clr.fund

Summary

clr.fund (pronounced "clear fund") is a permissionless, trust-minimized quadratic funding (QF) protocol for Ethereum public goods. Incubated at ETHDenver and formally introduced on Ethereum Research in May 2020 by Ezra Weller, with Auryn Macmillan widely credited as founder, it was the first production QF system to integrate MACI (Minimal Anti-Collusion Infrastructure) so that individual contributions are encrypted and vote tallies are proven correct with zk-SNARKs. Where Gitcoin Grants relied on centralized operation and post-hoc Sybil/collusion detection, clr.fund aimed for credible neutrality by construction: anyone can add recipients, fund the matching pool, or contribute, and no one — not even the round coordinator — can prove how a given contributor allocated funds, undermining bribery markets. Rounds ran first on xDai, then moved to Arbitrum for cheaper zk-friendly operation, including community instances such as an ETHColombia round around Devcon Bogotá. It remained deliberately small relative to Gitcoin (a late-2021 round matched roughly $12k across ~511 contributors) and development activity tapered by mid-2024, but its MACI-based design became the reference architecture for anti-collusion funding rounds.

Design (Mechanism)

• Quadratic funding core. Matching follows the CLR formula: each project's share of the matching pool is proportional to the square of the sum of square roots of individual contributions, favoring broad support over whale donations.
• Factory-deployed rounds. A factory contract deploys a fresh funding-round contract per round, with distinct roles: Owner (protocol governance, held by multisigs), Coordinator (runs MACI tallying), Contributors, and Recipients. Recipient listings are managed by a registry, initially curated (early designs proposed Burn Signal quadratic voting for curation).
• MACI anti-collusion. Contributors register keys with MACI and submit encrypted votes; they can secretly invalidate a key and re-vote, so a bribed vote cannot be credibly proven to a briber. The coordinator tallies votes off-chain and posts a zk-SNARK proving the tally matches the encrypted messages, without revealing individual allocations.
• Sybil resistance. BrightID social-graph verification (and later alternative gatekeepers) required one-person-one-registration before contributions counted toward matching.
• Trust residue and escape hatches. The coordinator can censor by stalling (though not forge results); early designs included a contributor "kill switch" to abort a compromised round and reclaim funds. Governance sat with Gnosis Safe multisigs (e.g., matching pool Safe 0xFcC41c…8680 on Mainnet/xDai) plus a Colony instance on xDai to track and reward ecosystem contributions, with a stated goal of progressive decentralization to a DAO.

Outcome

clr.fund shipped and ran real-money rounds repeatedly: a first test round on xDai with whitelisting (2020–21), successive numbered rounds, and a migration to Arbitrum (announced December 2021) with a revamped app. Engineering milestones included cutting MACI proof generation for ~50k votes from an estimated 100 days to ~3 days (December 2021, credited to Wei Jie of the MACI/PSE team). As of November 2021 the protocol had completed multiple rounds with modest scale — the then-latest round distributed about $12,000 in matching against ~$6,300 of donations from 511 contributors. Round 8 suffered a technical incident in which funds became stuck in a contract, with most funds later recovered; Round 9 launched with a ~$50k matching pool. Community-branded instances (e.g., ETHColombia on Arbitrum) and an Ethereum Foundation fork ("Eth2 CLR," github.com/ethereum/clrfund) extended the codebase. GitHub activity slowed markedly after mid-2024, and no evidence of new flagship rounds in 2025–26 was found. Verdict: a technical proof that trust-minimized QF works in production, but it never approached Gitcoin's scale of capital or users — hence partial_success.

Why it worked

• It solved a real, articulated attack on QF: collusion and vote-buying, which plain QF is acutely vulnerable to because matching amplifies coordinated small donations. MACI's receipt-freeness made bribery unenforceable rather than merely detectable.
• Minimal, credible-neutral protocol surface: permissionless recipient registration and matching-pool funding meant anyone could run or fund a round without gatekeepers.
• Strong alignment with the Ethereum research community (ethresear.ch launch, PSE/MACI collaboration, EF fork) gave it sustained engineering support disproportionate to its size.
• Pragmatic chain choices (xDai, then Arbitrum) kept per-contributor gas costs compatible with small donations.

Where the design broke

• UX tax of trust minimization. BrightID verification plus MACI key registration and encrypted voting was far heavier than Gitcoin's checkout, throttling contributor counts (hundreds, not tens of thousands).
• Coordinator bottleneck. Rounds still depended on a trusted coordinator for tallying; proof generation was initially so slow it constrained round size — an acknowledged "biggest limitation" until late-2021 optimizations.
• Small matching pools. Without a native token, treasury, or dedicated pool-growth mechanism, matching pools stayed in the $10k–$50k range, limiting recipient upside and attention.
• Operational fragility. The Round 8 stuck-funds incident showed the cost of complex per-round contract choreography, even though funds were mostly recovered.
• Ecosystem competition. Gitcoin's network effects, and later Allo/retro-funding programs, absorbed most public-goods funding demand; clr.fund's differentiator (anti-collusion) mattered less at the scales it actually operated.

Lessons

• Anti-collusion by construction (receipt-free encrypted voting) is achievable in production QF, and is strictly stronger than statistical post-hoc Sybil defense — but it must be paid for in UX and coordinator complexity.
• Mechanism integrity does not bootstrap capital: a maximally credible-neutral funding protocol still needs a matching-pool growth engine, or it stays a demo at the margin of the ecosystem it defends.
• zk infrastructure costs are dynamic: a mechanism that is infeasible today (100-day proofs) can become practical within months; design protocols so the trust-minimizing component can be upgraded per round.
• Factory-per-round architectures isolate blast radius (Round 8 losses were contained and mostly recovered), a pattern worth copying for any episodic funding mechanism.
• Forkable, chain-portable instances (ETHColombia, Eth2 CLR) are a viable distribution strategy for funding protocols even when the flagship deployment stays small.

Redesign (EDITORIAL — hypothesis, not fact)

This section is editorial speculation. A modern clr.fund would attack its two binding constraints: contributor UX and pool size. Replace BrightID with a menu of passport-style attestations (zk email/passport proofs, onchain history scores) evaluated inside the MACI circuit so verification is one signature, not a video call. Use account abstraction to bundle registration, encrypted voting, and donation into a single sponsored transaction. Decentralize the coordinator via a small committee running threshold-decryption MACI (as later MACI research proposed), removing the stalling/censorship residue. For pool growth, plug matching pools into protocol-fee streams (e.g., a sequencer-fee or restaking-yield tithe governed by the round's own QF outcomes), making rounds recurring and self-funding rather than grant-dependent. Finally, publish per-round anti-collusion "integrity reports" (proof artifacts plus audit of coordinator behavior) as a marketable differentiator to ecosystems that have been burned by Sybil-driven QF farming — selling trust minimization as compliance infrastructure, not just ideology.