OpenZeppelin Security Partnership - 2022 Q2 Adjustment V4
01Summary
OpenZeppelin's Q2 2022 security partnership payment is being adjusted via an updated streaming grant, removing previous Sablier-related timing issues. The adjustment sets a contributor COMP speed of approximately 19.63 COMP per block for OpenZeppelin's address.
- Type
- parameter change
Key changes
- Set contributor COMP speed for OpenZeppelin (0x57C970568668087c05352456a3F59B58B0330066) to 19632448894554800 wei per block via _setContributorCompSpeed function(high)
- Replace Sablier stream mechanism with continued use of existing streaming function to resolve prior timing issues(medium)
Notable concerns
- Prior proposals had timing issues with Sablier stream creation that required cancellation
Generated by Kvorum
02Description
OpenZeppelin Security Partnership - 2022 Q2 Adjustment V4
Background
There were timing issues with the Sablier stream creation in past canceled proposals. In this proposal, we've removed Sablier and will continue with the existing streaming function. More information on the timing issue is available here.
Starting on Dec 21st, 2021, OpenZeppelin was selected to offer the Compound DAO security services including continuous audit, security advisory, and monitoring.
OpenZeppelin has finished auditing the Compound Deployed Contracts and finalized the CToken Refactor audit (details here). On the Security Advisory services, OpenZeppelin has been focusing on improving the security of the Proposal Process and Asset Listings. Finally, on Security Monitoring, OpenZeppelin is aiming to release an initial solution by the end of March.
As outlined in the original proposal, at the start of every quarter OpenZeppelin will create a proposal to update the service fee payment in accordance with the formula outlined in the proposal. As it is the beginning of a new quarter, OpenZeppelin is updating its existing streaming grant.
More detail in this forum post
03Mismatch analysis
The description explains that this is a quarterly adjustment to OpenZeppelin's security partnership compensation, explicitly noting that Sablier stream creation has been dropped in favor of continuing with the existing COMP streaming mechanism (i.e., _setContributorCompSpeed). The single decoded action is exactly a call to _setContributorCompSpeed, targeting what is presumably OpenZeppelin's recipient address, setting a new per-block COMP rate. This aligns directly with the narrative: one action, one recipient, using the existing streaming function rather than Sablier. The description does not specify an exact numeric COMP speed or dollar figure, so I cannot verify the exact value against a stated figure in the text — this limits confidence to medium rather than high, but it does not constitute a discrepancy since the description makes no specific numeric claim to contradict. There is no evidence of extra actions, omitted actions, or a mismatched target contract/function. Overall, the calldata is consistent with what the description claims will happen, and no material or misleading gaps were found.
Generated by Kvorum
04Actions
- Target
- 0x3d98…cd3b
- Value
- 0 wei
- Function
- _setContributorCompSpeed(address,uint256)
- Arguments
{ "0": "0x57C970568668087c05352456a3F59B58B0330066", "1": "19632448894554800" }- Calldata
05Tally
Summed from votes
06Voters
No votes recorded yet.
07Forum
- Proposal: OpenZeppelin Security Partnership - 2022 Q2 Adjustment ↗discourse · high confidence
- Proposal Security Process Discussion ↗discourse · high confidence
Arguments for
- The proposal simply continues the quarterly compensation formula for OpenZeppelin's security services as originally approved by COMP voters in the on-chain December 2021 proposal.— cylon
- OpenZeppelin has been transparent about its repeated execution mistakes, explained the technical root causes, and proactively refunded gas costs to affected voters.— cylon
- OpenZeppelin is improving its process by adding buffer time to Sablier startTime parameters and automating queue/execute steps via Defender Autotasks to prevent further failures.— cylon
- When Sablier repeatedly proved problematic, OpenZeppelin pragmatically switched back to the simpler built-in COMP streaming function and simulated execution to ensure success.— cylon
Arguments against
- There is a discrepancy between the on-chain proposal text (quarterly payments) and the incorporated Google Doc 'Final Proposal' (which stated a 6-month period and two payments), raising concern that the DAO may not have clearly approved the terms being enacted, especially given the proposal involves roughly $4M/year.— kleong
- Multiple consecutive failed proposal executions (timing issues with Sablier's startTime, and a deposit-not-divisible-by-duration error) demonstrate poor process reliability and repeated user error.— arr00, yuradmt, cylon
Unresolved concerns
- Whether COMP holders who voted based on the linked Google Doc's terms (6-month/two-payment structure) may have been operating under different assumptions than the on-chain text, and how such discrepancies should be handled going forward.— kleong
- Whether Sablier v1 is fundamentally unsuited for time-sensitive Compound governance proposals given repeated startTime and divisibility failures, pending future protocol fixes.— cylon, paulrberg, yuradmt
- Whether the proposed Defender Autotask automation tool is reliable and safe enough to be recommended for broader community use in future proposals.— cylon
Notable participants
- cylonProposer from OpenZeppelin who submitted multiple versions of the compensation proposal, explained technical failures, refunded gas costs, and responded to community concerns.
- kleongCommunity member who raised a detailed concern about discrepancies between the on-chain proposal and the referenced Google Doc's fee structure terms.
- paulrbergSablier team representative who explained the protocol's startTime limitation and noted plans to fix it in future releases.
- arr00Community member credited with identifying the first Sablier timing issue that led to cancellation of the initial proposal.
- yuradmtCommunity member who identified the on-chain execution failure due to a deposit-divisibility issue in the Sablier stream.
Generated by Kvorum
08Similar proposals
- compoundcanceledOpenZeppelin Security Partnership - 2022 Q2 Adjustment96%
- compoundcanceledOpenZeppelin Security Partnership - 2022 Q2 Adjustment V295%
- compoundcanceledOpenZeppelin Security Partnership - 2022 Q2 Adjustment V395%
- compounddefeatedSecurity Solutions For Compound Governance82%
- compoundexecutedOpenZeppelin Security Partnership - Annual Renewal 202481%
- compoundcanceledOpenZeppelin Security Partnership - Annual Renewal 202581%
- compoundexecutedOpenZeppelin Security Partnership - Annual Renewal 202581%
- compoundexecutedOpenZeppelin Continuous Audit & Security Services Proposal79%
- compoundexecutedFinalize Security Service Provider Engagement (2025)70%
- compoundexecutedOpenZeppelin Security Partnership - 2025 Early Termination68%