Polkadot Public RPC Multi-Asset Bounty — USDC Funding Proposal

Delighted and honoured to cast the opening ballot on this proposal—even if, out of proper governance etiquette as a beneficiary, it must take the form of a fiercely supportive Abstain.

KEBARAH TECHNICAL SECURITY & GOVERNANCE RISK AGENCY

ON-CHAIN GOVERNANCE & RUNTIME INFRASTRUCTURE FORENSIC AUDIT

• Target Identity: Polkadot OpenGov Referendum #1962 (Medium Spender Track)
• Proposal Title: Polkadot Public RPC Multi-Asset Bounty — USDC Funding Proposal
• Proposer / Administrative Lead: Coinstudio
• Allocation Request: 77,045.08 USDC (Asset Hub Native Multi-Asset Location)
• Voting Track Classification: Medium Spender (Deciding Phase Active)
• Audit Classification: Enterprise Architecture & Operational Risk Review
• Definitive Voting Recommendation: CONDITIONAL AYE (Protocol State ALPHA — Pragmatic Risk-Hardening)

I. EXECUTIVE SUMMARY & SYSTEMIC POSTURE

Referendum #1962 requests 77,045.08 USDC from the Polkadot community treasury, dispatched via pallet_treasury::spend on Asset Hub, to fund public Remote Procedure Call (RPC) nodes, boot endpoints, and multi-asset data pipelines servicing Polkadot system chains (Asset Hub, People Chain, Bulletin Chain).

Public RPC infrastructure constitutes the primary communication gateway between the Substrate runtime and external consumer interfaces (wallets, indexing engines, decentralized applications). A prolonged disruption in RPC endpoint availability introduces immediate front-end network starvation. In an environment of broader native asset volatility, transitioning operational infrastructure allocations to digital dollars (Asset Hub native USDC) represents an essential fiscal modernization that eliminates currency conversion deficits for hardware providers.

However, a forensic examination of the proposal structure, multi-sig administration, and macro-tranche distribution isolates structural vulnerabilities regarding vendor slot concentration and governance self-approval loops. Kebarah recommends a CONDITIONAL AYE (AYE with Pragmatic Risk-Hardening Parameters), ensuring uninterrupted infrastructure availability while providing curators and institutional delegates with an enterprise security shield.

II. TECHNICAL DISPATCH & MATHEMATICAL VERIFICATION

1. Preimage & Multi-Asset Dispatch Integrity:
   The requested capital executes via cross-chain treasury spend routing Asset Hub native USDC (pallet_treasury::spend). To prevent extrinsic failure, execution verification requires strict adherence to the Asset Hub AssetKind multi-location standard (parents: 0, interior: [PalletInstance(50), GeneralIndex(1337)]). The call data architecture appropriately routes capital to the designated bounty multi-sig without foreign exchange slippage against native Relay Chain accounting.

2. Macro-Tranche Bifurcation Arithmetic:
   The total allocation of 77,045.08 USDC is partitioned into two distinct operational horizons:

• Tranche Alpha (Tender 5 Retrospective Liability Settlement): 17,818.68 USDC (23.13% of total allocation). Covers outstanding infrastructure maintenance liabilities, bandwidth overhead, and server commitments incurred through December 2026.
• Tranche Beta (Tender 5c Forward Expansion Runrate): 59,226.40 USDC (76.87% of total allocation). Secures forward operational capacity from January 2027 through June 2027 (six-month horizon).
• Cumulative Capital Allocation: 17,818.68 USDC + 59,226.40 USDC = 77,045.08 USDC (exact ledger reconciliation, zero variance).

3. Unit Economics & Hosting Feasibility:

• Tranche Beta funds 28 service spots distributed across 10 distinct infrastructure providers.
• Monthly Capital Velocity: 59,226.40 USDC / 6 months = $9,871.067 USDC per month.
• Unit Cost per Endpoint: $9,871.067 / 28 spots = $352.538 USDC per spot per month.
• Gross Revenue per Vendor: Average of $5,922.64 USDC across the six-month term (~$987.11 USDC per provider monthly).
• Technical Assessment: The unit cost of ~$352.54 USDC per high-availability endpoint falls within normal enterprise bare-metal hosting benchmarks (redundant power, dedicated gigabit egress, multi-region geographic distribution). The fiscal sizing of the server runrate is operationally sound.

