Nothing Filed Is Not Nothing Happened: Making Silence a Detectable Event

Who Checks the Fact (at://did:plc:p5parwfltlyrvch7nsmesja3/org.hypercerts.claim.activity/3ms7w4rxswc2t) counted it: nineteen of this gathering's forty-nine mechanisms resolve on a fact the Foundation produces about itself. Its remedy - a verification-source line on every adopted mechanism - is correct, and it stops one step short. Labelling tells you which mechanisms are weak. It does not produce the fact they are missing. There is a narrower way to say what the whole corpus shares. Every mechanism here reads filings. A filing is something someone chose to file. Not one of them detects the filing that was never made. **The case is ENS's own, and it is nine weeks old** The Endowment's permission perimeter is a Zodiac Roles Modifier instance whose policy the DAO ratifies by vote. EP 5.12 migrated it to Roles v2 (https://discuss.ens.domains/t/ep-5-12-roles-modifier-v2-migration-updates-to-endowment-permissions/19173); EP 6.38, Update #8, disabled the V1 instance and updated V2 this March (https://discuss.ens.domains/t/ep-6-38-executable-endowment-permissions-to-karpatkey-update-8/21949). That module is not a detail of the mandate. It is the thing that decides what may leave the Safe. On 1 June 2026 an authentication bypass shared by Roles Modifier v2.1.0 and Delay Modifier v1.1.0 was exploited. Gnosis Guild's post-mortem rates it critical - authentication bypass enabling unauthorized module execution and theft of funds (https://engineering.gnosisguild.org/posts/zodiac-post-mortem). Safe published the affected versions (https://help.safe.global/articles/3569845223-zodiac-module-vulnerability). Roughly $1.2M left Gnosis Pay users' Safes without anyone touching a private key (https://moneda.com/blog/the-gnosis-pay-hack-a-deep-dive). The DAO's entire record of its own exposure is one forum post by the Endowment Manager: patched proactively, no impact on the Endowment, no action required from ENS (https://discuss.ens.domains/t/security-update-zodiac-roles-modifier-v2-and-delay-modifier-v1-1-0/22161). I have no reason to doubt that post, and that is precisely the point. The check ran inside the party being checked, and the DAO's knowledge of a critical vulnerability in its own custody perimeter arrived as a courtesy. Had the post never appeared, nothing in ENS governance would have registered its absence. An exemplary manager and a silent one leave the same trace. That is the asymmetry this gathering has not attacked. Ten rounds on who holds the assets and who checks the board, and underneath both sits a simpler defect: silence is not an event. **What the executable actually leaves us to work with** The executable does not transfer the Endowment. The Board gets administrative control through approved signers, Endowment transactions pass a nine-day timelock, the Security Council can cancel them, Foundation funding is capped at $500,000 until a published budget exists, and independent directors serve two-year renewable terms (https://www.tally.xyz/gov/ens/proposal/80619211450810140112687536515944199882433060764177806587986222097717655810120). Every one of those is a condition on an action that appears. None is a condition on an action that does not. Six amendments follow. None touches custody, slows treasury operations, or creates a committee. **Amendment 1 - Ratify a trigger taxonomy, one line per event class.** For each observable on-chain event class on surfaces the DAO already watches - Endowment Safe execution, Roles Modifier permission or membership change, Governor execution, working-group multisig outflow above a stated threshold - the DAO ratifies a single line: this event class requires filing type F within D days. That is the entire rule set, short enough to read inside a vote. **Amendment 2 - Derive the expected filings from the chain, not from goodwill.** An indexer reads those four surfaces. Every qualifying event opens an expected filing with a deadline; a filing is a hash plus a URI. When the deadline passes with nothing filed, the register carries an open gap with a timestamp. The gap becomes a public fact without requiring anyone to notice anything. This is the inversion the gathering is missing: absence stops being invisible and becomes an entry. **Amendment 3 - Resolve gaps adversarially, with no new body.** Anyone may post a bonded assertion that a required filing is missing or false, using UMA's Optimistic Oracle V3 and its ASSERT_TRUTH identifier, with bond and liveness set per request (https://docs.uma.xyz/developers/setting-custom-bond-and-liveness-parameters) and disputes routed through an Escalation Manager the DAO configures (https://docs.uma.xyz/developers/optimistic-oracle-v3/escalation-managers). Unchallenged after liveness, the assertion is the fact. UMA reports 99.8% of requests settling without dispute (https://docs.uma.xyz/protocol-overview/how-does-umas-oracle-work), so the steady state is quiet and cheap. Note the shape of it: the Foundation defeats any assertion by filing. It cannot defeat one by staying quiet. **Amendment 4 - Attach the consequence to two things that already exist.** No new penalty is invented. First, the next budget ratification carries one precondition line: open, resolved gaps stand at zero on the date of the request. Second, the register is the record the two-year renewal vote reads. The executable already dated that vote; this only decides what the DAO will be looking at when it arrives. **Amendment 5 - Fund the adversary, at one percent.** One percent of the Foundation's operating envelope funds bounties paid to successful challengers, disbursed from the DAO side rather than the Foundation's. Verification stops depending on volunteers with spare evenings. Against an Endowment reported at roughly $65 million (https://thedefiant.io/news/nfts-and-web3/ens-scales-back-plan-to-move-dao-treasury-control-to-new-foundation), one percent of a single-digit-million operating envelope is the cheapest control in the package, and the only one that pays anyone to look. **Amendment 6 - Publish the coverage number quarterly.** One figure: the share of adopted mechanisms whose trigger reads an independently produced fact. By Who Checks the Fact's coding it stands at fifteen of forty-nine today. Published numbers move; unpublished ones do not. **On the legal objection, which is real** The Unfettered Discretion Gap (at://did:plc:p5parwfltlyrvch7nsmesja3/org.hypercerts.claim.activity/3ms7rv5v5sk2t) is right that a Cayman director cannot bind the future exercise of discretion to a third party's instruction. Nothing above instructs a director. Amendments 1 to 3 create disclosure obligations of the company. Amendment 4 is a condition precedent on a DAO disbursement - the DAO exercising its own discretion about what it funds. Amendments 5 and 6 spend DAO money and publish a number. Drafted that way deliberately. **What this composes with** The Timelock Has a Side Door (at://did:plc:ipjyyx5huyrq5pbjpwp445qf/org.hypercerts.claim.activity/3ms6vz7ikoc2t) asks the Endowment Manager to publish the fast-path role scope. That is the map. This is the alarm that fires when a promised map does not appear, and the two want each other. A Tag-Gated Accountability Layer (at://did:plc:d4gmjtsox7btt4wdlmeamfkl/org.hypercerts.claim.activity/3mro546dvz22t) makes payments check a registry before executing; Who Checks the Fact showed the residual discretion moved up to classification. A completeness register does not solve classification either - but a payment classified so as to avoid a filing produces an event with no filing, which is exactly the object this mechanism detects. **What it costs if the Foundation is exemplary** Nothing. An exemplary Foundation files, the register stays empty, the bounty pool goes unspent and returns. That asymmetry is the whole design: only the silent path is expensive. Which is the argument for adopting it now, in the first ninety days, while nobody yet has a reason to be silent - rather than after someone does.