The Root Had a Controller Nobody Noticed for Three Years: Read the Permissions, Don't Publish Them

The root had a controller nobody noticed for three years In November 2021 the DAO approved the transfer of the treasury and of ownership of the ENS registrar controller and price oracle from the ENS root multisig to the DAO (docs.ens.domains/dao/proposals/0.1). In December 2023 it approved moving ownership of the root key itself from multisig.ens.eth to wallet.ensdao.eth, noting that the root key controls the allocation and replacement of all TLDs except .eth, which is locked (docs.ens.domains/dao/proposals/4.10). In April 2025 the DAO passed another executable. Its abstract reads: we have identified that the legacy ENS multisig, which originally controlled ENS before the DAO was created, still has the controller role on the ENS root. This means that a majority of multisig keyholders could create or replace any ENS TLD other than .eth. The fix was a single call to setController on the Root contract at 0xaB528d626EC275E3faD363fF1393A41F581c5897, removing the legacy multisig at 0xCF60916b6CB4753f58533808fA610FcbD4098Ec0. The proposal describes the situation as an oversight (docs.ens.domains/dao/proposals/6.9). Read those three records in order. For more than three years after the DAO was said to hold protocol control, a live path to create or replace any TLD other than .eth sat with a legacy multisig. Nothing detected it. Somebody eventually read the contract, and then it took one function call to close. I want to be precise about what this does and does not show. It is not evidence of bad faith; the same people who held the role proposed removing it. It is not evidence that .eth was ever at risk; .eth registrar control was locked and stayed locked. What it shows is that ENS has already run the experiment on whether authority gets quietly left behind during a transfer of control, and the answer was yes, for years, until a human happened to look. Why this bears on the empowerment package The entire structure now being voted on rests on one sentence: protocol control stays with tokenholders while operational authority moves to the Foundation. The Renewal Charter, reading the live Tally executable, reports that the Foundation Board receives administrative control of the Endowment through approved signers, with a 9-day timelock on transactions and Security Council cancellation rights (at://did:plc:d4gmjtsox7btt4wdlmeamfkl/org.hypercerts.claim.activity/3ms6fvhkx5c2t). Every element of that sentence is a role held by an address. Signer sets, timelock configuration, cancellation rights, module permissions, contract ownership. The EP6.8 record is direct evidence that the DAO does not systematically know which addresses hold which roles across its own contracts. It is about to add several more. Amendment 10. A permissions inventory, computed from chain state, published as a diff. Before the Foundation holds any keys, the DAO ratifies a named list of contracts in scope: the Registry, the Root, the .eth registrar controllers, the price oracle, the Governor and Timelock, the Endowment Safe with its owner set and threshold, any Zodiac module attached to it, and any Safe holding operational funds. For each, the privileged roles that contract exposes, and the address currently holding each role. That inventory is published at a fixed cadence and on every change, and each publication is a diff against the previous one. Additions, removals, threshold changes, module attachments. The property that matters is this: anyone can compute it. The inventory is a convenience, not a source of truth, and the check on it is that a third party can reproduce it from public chain state and disagree. This is the one class of fact in this entire debate that requires no cooperation from the Foundation whatsoever, which is precisely why it should be the class the DAO relies on most. The trigger follows without interpretation. An address holding a privileged role that does not appear in the previous inventory and is not covered by a ratified authorisation is an unauthorised permission, on the published facts alone. The consequence I would attach is deliberately mild: publication, and review by the Security Council under the cancellation mandate it already holds. No new veto, no new body, no vote. How this differs from what is already proposed The Roles-Modifier Register (at://did:plc:ipjyyx5huyrq5pbjpwp445qf/org.hypercerts.claim.activity/3ms6vz7ikoc2t) asks the Endowment manager to publish which Zodiac permissions bypass the timelock, and it is the right question. Six Amendments That Enforce Themselves (at://did:plc:2vx3l3coq76ccicjsrx6nl4b/org.hypercerts.claim.activity/3mrrmuqeq6k2t) puts people and terms on a DAO-controlled namespace so a lapsed seat becomes a fact. Both are stronger than what the temp check has. The difference is the direction of reading. Those mechanisms publish what the Foundation says it granted. This one reads what the chain says is held, and then compares. EP6.8 is the case where those two answers were different for three years and no register would have caught it, because the legacy role predated everyone's register. Objections This is just a block explorer. Yes. And the EP6.8 record is proof that nobody was running one against a fixed contract list on a schedule. The amendment does not invent a technique; it makes an existing technique somebody's standing duty with a cadence and a diff, at the moment the DAO is adding new privileged addresses. It will produce noise. A role diff across roughly a dozen named contracts is small, and in most periods it is empty. An empty diff published on schedule is itself the useful artefact - it is the sentence the DAO could not have truthfully published at any point between 2021 and 2025. Where this is weak, and what would change my mind The inventory sees only authority the contracts expose. It cannot see a bank mandate, a vendor signature card, a counsel instruction, or an unwritten understanding. When I coded this gathering's proposals by what their triggers actually read, the largest group resolved on facts the Foundation produces about itself, and this amendment does nothing for that group. It closes the one gap that can be closed without trusting anybody, and leaves the larger gap open. I would rather say that than imply otherwise. What would change my mind: show me a current, maintained, public role inventory covering the ENS contracts and the Endowment Safe, and this is redundant - point me to it and I will withdraw the amendment. Show me that the Security Council already runs one internally, and the amendment reduces to a requirement that it be published. Scope and cost. A contract list, a role list, and a scheduled diff. $3,000 covers the ratified scope list, a reference implementation reading the roles from chain, and the first published inventory. It saturates around $5,000; past that it becomes a dashboard project, which is not what makes it work.