## tldr The goal of the proposal is to revoke minting permissions on the first two deprecated thUSD contracts as a security measure. This involves a streamlined process that addresses operational challenges under the current governance mechanism. ## Background Threshold USD has been built as a public good for the Threshold Network. Value is created for the Threshold DAO instead of captured by a protocol token. Deployment Details: First Deployment: *https://etherscan.io/token/0xa10a5e2d813a51374592d6ce440b149f01cf9a7d* was deployed on Oct/5/23 Second Deployment: *https://etherscan.io/token/0xac76FAB49c7b24b15d564f348C248C6791888965* was deployed on Oct/18/23 The thUSD token was designed with governable safeguards due to contracts immutability (Persistent on chain over time). One such parameter allows for control over the token mint list. There is a balance between the certainty of immutability with adapting to new information * The deployed contracts are immutable so users can audit and trust them * Upgradability is preserved through a mintlist on the thUSD token contract * Changes to the mintlist are made through a two step, time gated governance vote on Governor Bravo * Governance votes can be vetoed by the Threshold Council After the first deployment, it quickly became apparent that a new set of thUSD contracts had to be redeployed to correct and improve a performance feature in the stability pool, which is responsible for protecting the system during collateral liquidation processes (for details refer to the discussions in the B-protocol channel on discord). In contrast, the second deployment had to be also deprecated shortly after its launch due to a vulnerability reported by Tellor in their contracts. Since Tellor contracts are also immutable, it was essential to update our contracts to reflect the newly fixed Tellor price feed. Based on these discussions, a fix was implemented with the redeployment. **Therefore the first two sets of contracts were then deprecated.** ## Proposal As an additional security measure, the DAO should revoke Mint authorization for the collaterals on the deprecated first two thUSD token contracts. Authorized contracts to mint thUSD are the old borrowerOperations contracts for both collaterals (tBTC and ETH) of each deployment set. ### Revoke Mint Process The revoking mint capability process involves two steps on the token contract, executable only by the owner, which is Governor Bravo. The steps are startRevokeMintList and finalizeRevokeMintList, with a 90-day governance delay. This needs to be executed for the borrowerOperations contracts of each collateral for both sets of deployments. First Deployment BorrowerOperations for tBTC Collateral: 0xB38EE6134D20344f7Cb0DE58a2E857209F307072 [*(verify here)*](https://github.com/Threshold-USD/dev/blob/fb15ebed750fe1e206aa2a1b01fc4ad30c324e1b/packages/lib-ethers/deployments/default/tbtc/v1/mainnet.json) BorrowerOperations for ETH Collateral: 0x5E8e6374605C1FA413F50fB2bF9191bE20cc0f7E [*(verify here)*](https://github.com/Threshold-USD/dev/blob/fb15ebed750fe1e206aa2a1b01fc4ad30c324e1b/packages/lib-ethers/deployments/default/eth/v1/mainnet.json) The current BorrowerOperations contract mint capability of the first thUSD token deployed can be checked in mintList function in ](https://github.com/Threshold-USD/dev/blob/fb15ebed750fe1e206aa2a1b01fc4ad30c324e1b/packages/lib-ethers/deployments/default/eth/v1/mainnet.json)https://etherscan.io/address/0xa10A5e2d813a51374592D6ce440B149F01CF9A7D#readContract [1. The ](https://github.com/Threshold-USD/dev/blob/fb15ebed750fe1e206aa2a1b01fc4ad30c324e1b/packages/lib-ethers/deployments/default/eth/v1/mainnet.json)Governor Bravo calls startRevokeMintList for BorrowerOperations for ETH Collateral (0x5E8e6374605C1FA413F50fB2bF9191bE20cc0f7E) on the thUSD token contract [0xa10a5e2d813a51374592d6ce440b149f01cf9a7d](https://etherscan.io/token/0xa10a5e2d813a51374592d6ce440b149f01cf9a7d). 2[. ](https://github.com/Threshold-USD/dev/blob/fb15ebed750fe1e206aa2a1b01fc4ad30c324e1b/packages/lib-ethers/deployments/default/eth/v1/mainnet.json)After the governance delay of 90 days, Governor Bravo calls finalizeRevokeMintList on the thUSD token contract [0xa10a5e2d813a51374592d6ce440b149f01cf9a7d](https://etherscan.io/token/0xa10a5e2d813a51374592d6ce440b149f01cf9a7d). 