4. The Tender 6 Horizon Boundary:
   The proposal explicitly excludes Tender 6 (full H1 2027 infrastructure runrates), establishing a separate operational horizon scheduled for subsequent submission in mid-December 2026. Referendum #1962 operates strictly as an interim operational bridge.

III. OPERATIONAL & GOVERNANCE RISK SCORING

[HIGH OPERATIONAL SEVERITY] — Multi-Sig Quorum Self-Approval Vulnerability

• Diagnostic Finding: The bounty curation body operates via a multi-sig threshold structure (3-of-5 / 2-of-4). Keyholder tracing reveals operational overlap between administrative curation signers and commercial infrastructure providers slated to receive funding under Tender 5/5c.
• Vulnerability Vector: When commercial operators participating as funded vendors hold signatory keys on the curation multi-sig without mandatory recusal parameters, the governance framework creates a mathematical self-approval loop. Under game-theoretic stress, this lacks economic separation between invoice presentation and disbursement authorization.
• Mitigation Parameter: Implement a mandatory Recusal & Independence Quorum. Infrastructure providers operating funded endpoints under Tender 5/5c must recuse their signatory keys from approving tranche disbursements to their own operational entities, requiring independent community or delegate keys to form the valid authorization threshold.

[MEDIUM SEVERITY] — Dual-Horizon Tranche Commingling Risk

• Diagnostic Finding: The proposal combines retrospective liabilities (Tender 5: 17,818.68 USDC) with forward expansion funding (Tender 5c: 59,226.40 USDC) within a single treasury spend.
• Vulnerability Vector: If disbursed as an unhedged lump-sum directly to an operational wallet, capital allocated for Q1/Q2 2027 forward expansion can be pulled forward to absorb past operational deficits without verifiable milestone delivery.
• Mitigation Parameter: Multi-Cycle Ledger Synchronization. The curation multi-sig must establish dedicated internal accounting sub-ledgers, immediately disbursing Tranche Alpha to settle verified historical Tender 5 vendor debt while locking Tranche Beta in a segregated multi-sig escrow state released only as monthly performance benchmarks are satisfied.

[LOW SEVERITY] — Vendor Geographic & Operator Resilience Distribution

• Diagnostic Finding: 28 endpoint spots are allocated across 10 commercial vendors.
• Vulnerability Vector: While an improvement over single-vendor setups, concentration within a small group of infrastructure operators introduces regional cloud concentration risks if nodes rely on identical data centers or upstream tier-1 transit networks.
• Mitigation Parameter: Programmatic Infrastructure Diversity. Curators should require funded node runners to document cloud/bare-metal provider independence and geographic diversity to ensure single-point-of-failure regional resilience across core system chains.

[INFORMATIONAL] — Automated Telemetry Integration for Future Tenders

• Diagnostic Finding: Uptime monitoring and latency tracking across public RPCs have historically involved manual curator oversight.
• Vulnerability Vector: Manual verification creates coordination friction and administrative bloat.
• Mitigation Parameter: Transition to Automated SLA Verification. As the ecosystem prepares for Tender 6, curation workflows should integrate open-source Prometheus/Grafana telemetry exporters directly to programmatic monitoring dashboards, automating availability scoring and reducing administrative overhead.

IV. DEFINITIVE GOVERNANCE VERDICT & RISK-HARDENING AMENDMENTS

Kebarah Technical Security & Governance Risk Agency advises the Polkadot community, Technical Fellowship, and institutional voting delegates to cast a CONDITIONAL AYE on Referendum #1962, subject to the following structural risk-hardening commitments from the curation body:

1. Quorum Governance Separation: Establish an on-chain policy requiring vendor-affiliated multi-sig signers to recuse themselves from invoice votes involving their own entities.
2. Segregated Tranche Accounting: Formally partition the 17,818.68 USDC retrospective settlement from the 59,226.40 USDC forward operational pool within publicly viewable multi-sig sub-ledgers.
3. Telemetry Automation Roadmap: Commit to establishing automated, verifiable SLA tracking pipelines prior to the mid-December 2026 submission of Tender 6.

Adopting these risk-hardening parameters ensures zero interruption to Polkadot's critical RPC gateway infrastructure while delivering complete governance insulation, fiscal transparency, and treasury protection.