Author(s)
Steven — steven3002
Experiences and Qualifications
I developed the MVP in draft PR #643, including an independent MultiSend decoder, Safe transaction-hash calculation, an exact payout verifier, and a same-run plan builder.
The PR documents 193 locally passing offline unit tests, including 14 same-run tests. These exercise CoW’s existing auto_propose code with mocked network boundaries and demonstrate detection of altered transactions and injected construction errors. Reproduction commands are included in the PR.
Grant Description
Summary
I am requesting a completion grant to connect the existing MVP to CoW’s solver-payout verification workflow.
The objective is to verify that the payout intent produced in one accounting run matches the specific Safe transaction presented for authorization. The check uses exact integer token amounts and identifies missing, additional, duplicated, or altered calls.
The completed MVP is not included in this funding request. Funding covers the remaining operational integration, review revisions, and validation.
Problem and Benefit
Issue #529 documents differences between generated CSV amounts and transaction calldata that obstruct exact automated verification.
This contribution captures expected payments from the same proposal run and compares them with independently decoded Safe transaction data. It gives payout operators and reviewers a reproducible check tied to a specific transaction, rather than relying on a separately generated reporting artifact.
Existing MVP
The implementation already provides:
- Independent calldata decoding and Safe transaction-hash recomputation, with checks for transaction identity, supported calls, exact amounts, and gas-refund parameters.
- Expected plans built from payout inputs, not from the transaction being verified.
- Same-run regression tests and seven recorded transaction/proposal fixtures covering both supported cases and deliberate rejection cases.
PR #643 remains a review-only draft. It does not change production signing or posting behavior; maintainer review and upstream CI validation are pending.
Relationship to Existing Work
PR #635 improves accounting comparisons, data retrieval, and calldata input handling. This request focuses on the additional same-run plan capture, transaction-identity verification, and trusted plan handoff. It will reuse compatible upstream work rather than fund parallel implementations.
The payout maintainer and assigned reviewer will confirm the remaining scope and one integration route during forum review, before the funding vote.
Type of Grant
Hybrid: milestone-based acceptance with capped hourly billing. Payments cover documented post-approval work only. No upfront payment is requested.
Milestones
| Milestone | Deliverable | Target from approval | Funding cap (xDAI-equivalent) |
|---|---|---|---|
| M1 | Operational same-run plan capture | Week 2 | 1,125 |
| M2 | Agreed verification integration | Week 4 | 2,025 |
| M3 | Upstream acceptance and operator validation | Week 6 | 1,350 |
| Total | 6 weeks | 4,500 |
M1 — Operational Same-Run Plan Capture
Connect the plan builder to the proposal-construction boundary. Record the final filtered payout inputs, balance and nonce values used by the run, accounting period, code revision, and non-secret configuration.
Generate a deterministic integer-only plan from those inputs, independently of decoding the proposed transaction. Document how reviewers obtain the plan and confirm its digest through a trusted operator-controlled channel.
Acceptance: A fresh integration test captures real run metadata, produces identical plan digests for identical captured inputs, and detects changes to the expected payments or transaction context. Exported artifacts contain no secrets.
M2 — Agreed Verification Integration
Implement one route selected before voting:
Pre-flight: Verify supported unsigned transactions before signing or posting. A mismatch blocks those transactions, and the exact verified objects are passed onward without rebuilding them.
Signer-facing: Verify a pending Safe transaction against the trusted same-run plan and produce a report tied to its recomputed safeTxHash. This supports signer review without changing the posting path.
Add integration tests for changed recipients, amounts, transaction identity, refund parameters, and missing or additional calls. Preserve the existing accounting-comparison workflow.
Acceptance: The selected route passes an honest same-run example and rejects the agreed mutations. Reports include the plan digest, Safe transaction hash, call totals, and coverage. Unsupported transaction groups are clearly identified, and partial coverage never receives a complete-run success verdict.
M3 — Upstream Acceptance and Operator Validation
Address review feedback, obtain passing upstream checks, merge the agreed integration, and document the verification workflow.
Complete one fresh operator-run verification using a staging or appropriately sanitized operational payout bundle. Production credentials remain with CoW’s operators.
Acceptance: The integration is merged, the designated maintainer or operator reproduces the supported workflow, and the final report documents delivery, test results, and coverage. Scope changes require prior agreement with the Steward; undelivered milestones will not be invoiced.
Length
Six weeks from successful Snapshot approval. Progress and milestone evidence will be posted in the application thread. Review-related schedule changes will be agreed with the Steward without an automatic budget increase.
Funding Request
Estimated cost: 3,600 xDAI-equivalent for 80 hours at 45 xDAI-equivalent per hour.
Maximum request: 4,500 xDAI-equivalent for up to 100 hours, subject to the milestone caps.
COW requested: 0.
Only accepted, documented work is payable. The existing MVP, review waiting time, and unused allocation will not be billed. No hosting or recurring maintenance funding is requested. The payment asset and network will be confirmed with the Steward before voting.
Grant Receiving Address
[0x1C9b94ef19bce5CAB6CC7Fd458C30d09D431022B]
Other Information
Initial operational coverage is Mainnet COW payouts and an Arbitrum native-payout path, including supported wrapped-native withdrawals and empty nonce-reservation transactions.
The check verifies declared payout intent against a Safe transaction. It does not validate reward calculations, underlying accounting data, affordability, or owner signatures. Overdrafts, Safe module executions, later transactions at reserved nonces, additional networks, and post-execution reconciliation are outside this request.
The verifier requires no production signing key. Code and documentation will follow the repository’s licensing and contribution requirements.
Terms and Conditions
By submitting this grant application, I acknowledge and agree to be bound by the CoW DAO Participation Agreement and the CoW DAO Grant Agreement Terms.