OpenZeppelin Security Partnership - 2022 Q2 Adjustment V3
01Summary
Compound DAO is ending OpenZeppelin's existing COMP contributor stream and replacing it with a Sablier stream for 8,349.61 COMP tokens covering Q2 2022 (April 19 - June 30, 2022). This corrects timing issues from two previously canceled proposals and aligns with the quarterly adjustment formula established in the original OpenZeppelin security partnership.
- Type
- treasury allocation
Key changes
- Set OpenZeppelin ContributorCompSpeed to zero, ending the existing continuous COMP stream(high)
- Approve 8,349.61 COMP tokens to Sablier contract for stream creation(high)
- Create Sablier stream sending 8,349.61 COMP to OpenZeppelin from April 19, 2022 to June 30, 2022(high)
Notable concerns
- This is the third attempt at this proposal due to timing issues with Sablier stream creation in proposals 94 and 95
Generated by Kvorum
02Description
OpenZeppelin Security Partnership - 2022 Q2 Adjustment V3
Background
There were timing issues with the Sablier stream creation in the past two canceled proposals 94 and 95 that has been corrected in this proposal. More information on the timing issue and how we've corrected for it is available here.
Starting on Dec 21st, 2021, OpenZeppelin was selected to offer the Compound DAO security services including continuous audit, security advisory, and monitoring.
OpenZeppelin has finished auditing the Compound Deployed Contracts and finalized the CToken Refactor audit (details here). On the Security Advisory services, OpenZeppelin has been focusing on improving the security of the Proposal Process and Asset Listings. Finally, on Security Monitoring, OpenZeppelin is aiming to release an initial solution by the end of March.
Replacing Existing Contributor Grant with Sablier Stream
As outlined in the original proposal, at the start of every quarter OpenZeppelin will create a proposal to update the service fee payment in accordance with the formula outlined in the proposal.
As it is the beginning of a new quarter, OpenZeppelin is updating its streaming grant and replacing its existing COMP stream with a Sablier stream. This governance proposal sets the OpenZeppelin ContributorCompSpeed to zero and sets up a Sablier stream to OpenZeppelin instead.
More detail in this forum post
03Mismatch analysis
The description states two high-level actions: zero out OpenZeppelin's existing ContributorCompSpeed and create a new Sablier stream to OpenZeppelin instead. The calldata does exactly this: action 0 zeroes the comp speed for the OpenZeppelin address, action 1 approves the Sablier contract to pull the COMP needed for the stream (a routine mechanical step implied by 'setting up a Sablier stream'), and action 2 creates the stream to the same OpenZeppelin address for a ~72-day period spanning April-June 2022, consistent with a quarterly adjustment. The description does not specify exact COMP amounts or stream dates, but this is reasonable summarization for a recurring quarterly process proposal type, and none of the omitted details (approval step, exact amount/dates) contradict or redirect funds away from the stated recipient. All target addresses are consistent internally (recipient in action 0 and action 2 match, approved spender in action 1 matches Sablier contract in action 2). No value, target, or directional mismatches were found.atMy confidence is high because the actions map cleanly onto the two claims in the description with no ambiguity in target addresses or purpose.
Generated by Kvorum
04Actions
- Target
- 0x3d98…cd3b
- Value
- 0 wei
- Function
- _setContributorCompSpeed(address,uint256)
- Arguments
{ "0": "0x57C970568668087c05352456a3F59B58B0330066", "1": "0" }- Calldata
- Target
- 0xc00e…6888
- Value
- 0 wei
- Function
- approve(address,uint256)
- Arguments
{ "0": "0xCD18eAa163733Da39c232722cBC4E8940b1D8888", "1": "8349610456744080000000" }- Calldata
- Target
- 0xcd18…8888
- Value
- 0 wei
- Function
- createStream(address,uint256,address,uint256,uint256)
- Arguments
{ "0": "0x57C970568668087c05352456a3F59B58B0330066", "1": "8349610456744080000000", "2": "0xc00e94Cb662C3520282E6f5717214004A7f26888", "3": "1650412800", "4": "1656633600" }- Calldata
05Tally
Summed from votes
06Voters
No votes recorded yet.
07Forum
- Proposal: OpenZeppelin Security Partnership - 2022 Q2 Adjustment ↗discourse · high confidence
- Proposal Security Process Discussion ↗discourse · high confidence
Arguments for
- The proposal simply continues the quarterly compensation formula for OpenZeppelin's security services as originally approved by COMP voters in the on-chain December 2021 proposal.— cylon
- OpenZeppelin has been transparent about its repeated execution mistakes, explained the technical root causes, and proactively refunded gas costs to affected voters.— cylon
- OpenZeppelin is improving its process by adding buffer time to Sablier startTime parameters and automating queue/execute steps via Defender Autotasks to prevent further failures.— cylon
- When Sablier repeatedly proved problematic, OpenZeppelin pragmatically switched back to the simpler built-in COMP streaming function and simulated execution to ensure success.— cylon
Arguments against
- There is a discrepancy between the on-chain proposal text (quarterly payments) and the incorporated Google Doc 'Final Proposal' (which stated a 6-month period and two payments), raising concern that the DAO may not have clearly approved the terms being enacted, especially given the proposal involves roughly $4M/year.— kleong
- Multiple consecutive failed proposal executions (timing issues with Sablier's startTime, and a deposit-not-divisible-by-duration error) demonstrate poor process reliability and repeated user error.— arr00, yuradmt, cylon
Unresolved concerns
- Whether COMP holders who voted based on the linked Google Doc's terms (6-month/two-payment structure) may have been operating under different assumptions than the on-chain text, and how such discrepancies should be handled going forward.— kleong
- Whether Sablier v1 is fundamentally unsuited for time-sensitive Compound governance proposals given repeated startTime and divisibility failures, pending future protocol fixes.— cylon, paulrberg, yuradmt
- Whether the proposed Defender Autotask automation tool is reliable and safe enough to be recommended for broader community use in future proposals.— cylon
Notable participants
- cylonProposer from OpenZeppelin who submitted multiple versions of the compensation proposal, explained technical failures, refunded gas costs, and responded to community concerns.
- kleongCommunity member who raised a detailed concern about discrepancies between the on-chain proposal and the referenced Google Doc's fee structure terms.
- paulrbergSablier team representative who explained the protocol's startTime limitation and noted plans to fix it in future releases.
- arr00Community member credited with identifying the first Sablier timing issue that led to cancellation of the initial proposal.
- yuradmtCommunity member who identified the on-chain execution failure due to a deposit-divisibility issue in the Sablier stream.
Generated by Kvorum
08Similar proposals
- compoundcanceledOpenZeppelin Security Partnership - 2022 Q2 Adjustment V2100%
- compoundcanceledOpenZeppelin Security Partnership - 2022 Q2 Adjustment98%
- compoundexecutedOpenZeppelin Security Partnership - 2022 Q2 Adjustment V495%
- compounddefeatedSecurity Solutions For Compound Governance81%
- compoundexecutedOpenZeppelin Security Partnership - Annual Renewal 202580%
- compoundcanceledOpenZeppelin Security Partnership - Annual Renewal 202580%
- compoundexecutedOpenZeppelin Security Partnership - Annual Renewal 202480%
- compoundexecutedOpenZeppelin Continuous Audit & Security Services Proposal77%
- compoundcanceledMigrate Contributor Streams to Sablier75%
- compoundexecutedFinalize Security Service Provider Engagement (2025)72%