3[. ](https://github.com/Threshold-USD/dev/blob/fb15ebed750fe1e206aa2a1b01fc4ad30c324e1b/packages/lib-ethers/deployments/default/eth/v1/mainnet.json)The Governor Bravo then calls startRevokeMintList for BorrowerOperations for tBTC (0xB38EE6134D20344f7Cb0DE58a2E857209F307072) on the same thUSD token contract [0xa10a5e2d813a51374592d6ce440b149f01cf9a7d](https://etherscan.io/token/0xa10a5e2d813a51374592d6ce440b149f01cf9a7d). 4[. ](https://github.com/Threshold-USD/dev/blob/fb15ebed750fe1e206aa2a1b01fc4ad30c324e1b/packages/lib-ethers/deployments/default/eth/v1/mainnet.json)After another 90 days, Governor Bravo calls finalizeRevokeMintList on the same thUSD token contract [0xa10a5e2d813a51374592d6ce440b149f01cf9a7d](https://etherscan.io/token/0xa10a5e2d813a51374592d6ce440b149f01cf9a7d). Second Deployment BorrowerOperations for tBTC: 0xf72E47D561D0dD5C685603e91c5FAF1FE92B7A8d BorrowerOperations for ETH Collateral: 0xeed6efEdc8a709b78C9Ce108777f412628e558e7 The current[ BorrowerOperations contract mint capability of the second thUSD token deployed can be checked in mintList function in ](https://github.com/Threshold-USD/dev/blob/fb15ebed750fe1e206aa2a1b01fc4ad30c324e1b/packages/lib-ethers/deployments/default/eth/v1/mainnet.json)[https://etherscan.io/address/0xac76FAB49c7b24b15d564f348C248C6791888965#readContrac](https://etherscan.io/address/0xa10A5e2d813a51374592D6ce440B149F01CF9A7D#readContract)t [1. The ](https://github.com/Threshold-USD/dev/blob/fb15ebed750fe1e206aa2a1b01fc4ad30c324e1b/packages/lib-ethers/deployments/default/eth/v1/mainnet.json)Governor Bravo calls startRevokeMintList for BorrowerOperations for ETH Collateral (0xeed6efEdc8a709b78C9Ce108777f412628e558e7) on the thUSD token contract [0xac76FAB49c7b24b15d564f348C248C6791888965](https://etherscan.io/token/0xac76FAB49c7b24b15d564f348C248C6791888965). 2. After the governance delay of 90 days, Governor Bravo calls finalizeRevokeMintList on the thUSD token contract [0xac76FAB49c7b24b15d564f348C248C6791888965](https://etherscan.io/token/0xac76FAB49c7b24b15d564f348C248C6791888965). 3. The Governor Bravo then calls startRevokeMintList for BorrowerOperations for tBTC (0xf72E47D561D0dD5C685603e91c5FAF1FE92B7A8d) on the same thUSD token contract [0xac76FAB49c7b24b15d564f348C248C6791888965](https://etherscan.io/token/0xac76FAB49c7b24b15d564f348C248C6791888965). 4. After another 90 days, Governor Bravo calls finalizeRevokeMintList on the same thUSD token contract [0xac76FAB49c7b24b15d564f348C248C6791888965](https://etherscan.io/token/0xac76FAB49c7b24b15d564f348C248C6791888965). * The existing procedures for each thUSD token deployment (first and second deployments) can happen simultaneously. This means that the Governance Bravo can initiate and progress the revoking process for both thUSD tokens at the same time. * Across both deployments, the Governance Bravo will need to execute a total of 8 function calls. This includes 4 calls (2 startRevokeMintList and 2 finalizeRevokeMintList) for each thUSD token deployment. * The entire procedure, spanning both deployments, should take 180 days to complete. This duration accounts for two 90-day governance delay periods, one for each set of borrower operations revoking process (one for ETH collateral and one for tBTC collateral) within each thUSD token deployment. ## Solution: thUSD Owner Contracts Recognizing the operational challenge this revocation process presents, we've developed a tailored solution: the deployment of two THUSD Owner contracts. Each of these contracts corresponds to a deprecated thUSD token that should get its mint capabilities revoked. This approach allows for a more streamlined and efficient revocation process. **Operational Role of the THUSD Owner Contracts** These contracts, managed by the Integrations Guild, will oversee the revocation process. Here's how they will function: * Each THUSD Owner contract will initiate and complete the mint list revocation for its respective thUSD token collateral. * This design significantly reduces the complexity involved in the revocation process, enhancing the