Security Solutions For Compound Governance
01Summary
OpenZeppelin proposes a security retainer program to provide continuous auditing, threat monitoring, protocol security advisory, and community education for Compound governance. The on-chain action sets a contributor COMP distribution rate to OpenZeppelin's address.
- Type
- treasury allocation
Key changes
- Establish Protocol Security Officer role providing advisory on governance incident and emergency response(high)
- Implement continuous security audits of all new code introduced through governance proposals(high)
- Deploy continuous threat monitoring of the Compound Protocol(high)
- Provide security training and community education on DeFi threats and best practices(medium)
- Set COMP contributor distribution rate of 5026789647075380 wei per block to OpenZeppelin address(medium)
Notable concerns
- Proposal references Proposal 62 as evidence of security risks but does not detail specific vulnerabilities
- Security solutions are described as ongoing retainer with future performance fee proposal to be submitted after March 30, 2022
- Implementation details and success metrics are not included in the proposal summary
Generated by Kvorum
02Description
Security Solutions For Compound Governance
Summary:
Goal
Implement Security Solutions to prevent and mitigate loss of funds resulting from security risks introduced by community-proposed upgrades to the Compound protocol.
Problem
As evidenced in recent market events and specifically Proposal 62, governance upgrades can introduce new security risk vectors which could result in reputational damage to the protocol and possible loss of user funds. Security is a continuous effort and should therefore be seen and addressed from a holistic, continuous perspective.
Background
For the past two years, OpenZeppelin has worked formally and informally with Compound to perform 10+ security audits, develop a standardized version of GovernorAlpha and GovernorBravo contracts, introduce security best practices for safer governance systems, and develop bespoke threat detection agent scripts monitoring Compound.
As the community assumes greater responsibility for the protocol and the stakes become higher, Compound's decentralized phase of growth demands comprehensive and continuous security processes to thrive.
Contributor grant
OpenZeppelin is requesting a streaming grant for the Security Solutions retainer fee to begin implementation of a comprehensive set of best-in-class Security Solutions throughout all stages of the Compound governance proposal lifecycle, the elements of which include:
- Protocol Security Officer to provide advisory services and recommendations on improvements to the governance process (specifically in the area of incident and emergency response)
- Security Training and tailored community support specifically designed to educate the community to security best practices and threats in the DeFi space related to the Compound protocol
- Continuous Audits of all new code introduced by governance proposals
- Continuous Threat Monitoring of the Compound Protocol
See full proposal and forum discussion
Starting March 30, 2022, and after further feedback from the Community, OpenZeppelin, will create an additional proposal to cover the performance fee payment in accordance with the formula outlined in the full proposal.
References
-
Forum Discussion on reviewing large code changes: https://www.comp.xyz/t/more-rigorous-process-on-reviewing-large-code-changes-re-comp-bug-9-29-21/2326/2
-
Patch for Proposal 63: https://www.comp.xyz/t/compound-proposal-63-temporary-patch-for-comp-distribution-bug-9-29-21/2327
03Mismatch analysis
The proposal describes a 'streaming grant' to OpenZeppelin for a Security Solutions retainer, to be paid over time rather than as a lump sum. The single decoded action calls Comptroller._setContributorCompSpeed, which is exactly the mechanism Compound Governance uses to stream COMP tokens to a contributor address at a fixed per-block rate — this matches the prose's description of a 'streaming grant' well. The description does not specify the exact recipient address or the COMP/block rate, so I cannot verify those specific numbers against the prose, but there is no contradicting claim in the text (no different address or amount is stated that conflicts with calldata). Since the action type (streaming compensation via comp speed) aligns with the narrative and there are no numeric or target claims in the prose to contradict, I find no discrepancy. Confidence is medium rather than high because the description is fairly high-level (funding mechanism, exact figures, and recipient address are not explicitly stated in the prose), limiting the precision of the comparison, but the fundamental action matches the stated intent well enough to be called consistent.
