-elected by the DAO after that). In case of non-use, the multisig automatically expires on a fixed date in the future – currently set to May 1st 2024.
At any time, the DAO can vote to appoint a new Gate Seal committee with a new expiration date.