Blossom Budgeting a voting mechanism for Round Two, by Blossom Labs

51% of the voters should not spend the whole pool.

Round Two asks the ETHSecurity Badge holders to allocate TheDAO Security Fund. Under a majority rule (Condorcet, Borda, most votes first), the largest like-minded group decides every dollar. Blossom Budgeting is a tiered-ballot rule that protects representation for groups with shared priorities. Projects first need enough initial backing to cover their ask. Below is the same small round, tallied both ways.

Majority ruleAuditors cast 55% of the ballots and direct 100% of the pool.
Blossom BudgetingAuditors cast 55% of the ballots and direct 55% of the pool.
  • Auditing tools
  • Wallet safety
  • Incident response
  • Research and education
  • Unspent

A round in miniature

Thirty people hold a badge and 20 of them submit a ballot. The $100,000 pool is split equally among the ballots, so each voter steers $5,000. Nine initiatives ask for $175,000 between them, each with one deliverable and one price.

A ballot sorts the proposals a voter wants into tiers: S-Tier for what must be funded, A-Tier for what should be, B-Tier for what would be nice to have. Proposals in the same tier are tied. The voters fall into five groups with different priorities, which is what a security community looks like: auditors want auditing tools, wallet teams want phishing defence, responders want response capacity. To keep the example small, everyone in a group submits the same ballot as their colleagues.

Audit firms

6 identical ballots, $30,000

  1. S-Tier
    • Bridge fuzzing harness $40k
  2. A-Tier
    • Vyper static analyzer $20k
    • Audit findings database $15k
  3. B-Tier
    • Compiler bug bounty $25k

Solo auditors

5 identical ballots, $25,000

  1. S-Tier
    • Bridge fuzzing harness $40k
  2. A-Tier
    • Audit findings database $15k
    • Compiler bug bounty $25k
  3. B-Tier
    • Vyper static analyzer $20k

Wallet teams

4 identical ballots, $20,000

  1. S-Tier
    • Phishing blocklist API $20k
  2. A-Tier
    • Transaction simulation warnings $10k
    • Whitehat legal retainer $10k

Incident responders

3 identical ballots, $15,000

  1. S-Tier
    • Incident war room $20k
  2. A-Tier
    • Whitehat legal retainer $10k
    • Transaction simulation warnings $10k

Researchers

2 identical ballots, $10,000

  1. S-Tier
    • Formal verification course $15k
  2. A-Tier
    • Whitehat legal retainer $10k
    • Audit findings database $15k

A majority rule orders the proposals by what most voters prefer and funds from the top. Here every auditing proposal beats every other proposal head to head, because the same eleven voters outvote whoever is on the other side, and the Borda and vote-count orders come out the same. Their four proposals cost exactly $100,000. Fund from the top and the other nine voters, 45% of the electorate, get nothing they asked for.

A proportional rule asks a different question: how much of the pool does each group deserve to steer? Blossom Budgeting answers it with the Expanding Approvals Rule for participatory budgeting (PB-EAR), published by Haris Aziz and Barton Lee at AAAI 2021.

How the tally works

  1. Money is weight. The pool is split equally among the badge holders who submit a ballot, so total voting weight always equals the pool balance.
  2. Initial backing must cover the ask. Add the full initial weight of every voter who places a proposal in any tier, counting each voter once. Remove proposals whose backing is below their ask from every ballot. Check once, before spending; keep every voter and their original weight.
  3. Start with each voter's top tier. A proposal is affordable when the voters who have it in their highest tier of eligible proposals, usually their S-Tier, hold enough unspent money to cover its cost. If several are affordable, the one with the most money behind it goes first.
  4. Current supporters pay, in proportion. The proposal's cost is deducted from the voters who have it in an open tier, each in proportion to what they still hold. Spent money cannot pay for anything else.
  5. Widen only when stuck. When nothing is affordable, the tally widens a step and lower tiers open: a voter's next tier opens after one step for each proposal in the tiers above it. Unplaced eligible proposals count as a tied last tier. It stops when no unfunded eligible proposal fits in what is left or no remaining voting weight can pay for one.