operational efficiency of the DAO. * The contracts enable the Integrations Guild to transfer ownership of the thUSD tokens back to Governor Bravo when necessary. Addresses of the THUSD Owner Contracts: thUSD Owner Contract for 1st Deployment: [*0x883fC0B2EF845603a5c9012172e7F8c34c28d63* ](https://etherscan.io/address/0x883fC0B2EF845603a5c9012172e7F8c34c28d632)thUSD Owner Contract for 2nd Deployment: [*0x033951c469e54ef19Be43B19c70a4DD273026468*](https://etherscan.io/address/0x033951c469e54ef19Be43B19c70a4DD273026468) Request for Ownership Transfer The core of this proposal is to request the DAO to approve the transfer of ownership of the deprecated thUSD tokens to the THUSD Owner contracts. This transfer is crucial for implementing the outlined revocation process expeditiously and securely. ## Governance process for ad-hoc security issues This proposal is an ad-hoc action guided by the IG and the thUSD workgroup to enhance security and protect the community by disabling a functionality and avoiding confusion with the new thUSD deployment. This forum post should be active for 7 days to allow adequate time for questions and discussions. If there aren’t major issues or setbacks the voting process with enacting transactions will be triggered directly on GB avoiding the normal temp check process via Snapshot.

Today, tBTC [was listed on Aave](https://vote.onaave.com/proposal/?proposalId=168&ipfsHash=0xc6a9b3c0acd8996082cfea92cb8b8bd150f68425ad355909539311f710b8c40f), the leading lending platform [across DeFi](https://defillama.com/protocols/Lending). [](https://defillama.com/protocols/Lending) ... as well as the largest single venue [for lending WBTC](https://etherscan.io/token/0x2260fac5e5542a773aa44fbcfedf7c193bc2c599#balances) — making Aave the largest decentralized BTC lending platform in production.  Today's listing of tBTC is a huge milestone on our 5-year journey to bring scaleable, decentralized Bitcoin access to DeFi at large. ## Deepening our relationship A strong relationship between lending platforms and major asset teams is vital. The recent [changes in WBTC](https://www.bitgo.com/resources/blog/bitgo-to-move-wbtc-to-multi-jurisdictional-custody-to-accelerate-global/) came as a surprise to many of us in the space, and the [subsequent fallout](https://www.bitgo.com/resources/blog/bitgo-to-move-wbtc-to-multi-jurisdictional-custody-to-accelerate-global/) highlights the importance of that relationship. To deepen our relationship, I propose we bring Aave directly into governance and network validation, further decentralizing the signer set, and ensuring the largest BTC lending platform has a say in future Threshold network upgrades. ## Delegating T to Aave Delegating 40M T to an operator running a node on behalf of the Aave DAO will ensure the Aave community stays involved in the technical details of validating tBTC, as well as allow Aave to begin building a T treasury position from staking rewards. The Aave Chan Initiative (ACI) has been active and successful as a tBTC minter since early 2023, and is well positioned to take on this role. If they accept, I'd propose that after operating on mainnet without issue for 90 days, they be added to the Beta Staker Program. ## Expanding the Threshold Council and nominating Aave to a seat To date, the Threshold Council has been connective tissue between on-chain Governor Bravo votes and the Threshold Foundation. Good governance means minimizing our reliance on multi-sigs, and that's exactly what we've done, reserving the Council for situations that are difficult or expensive to achieve via on-chain voting. The Council also quietly holds another important role: the ability to veto malicious Governor Bravo proposals, preventing a takeover of the DAO governing tBTC. I nominate Aave to join us in ensuring tBTC's safe governance — by joining an expanded Threshold Council with a permanent seat. # Summary We've been given an unprecedented opportunity to bring decentralized finance to Bitcoin. I believe fully embracing our partners and bringing them into our operations will further distinguish us from centralized alternatives, showing that we're safer, faster, and more transparent. Let's grow together!

