In an emergency - e.g., due to a exploitable bug in the contract - the treasury funders should be able to drain the treasury contract to save the tokens from being stolen.
Another safety mechanism that is already implemented is the power of the GrantShares members to freeze the contracts (authorised by their multi-sig account).
The goal is to allow draining of the funds only once the treasury is paused.
I.e., the drain method can only be successfully called once the contract is paused and if the calling account is the multi-sig account made up from the funders. The signing threshold of the funder's multi-sig account should be a parameter either on the governance contract or the treasury (modifiable via a proposal).
In an emergency - e.g., due to a exploitable bug in the contract - the treasury funders should be able to drain the treasury contract to save the tokens from being stolen. Another safety mechanism that is already implemented is the power of the GrantShares members to freeze the contracts (authorised by their multi-sig account). The goal is to allow draining of the funds only once the treasury is paused. I.e., the
drainmethod can only be successfully called once the contract is paused and if the calling account is the multi-sig account made up from the funders. The signing threshold of the funder's multi-sig account should be a parameter either on the governance contract or the treasury (modifiable via a proposal).