Step 1 of 9Checking initial backing against each ask

The $100,000 pool is split equally among the 20 badge holders who submitted a ballot, $5,000 each. First, add up the full share of everyone who placed each proposal in any tier. Incident war room ($15,000 backing for a $20,000 ask) and Formal verification course ($10,000 backing for a $15,000 ask) fall short of their ask and are removed from every ballot. Incident responders and Researchers lose their S-Tier pick, so their A-Tier becomes their top tier. The 7 eligible proposals enter the tally with every voter's share unchanged.

Voters and what they still hold

  • Audit firms6 ballots

    1. S-TierFuzzing
    2. A-TierAnalyzerFindings DB
    3. B-TierBounty
    4. other eligible proposals
    $30,000
  • Solo auditors5 ballots

    1. S-TierFuzzing
    2. A-TierFindings DBBounty
    3. B-TierAnalyzer
    4. other eligible proposals
    $25,000
  • Wallet teams4 ballots

    1. S-TierBlocklist
    2. A-TierSimulationRetainer
    3. other eligible proposals
    $20,000
  • Incident responders3 ballots

    1. S-TierWar roomexcluded
    2. A-TierRetainerSimulation
    3. other eligible proposals
    $15,000
  • Researchers2 ballots

    1. S-TierCourseexcluded
    2. A-TierRetainerFindings DB
    3. other eligible proposals
    $10,000

Initial backing in any tier

  • Bridge fuzzing harness$40,000

    Eligible: $55,000 initial backing covers the ask

  • Vyper static analyzer$20,000

    Eligible: $55,000 initial backing covers the ask

  • Audit findings database$15,000

    Eligible: $65,000 initial backing covers the ask

  • Compiler bug bounty$25,000

    Eligible: $55,000 initial backing covers the ask

  • Phishing blocklist API$20,000

    Eligible: $20,000 initial backing covers the ask

  • Transaction simulation warnings$10,000

    Eligible: $35,000 initial backing covers the ask

  • Incident war roomExcluded$20,000

    Only Incident responders back it: $15,000 is $5,000 short of the $20,000 ask

  • Whitehat legal retainer$10,000

    Eligible: $45,000 initial backing covers the ask

  • Formal verification courseExcluded$15,000

    Only Researchers back it: $10,000 is $5,000 short of the $15,000 ask

The marker is the ask; initial backing must reach it to qualify. The excluded proposals stop short of theirs and leave the round.

$0 of $100,000 spent

Cast a ballot

This is the ballot a badge holder fills in: Must fund is the S-Tier, Should fund the A-Tier, Nice to have the B-Tier. You are a twenty-first voter, and to keep the numbers round the pool grows so every ballot still steers $5,000. Proposals in the same tier are tied. Placing a proposal in any tier counts your share toward its initial backing; leaving it unplaced adds no backing. Eligible proposals you leave unplaced still sit below all three tiers during the tally and can receive your remaining money. The incident responders hold $15,000 and their war room costs $20,000. The researchers hold $10,000 and their course costs $15,000. Your one ballot can make either eligible. A direct public donation can also lower its ask to meet the threshold, which you can try under the ballot.

Or start from a ballot:

Set your funding priorities

Drag proposals into a tier, or select a proposal and choose “Move here”.

Proposals in the same row have equal priority. Unplaced proposals sit below all three tiers.

Unplaced proposals 9

S-TierMust fund

Drop proposals here

A-TierShould fund

Drop proposals here

B-TierNice to have

Drop proposals here

You can move proposals between tiers at any time before submitting your ballot.

The public does not vote. A donation goes straight to an initiative and lowers what it asks from the pool, so it needs less badge-holder weight to pass.

The round with your ballot in it

$100,000 pool, 20 ballots, $5,000 each

Initial backing check

7 of 9 proposals qualify. Backing counts each voter's full initial weight when they place a proposal in any tier.