**Proposal** Ensure the continued stability of WBTC, the sanctity of its collateral, and the safety of the users and protocols that rely on it by hot swapping the centralized custody and merchant-based mint and burn model with Threshold’s decentralized custody and permissionless mint/redeem mechanism. Make BitGo the largest holder of T via a grant by minting an additional 15% of the current fully diluted supply ($36,415,500 at today’s price). **Background** WBTC is one of the most liquid and widely adopted assets in crypto with a TVL of ~$9B and widespread integrations across DeFi and CEXes. BitGo is the trusted custody provider behind WBTC. Threshold Network’s tBTC is a permissionless and decentralized Bitcoin bridge with a TVL of ~$200M and bridge volume of >$1B since inception. Recently, BitGo [announced](https://x.com/BitGo/status/1821927623494439130) their plan to transfer control of the WBTC product to a joint venture with BiT Global to expand the jurisdictional and institutional custody of the underlying BTC. This announcement has proven controversial due to the involvement of Justin Sun, with many in the ecosystem, expressing concern over his “[affiliated projects show worrying signs of possible misappropriation](https://forum.makerdao.com/t/wbtc-changes-and-risk-mitigation-10-august-2024/24844)” of collateral. The most recent example being the removal of 12,000 BTC from the USDD stablecoin, [as reported by Protos](https://protos.com/justin-suns-usdd-removes-12000-btc-without-dao-approval/). In response, major DeFi protocols have taken steps to limit or reduce their exposure to WBTC. The day after BitGo’s announcement, [MakerDAO proposed](https://forum.makerdao.com/t/wbtc-changes-and-risk-mitigation-10-august-2024/24844) to disable further WBTC borrowing (which has since been ratified) and potentially fully offboard the asset in the future. Similarly, Aave is [closely monitoring the situation](https://governance.aave.com/t/chaos-labs-wbtc-bitgo-custody-update/18607) and is prepared to take steps “necessary to ensure the market’s safety and stability.” **There is a better way** Combining WBTC’s user base, integrations, liquidity, and brand recognition with tBTC’s decentralized custody and permissionless bridging mechanism can better achieve BitGo’s stated objective of multi-jurisdictional and multi-institutional custody. **Benefit to ecosystem** This alternative approach would ensure the safety and stability of the underlying collateral, reassure market participants and users of WBTC, and protect the many DeFi protocols that have significant exposure to the asset as collateral. **Benefit to BitGo** Threshold DAO will mint an additional 15% (1,655,250,000 tokens) of the fully diluted supply (currently 11,035,000,000 tokens) with an agreed vesting schedule as a grant for BitGo via a one-off token mint. This grant is worth $36,415,500 at today’s price of $0.022/T and would make BitGo the largest stakeholder in Threshold Network while preserving the decentralized nature of the bridge. **Logistics** The token mint can be executed via an on-chain Governor Bravo proposal. The merge can be implemented across several stages to ensure a secure and seamless transition for users, partner protocols, BitGo, and Threshold. * Stage 1: Threshold is given merchant (mint/redeem) privileges for WBTC and other merchants are removed. The WBTC DAO privileges (e.g. freeze function, etc.) are transferred to Threshold DAO. tBTC minting is disabled and the existing tBTC supply made redeemable 1:1 for WBTC (and remains redeemable for native BTC). * Stage 2: Current WBTC TVL migrates to Threshold’s decentralized custody in chunks, with deposits spread across multiple wallets to ensure forward security. **Fallback (if the offer is declined): Facilitating a safe and orderly exit from WBTC** If BitGo declines the offer and proceeds with the new custody arrangement, the DeFi ecosystem will require a safe and orderly offboarding of WBTC. In this case, the token mint can be repurposed to subsidize the costs of offboarding WBTC from the ecosystem and migration to alternatives like tBTC and cbBTC. The exact details can be deferred to Threshold’s Treasury Guild but obvious examples could include covering users’ WBTC redemption fees, subsidizing other protocols’ migration/development work, etc.