Generated by Kvorum
04Actions
- Target
- 0x3d98…cd3b
- Value
- 0 wei
- Function
- _setContributorCompSpeed(address,uint256)
- Arguments
{ "0": "0x57C970568668087c05352456a3F59B58B0330066", "1": "5026789647075380" }- Calldata
05Tally
Summed from votes
06Voters
| Voter | Choice | % of total | Rationale | ||
|---|---|---|---|---|---|
| EA0xea6c…3bf7 | Against | 306K | 38.22% | — | 5y ago |
| 880x88fb…3981 | For | 105K | 13.12% | — | 5y ago |
| 680x683a…6c02 | Abstain | 100K | 12.49% | — | 5y ago |
| 9B0x9b68…2984 | Against | 66.1K | 8.25% | — | 5y ago |
| F60xf63e…78c8 | Against | 50.3K | 6.28% | — | 5y ago |
| 450x458c…730e | Against | 50K | 6.25% | — | 5y ago |
| DC0xdc1f…e432 | Against | 50K | 6.25% | — | 5y ago |
| 070x0703…961b | Against | 50K | 6.25% | — | 5y ago |
| 0A0x0a09…b92e | For | 15K | 1.87% | — | 5y ago |
| 2B0x2b38…bf33 | Against | 7.7K | 0.97% | — | 5y ago |
| C80xc8a6…dffc | Against | 200.2 | 0.03% | — | 5y ago |
| 840x84e3…5a95 | For | 165.2 | 0.02% | — | 5y ago |
| 660x66cd…65f9 | Against | 13.4 | 0.00% | — | 5y ago |
| 450x4504…3424 | Against | 0.5 | 0.00% | — | 5y ago |
| 880x88b3…1d42 | Against | 0.3 | 0.00% | — | 5y ago |
07Forum
- Auditing Compound Protocol ↗discourse · high confidence
- More Rigorous Process On Reviewing Large Code Changes (RE: Comp Bug 9/29/21) ↗discourse · high confidence
- Compound Proposal 63: Temporary Patch for COMP Distribution Bug (9/29/21) ↗discourse · high confidence
Arguments for
- Compound urgently needs a continuous, professional audit process for governance proposals to prevent a repeat of the Proposal 62 exploit.— sukernik, dvf, jamico, getty, OZSecure
- Shifting the audit burden from individual contributors to a protocol-funded service will speed development and reduce risk of unreviewed code reaching governance votes.— sukernik, dvf, OZSecure, dguido
- Top-tier firms like OpenZeppelin and Trail of Bits have deep, proven experience auditing Compound and the broader DeFi ecosystem, making them credible partners.— jamico, annamira, dvf, TylerEther
- A layered security approach combining audits, education, threat monitoring, and advisory services adds value beyond simple ad-hoc auditing.— OZSecure, jamico, dguido
- A short (quarterly-renewable) engagement lets the DAO evaluate vendor performance and adjust or cancel the arrangement relatively quickly.— jamico, OZSecure
- Running a competitive, multi-vendor selection process (OZ, Trail of Bits, ChainSecurity) validates that the DAO is getting fair value and sets a template for future B2DAO deals.— sukernik, jamico, Rk2357, getty
Arguments against
- The proposed fees (originally $8M/year) are far higher than market rates for comparable audit work, based on historical proposal volume and cost.— getty, allthecolors, dvf
- The performance fee structure is poorly aligned with incentives, since auditors would almost certainly collect it regardless of effort or actual security outcomes.— dvf, allthecolors, arr00
- Streaming indefinite COMP payments to a vendor is inappropriate; compensation should be periodic and re-authorized by governance each term.— arr00, allthecolors
- OpenZeppelin's proposal scope crept well beyond the original request (education, monitoring, dashboards) and should have been split into separate proposals.— allthecolors, jared, dguido
- The process felt rushed and favored a single vendor (OZ) due to a pre-existing conflict of interest with the proposer, undermining fair competition.— allthecolors, dguido, JacobPPhillips
- Relying solely on external auditors ignores the deeper problem that Compound lacks internal QA, PM, and development process discipline.— RexShinka, dvf
- A single-vendor, lump-sum model risks vendor lock-in and conflicts of interest; a decentralized multi-auditor 'audit suite' approach would better scale with protocol complexity.— HRitzdorf, jared, Emilie_ChainSecurity
Unresolved concerns
- Whether the final agreed price (even after removing the performance fee) truly reflects fair market value for the services rendered.— getty, dvf, allthecolors
- How Compound will fund ongoing security services once the COMP distribution schedule runs out in the long term.— allthecolors
- Lack of a formal, repeatable process or governance mechanism for evaluating and selecting among competing vendor proposals.— sukernik, ratankaliani, JacobPPhillips
- Whether Compound should invest in building an internal security/dev team rather than depending entirely on external auditors long-term.— RexShinka, dvf, HRitzdorf
- Governance's inability to natively support multi-option or batched proposal voting, forcing reliance on an ad hoc community multisig process for vendor selection.— ratankaliani, JacobPPhillips, arr00
Notable participants
- sukernikInitiated the proposal process, disclosed conflicts of interest, and organized the multi-vendor selection procedure.
- OZSecureRepresented OpenZeppelin, submitted and repeatedly revised the primary competing proposal, and defended its pricing and scope.
- dguidoRepresented Trail of Bits, submitted a competing proposal and pushed back on process fairness and OZ's approach.
- gettyRaised the earliest and most detailed pricing critique of OZ's proposal.
- dvfFrequent commenter providing security-industry perspective, critiqued performance fee incentives, and ultimately compared and endorsed OZ over Trail of Bits.
- allthecolorsProvided the most thorough critique of process, conflicts of interest, scope creep, and cost/payment structure.
- HRitzdorfRepresented ChainSecurity, proposed an alternative decentralized multi-auditor 'audit suite' model.
- jamicoRepresented a16z, supported OZ's proposal, and helped broker the fair competitive process timeline.
- jaredRaised questions about audit scope, timing, and favored a more comprehensive, process-oriented long-term solution.
- Emilie_ChainSecurityClarified and defended ChainSecurity's multi-auditor 'audit suite' proposal in response to community questions.
Generated by Kvorum
08Similar proposals
- compoundexecutedOpenZeppelin Continuous Audit & Security Services Proposal85%
- compoundexecutedOpenZeppelin Security Partnership - 2022 Q2 Adjustment V482%
- compoundcanceledOpenZeppelin Security Partnership - 2022 Q2 Adjustment82%
- compoundcanceledOpenZeppelin Security Partnership - 2022 Q2 Adjustment V381%
- compoundcanceledOpenZeppelin Security Partnership - 2022 Q2 Adjustment V280%
- compoundexecutedOpenZeppelin Security Partnership - Annual Renewal 202577%
- compoundcanceledOpenZeppelin Security Partnership - Annual Renewal 202577%
- compoundexecutedOpenZeppelin Security Partnership - Annual Renewal 202475%
- compoundexecutedFinalize Security Service Provider Engagement (2025)74%
- compoundexecutedGauntlet <> Compound Renewal 202469%