Audit firms
6 identical ballots, $30,000
- S-Tier
- Bridge fuzzing harness $40k
- A-Tier
- Vyper static analyzer $20k
- Audit findings database $15k
- B-Tier
- Compiler bug bounty $25k
Blossom Budgeting a voting mechanism for Round Two, by Blossom Labs
Round Two asks the ETHSecurity Badge holders to allocate TheDAO Security Fund. Under a majority rule (Condorcet, Borda, most votes first), the largest like-minded group decides every dollar. Blossom Budgeting is a tiered-ballot rule that protects representation for groups with shared priorities. Projects first need enough initial backing to cover their ask. Below is the same small round, tallied both ways.
Thirty people hold a badge and 20 of them submit a ballot. The $100,000 pool is split equally among the ballots, so each voter steers $5,000. Nine initiatives ask for $175,000 between them, each with one deliverable and one price.
A ballot sorts the proposals a voter wants into tiers: S-Tier for what must be funded, A-Tier for what should be, B-Tier for what would be nice to have. Proposals in the same tier are tied. The voters fall into five groups with different priorities, which is what a security community looks like: auditors want auditing tools, wallet teams want phishing defence, responders want response capacity. To keep the example small, everyone in a group submits the same ballot as their colleagues.
6 identical ballots, $30,000
5 identical ballots, $25,000
4 identical ballots, $20,000
3 identical ballots, $15,000
2 identical ballots, $10,000
A majority rule orders the proposals by what most voters prefer and funds from the top. Here every auditing proposal beats every other proposal head to head, because the same eleven voters outvote whoever is on the other side, and the Borda and vote-count orders come out the same. Their four proposals cost exactly $100,000. Fund from the top and the other nine voters, 45% of the electorate, get nothing they asked for.
A proportional rule asks a different question: how much of the pool does each group deserve to steer? Blossom Budgeting answers it with the Expanding Approvals Rule for participatory budgeting (PB-EAR), published by Haris Aziz and Barton Lee at AAAI 2021.
Step 1 of 9Checking initial backing against each ask
The $100,000 pool is split equally among the 20 badge holders who submitted a ballot, $5,000 each. First, add up the full share of everyone who placed each proposal in any tier. Incident war room ($15,000 backing for a $20,000 ask) and Formal verification course ($10,000 backing for a $15,000 ask) fall short of their ask and are removed from every ballot. Incident responders and Researchers lose their S-Tier pick, so their A-Tier becomes their top tier. The 7 eligible proposals enter the tally with every voter's share unchanged.
Audit firms6 ballots
Solo auditors5 ballots
Wallet teams4 ballots
Incident responders3 ballots
Researchers2 ballots
Bridge fuzzing harness$40,000
Eligible: $55,000 initial backing covers the ask
Vyper static analyzer$20,000
Eligible: $55,000 initial backing covers the ask
Audit findings database$15,000
Eligible: $65,000 initial backing covers the ask
Compiler bug bounty$25,000
Eligible: $55,000 initial backing covers the ask
Phishing blocklist API$20,000
Eligible: $20,000 initial backing covers the ask
Transaction simulation warnings$10,000
Eligible: $35,000 initial backing covers the ask
Incident war roomExcluded$20,000
Only Incident responders back it: $15,000 is $5,000 short of the $20,000 ask
Whitehat legal retainer$10,000
Eligible: $45,000 initial backing covers the ask
Formal verification courseExcluded$15,000
Only Researchers back it: $10,000 is $5,000 short of the $15,000 ask
The marker is the ask; initial backing must reach it to qualify. The excluded proposals stop short of theirs and leave the round.
$0 of $100,000 spent
This is the ballot a badge holder fills in: Must fund is the S-Tier, Should fund the A-Tier, Nice to have the B-Tier. You are a twenty-first voter, and to keep the numbers round the pool grows so every ballot still steers $5,000. Proposals in the same tier are tied. Placing a proposal in any tier counts your share toward its initial backing; leaving it unplaced adds no backing. Eligible proposals you leave unplaced still sit below all three tiers during the tally and can receive your remaining money. The incident responders hold $15,000 and their war room costs $20,000. The researchers hold $10,000 and their course costs $15,000. Your one ballot can make either eligible. A direct public donation can also lower its ask to meet the threshold, which you can try under the ballot.
Drag proposals into a tier, or select a proposal and choose “Move here”.
Proposals in the same row have equal priority. Unplaced proposals sit below all three tiers.
| S-TierMust fund | Drop proposals here |
|---|---|
| A-TierShould fund | Drop proposals here |
| B-TierNice to have | Drop proposals here |
You can move proposals between tiers at any time before submitting your ballot.
The public does not vote. A donation goes straight to an initiative and lowers what it asks from the pool, so it needs less badge-holder weight to pass.
$100,000 pool, 20 ballots, $5,000 each
7 of 9 proposals qualify. Backing counts each voter's full initial weight when they place a proposal in any tier.
You have not placed anything yet, so you change nothing. This is the outcome the other 20 voters reach on their own.
Nowhere yet. A badge holder who submits no ballot steers no money.
The paper calls it Inclusion PSC, proportionality for solid coalitions. That guarantee applies to the eligible proposals: groups that agree on their top choices receive representation according to their share, subject to project costs and ties. A group cannot be left short of another jointly preferred proposal if its share can cover that proposal plus the funded projects counted toward its representation. The wallet teams cast 20% of the ballots and all put their $20,000 blocklist in their S-Tier, so it passes the filter and is funded whatever the other 80% do.
The filter guarantees that every funded proposal had enough explicit initial backing to cover its ask. That backing is not reserved money: the same voters can back several proposals. The tally may eventually use a voter's remaining money for an eligible proposal they left unplaced. Eligibility is a collective support threshold, not an individual veto on spending.
Proposals are funded whole or not at all. The responders alone cannot make a $20,000 war room eligible with $15,000 of backing; they need an ally or a donation. Removed proposals have no funding guarantee. Any money the tally leaves unspent goes back to the funder.
The same contract can also let the public vote. In that variant anyone deposits their own funds into the pool during the voting window, and the deposit is both a donation to the round and their voting weight, in one transaction. The proposals they place in a tier count toward the initial eligibility check, then the same proportional tally spends among eligible proposals. Their remaining money can reach unplaced eligible proposals as a tied last tier. Badge holders and contributors would each sort into tiers how they want their share spent.
Curators could choose this instead of encouraging direct donations: the public votes with its money. A ballot that places a single project works much like a direct donation to it. The reason to do it is that a donor gets more than one choice: they can place several projects in tiers, and if their top pick falls short their money moves to the next tier. The crowd then steers the round in proportion to what it gives, under the same rule as the badge holders.