OpenZeppelin Security Partnership - 2022 Q2 Adjustment
01Summary
OpenZeppelin's Q2 2022 security partnership payment is being restructured: the existing COMP contributor grant stream is being terminated (set to zero), and replaced with a Sablier stream of approximately 8.93M COMP tokens distributed over a quarterly period from April 1 to September 1, 2022.
- Type
- treasury allocation
Key changes
- Set OpenZeppelin ContributorCompSpeed to zero, terminating the existing COMP contributor grant stream(high)
- Approve Sablier contract to spend 8,928,571.428571430000000000 COMP tokens(high)
- Create new Sablier stream to OpenZeppelin (0x57C970568668087c05352456a3F59B58B0330066) with quarterly payment from April 1, 2022 to September 1, 2022(high)
Notable concerns
- Quarterly payment structure requires governance action each quarter to adjust fees according to original formula
- Payment mechanism change from direct COMP stream to Sablier stream may affect token distribution timing
Generated by Kvorum
02Description
OpenZeppelin Security Partnership - 2022 Q2 Adjustment
Background
Starting on Dec 21st, 2021, OpenZeppelin was selected to offer the Compound DAO security services including continuous audit, security advisory, and monitoring.
OpenZeppelin has finished auditing the Compound Deployed Contracts and finalized the CToken Refactor audit (details here). On the Security Advisory services, OpenZeppelin has been focusing on improving the security of the Proposal Process and Asset Listings. Finally, on Security Monitoring, OpenZeppelin is aiming to release an initial solution by the end of March.
Replacing Existing Contributor Grant with Sablier Stream
As outlined in the original proposal, at the start of every quarter OpenZeppelin will create a proposal to update the service fee payment in accordance with the formula outlined in the proposal.
As it is the beginning of a new quarter, OpenZeppelin is updating its streaming grant and replacing its existing COMP stream with a Sablier stream. This governance proposal sets the OpenZeppelin ContributorCompSpeed to zero and sets up a Sablier stream to OpenZeppelin instead.
More detail in this forum post
03Mismatch analysis
The description states two high-level actions: (1) zero out OpenZeppelin's ContributorCompSpeed, and (2) set up a Sablier stream to OpenZeppelin instead. The calldata matches this narrative closely: action 0 sets the contributor comp speed to 0 for the OpenZeppelin address, action 1 approves the Sablier contract to spend a specific COMP amount, and action 2 creates a Sablier stream to the same OpenZeppelin recipient address over a ~91-day period (one quarter), consistent with the quarterly stream update described. There is no target mismatch — the recipient address in the stream (0x57C9...0066) matches the address whose comp speed was zeroed. The only omission is that the description does not specify the exact COMP amount or stream dates, but this is reasonable summarization for a routine quarterly adjustment proposal, especially since it links to a forum post with full details. This is a minor, not material, discrepancy — the core actions described (zero speed, create stream) are faithfully implemented, just without granular numbers in the prose.}
Discrepancies
- lowomitted in description
The description does not mention the specific COMP amount (8,928.57 COMP) or the exact stream duration/timestamps being set up, though this is a mechanical detail consistent with the quarterly adjustment described in the linked forum post.
“sets up a Sablier stream to OpenZeppelin instead”
Generated by Kvorum
04Actions
- Target
- 0x3d98…cd3b
- Value
- 0 wei
- Function
- _setContributorCompSpeed(address,uint256)
- Arguments
{ "0": "0x57C970568668087c05352456a3F59B58B0330066", "1": "0" }- Calldata
- Target
- 0xc00e…6888
- Value
- 0 wei
- Function
- approve(address,uint256)
- Arguments
{ "0": "0xCD18eAa163733Da39c232722cBC4E8940b1D8888", "1": "8928571428571430000000" }- Calldata
- Target
- 0xcd18…8888
- Value
- 0 wei
- Function
- createStream(address,uint256,address,uint256,uint256)
- Arguments
{ "0": "0x57C970568668087c05352456a3F59B58B0330066", "1": "8928571428571430000000", "2": "0xc00e94Cb662C3520282E6f5717214004A7f26888", "3": "1648771200", "4": "1656633600" }- Calldata
05Tally
Summed from votes
06Voters
No votes recorded yet.
07Forum
- Proposal: OpenZeppelin Security Partnership - 2022 Q2 Adjustment ↗discourse · high confidence
- Proposal Security Process Discussion ↗discourse · high confidence
Arguments for
- The proposal simply continues the quarterly compensation formula for OpenZeppelin's security services as originally approved by COMP voters in the on-chain December 2021 proposal.— cylon
- OpenZeppelin has been transparent about its repeated execution mistakes, explained the technical root causes, and proactively refunded gas costs to affected voters.— cylon
- OpenZeppelin is improving its process by adding buffer time to Sablier startTime parameters and automating queue/execute steps via Defender Autotasks to prevent further failures.— cylon
- When Sablier repeatedly proved problematic, OpenZeppelin pragmatically switched back to the simpler built-in COMP streaming function and simulated execution to ensure success.— cylon
Arguments against
- There is a discrepancy between the on-chain proposal text (quarterly payments) and the incorporated Google Doc 'Final Proposal' (which stated a 6-month period and two payments), raising concern that the DAO may not have clearly approved the terms being enacted, especially given the proposal involves roughly $4M/year.— kleong
- Multiple consecutive failed proposal executions (timing issues with Sablier's startTime, and a deposit-not-divisible-by-duration error) demonstrate poor process reliability and repeated user error.— arr00, yuradmt, cylon
Unresolved concerns
- Whether COMP holders who voted based on the linked Google Doc's terms (6-month/two-payment structure) may have been operating under different assumptions than the on-chain text, and how such discrepancies should be handled going forward.— kleong
- Whether Sablier v1 is fundamentally unsuited for time-sensitive Compound governance proposals given repeated startTime and divisibility failures, pending future protocol fixes.— cylon, paulrberg, yuradmt
- Whether the proposed Defender Autotask automation tool is reliable and safe enough to be recommended for broader community use in future proposals.— cylon
Notable participants
- cylonProposer from OpenZeppelin who submitted multiple versions of the compensation proposal, explained technical failures, refunded gas costs, and responded to community concerns.
- kleongCommunity member who raised a detailed concern about discrepancies between the on-chain proposal and the referenced Google Doc's fee structure terms.
- paulrbergSablier team representative who explained the protocol's startTime limitation and noted plans to fix it in future releases.
- arr00Community member credited with identifying the first Sablier timing issue that led to cancellation of the initial proposal.
- yuradmtCommunity member who identified the on-chain execution failure due to a deposit-divisibility issue in the Sablier stream.
Generated by Kvorum
08Similar proposals
- compoundcanceledOpenZeppelin Security Partnership - 2022 Q2 Adjustment V299%
- compoundcanceledOpenZeppelin Security Partnership - 2022 Q2 Adjustment V398%
- compoundexecutedOpenZeppelin Security Partnership - 2022 Q2 Adjustment V496%
- compounddefeatedSecurity Solutions For Compound Governance82%
- compoundexecutedOpenZeppelin Security Partnership - Annual Renewal 202581%
- compoundcanceledOpenZeppelin Security Partnership - Annual Renewal 202581%
- compoundexecutedOpenZeppelin Security Partnership - Annual Renewal 202480%
- compoundexecutedOpenZeppelin Continuous Audit & Security Services Proposal77%
- compoundcanceledMigrate Contributor Streams to Sablier72%
- compoundexecutedFinalize Security Service Provider Engagement (2025)71%