  • Incident war room: $15,000 backing / $20,000 ask
  • Formal verification course: $10,000 backing / $15,000 ask
  • Bridge fuzzing harness
  • Whitehat legal retainer
  • Phishing blocklist API
  • Audit findings database
  • Transaction simulation warnings

You have not placed anything yet, so you change nothing. This is the outcome the other 20 voters reach on their own.

Where your $5,000 went

Nowhere yet. A badge holder who submits no ballot steers no money.

What the rule guarantees

The paper calls it Inclusion PSC, proportionality for solid coalitions. That guarantee applies to the eligible proposals: groups that agree on their top choices receive representation according to their share, subject to project costs and ties. A group cannot be left short of another jointly preferred proposal if its share can cover that proposal plus the funded projects counted toward its representation. The wallet teams cast 20% of the ballots and all put their $20,000 blocklist in their S-Tier, so it passes the filter and is funded whatever the other 80% do.

The filter guarantees that every funded proposal had enough explicit initial backing to cover its ask. That backing is not reserved money: the same voters can back several proposals. The tally may eventually use a voter's remaining money for an eligible proposal they left unplaced. Eligibility is a collective support threshold, not an individual veto on spending.

Proposals are funded whole or not at all. The responders alone cannot make a $20,000 war room eligible with $15,000 of backing; they need an ally or a donation. Removed proposals have no funding guarantee. Any money the tally leaves unspent goes back to the funder.

What comes with the mechanism

Sealed ballots
Each ballot is encrypted in the voter's browser to the round operator's public key. Only the ciphertext goes on-chain, and a ballot can be replaced until the deadline. A ballot shown to a vote buyer proves nothing, and there is no last-hour bandwagon, while running public totals keep the round visible.
A tally nobody has to trust
The result is verified on-chain by one of three interchangeable verifiers: a Chainlink CRE confidential-compute attestation, chained Noir proofs of every tally batch, or a single ZisK zkVM proof that every committed ballot was decrypted with the published key and that the funded set follows the rule.
Badge holders vote, the public donates
TheDAO Security Fund sponsors the pool to the ETHSecurity Badge collection. The pool is split equally among the badge holders who submit a ballot, so holders who do not vote steer nothing: if 30 people hold a badge and 20 of them vote, each voter steers $5,000 of a $100,000 pool. The public does not vote. Anyone can donate directly to an initiative, and every dollar donated is a dollar that initiative no longer asks from the pool. A well-supported initiative gets cheaper for the badge holders to pass, which is the market signal Round Two is built around.
Co-sponsors could also participate in the vote
The mechanism allows it if the curators want it. A co-sponsor would deposit tokens into the same pool and name who votes with that money: its own address, a list of addresses, or an NFT collection. A wallet company could sponsor $50k voted by its security team, an L2 could sponsor its builders. Those voters' initial weights would count toward eligibility, and their tiers would guide spending among eligible proposals like any other ballot.
Priced deliverables, paid in full
Every proposal states one deliverable, one price in dollars and one recipient. It is funded in full or not at all, so each payout matches a concrete scope. Funds go to Safe multisigs controlled by TheDAO's operational signers.
Everything published
A public retrospective and as much round data as can be released: how the badge holders voted, what the public donated, and where the two disagreed.

A possible modification: voting with your own money

The same contract can also let the public vote. In that variant anyone deposits their own funds into the pool during the voting window, and the deposit is both a donation to the round and their voting weight, in one transaction. The proposals they place in a tier count toward the initial eligibility check, then the same proportional tally spends among eligible proposals. Their remaining money can reach unplaced eligible proposals as a tied last tier. Badge holders and contributors would each sort into tiers how they want their share spent.

Curators could choose this instead of encouraging direct donations: the public votes with its money. A ballot that places a single project works much like a direct donation to it. The reason to do it is that a donor gets more than one choice: they can place several projects in tiers, and if their top pick falls short their money moves to the next tier. The crowd then steers the round in proportion to what it gives, under the same rule as the badge holders.