OpenZeppelin Security Partnership - Annual Renewal 2025
01Summary
OpenZeppelin's annual security partnership renewal for 2025, providing comprehensive protocol audits and vulnerability identification. Compensation of $4M USD equivalent in COMP (110% buffer = ~93.5M COMP at 30-day TWAP) will be streamed over one year starting Q3 2025 via a price-adjusted streaming mechanism, with DAO clawback rights and early termination options.
- Type
- treasury allocation
- Funding
- $4000000
Key changes
- Grant 93,537,414.97 COMP to payment streamer contract for OpenZeppelin security services(high)
- Initialize streaming mechanism to distribute COMP over 12 months with USDC-price adjustment(high)
- Replace Vendor Payment Aera Vault with new COMP streaming payment structure(medium)
- Implement DAO clawback rights on unvested assets after term ends or notice period expires(medium)
Notable concerns
- 10% COMP buffer introduces price fluctuation risk that could result in excess or insufficient payout
- Early termination requires three months advance notice, locking DAO into minimum commitment period
- OpenZeppelin receives only prorated compensation based on actual service duration, but specific audit/proposal review metrics not quantified in proposal
Generated by Kvorum
02Description
OpenZeppelin Security Partnership - Annual Renewal 2025
Background
OpenZeppelin has secured Compound since December 2021, establishing a proven track record of comprehensive protocol protection. In our current annual term (July 2024-June 2025), we’ve completed 40+ security audits, reviewed 180+ governance proposals, and identified 6 critical vulnerabilities while maintaining zero protocol losses due to security exploits.
Throughout this partnership, we’ve maintained Compound’s ecosystem security while flexibly responding to incidents and adapting to the DAO’s evolving development needs. Our collaborative approach with key contributors has optimized processes and enabled early risk mitigation across protocol operations.
This renewal continues our comprehensive security services with more detailed specifications of the coverage we’ve been providing to Compound, making our commitments more explicit.
Compensation Structure
Previously OpenZeppelin used the Vendor Payment Aera Vault adopted in Proposal 249. With the deprecation of the Vendor Payment Aera Vault, Woof! Software proposed a USDC-price-adjusted COMP streaming mechanism. This approach provides several benefits:
- Reduced governance overhead for voters
- Payment of USDC obligations using COMP
- DAO clawback of unvested assets
- DAO capture of net COMP appreciation
OpenZeppelin will continue its annual renewal model for our Security Partnership adopting the same streaming approach. Our governance proposal will initiate a deposit of 110% of the 4M USDC equivalent in COMP, using a 30-day TWAP price at week of proposal submission, to be streamed over the course of a year starting at the beginning of Q3 2025.
The 10% buffer is designed to accommodate potential price fluctuations while balancing capital efficiency. OpenZeppelin will only receive the prorated portion of the $4M annual value based on actual service duration.
Governance may initiate early termination through a subsequent on-chain governance proposal with at least three months advance notice. Unvested funds can be transferred to the DAO by anyone 10 days or more after the term ends or after the notice period expires.
This proposal grants COMP from the Comptroller to the payment streamer contract, created by the Streamer Factory (Audit Report), and initializes the stream.
More detail in this forum post.
By approving this proposal, you agree that any services provided by OpenZeppelin shall be governed by the Terms of Service that were updated as of Sep 19th, 2023.
03Mismatch analysis
The proposal describes two concrete on-chain steps: (1) granting COMP from the Comptroller to a payment streamer contract in an amount equal to 110% of the 4M USDC annual value (using a 30-day TWAP COMP price), and (2) initializing that streamer contract to begin the year-long vesting schedule. The decoded calldata contains exactly these two actions in the same order: a _grantComp call sending ~93,537.41 COMP to address 0xF6E94C13F07a50b3AaFE55E5785EdC2be6c9620C, followed by an initialize() call on that identical contract address. The recipient address in the grant matches the streamer contract address linked in the description, and the initialize() call targets the same contract, so there is no target mismatch. While the exact USD-to-COMP conversion (based on the 30-day TWAP referenced via the Dune link) cannot be independently recomputed here, the COMP amount is of a plausible order of magnitude for a ~$4.4M grant at typical COMP prices during the cited period, and nothing in the calldata suggests a different recipient, a different amount basis, or any additional undisclosed action. No extra actions, omitted actions, or misleading characterizations were found. Overall the description accurately and completely reflects the two on-chain actions.
Generated by Kvorum
04Actions
- Target
- 0x3d98…cd3b
- Value
- 0 wei
- Function
- _grantComp(address,uint256)
- Arguments
{ "amount": "93537414965990000000000", "recipient": "0xF6E94C13F07a50b3AaFE55E5785EdC2be6c9620C" }- Calldata
- Target
- 0xf6e9…620c
- Value
- 0 wei
- Function
- initialize()
- Arguments
{}- Calldata
05Tally
Summed from votes
06Voters
No votes recorded yet.
07Forum
- OpenZeppelin Security Partnership Renewal 2025 ↗discourse · high confidence
Arguments for
- OZ has a proven multi-year track record securing Compound, including preventing critical exploits and maintaining zero protocol losses.— jbass-oz, allthecolors, GozmanGonzalez
- The proposal's 60/90-day early termination clause gives the DAO flexibility to run a future RFP without immediately severing coverage.— jbass-oz, cylon, Compound_Foundation
- Uninterrupted security coverage is critical given upcoming Woof! deployments and ongoing governance/proposal review needs, so a transitional renewal avoids risky gaps.— cylon, dmitriywoofsoftware, Compound_Foundation, jbass-oz
- The new USDC-price-adjusted COMP streaming mechanism improves capital efficiency, transparency, and DAO clawback/enforcement safeguards versus the prior Aera Vault model.— GozmanGonzalez, jbass-oz
- OZ originally won the role through a competitive RFP in 2021 and has since earned trust through consistent, transparent performance, so short-term renewal pending a new RFP is reasonable rather than punitive.— jbass-oz
Arguments against
- OZ's $4M/year cost is disproportionate to Compound's TVL and risk profile compared to peers like Aave, indicating treasury misallocation.— bryancolligan, pennblockchain, Jorstack
- OZ's workflow is slow, rigid, and serialized, causing costly delays (e.g., 15-month Rewards V2 delay) that hurt Compound's competitiveness and growth.— bryancolligan
- The DAO should run a proper competitive RFP process before renewing, since multiple credible alternative security firms have expressed interest and are being discouraged by perceived governance capture.— bryancolligan, pennblockchain, Jorstack, Shelly, glory
- A dual-provider or reduced advisory model (OZ retained cheaply for institutional knowledge, a new lower-cost auditor handling routine work) would cut costs while preserving continuity.— bryancolligan
- Given OZ has already earned roughly $16M over four years, they should continue supporting the transition at reduced or no cost as a show of good-faith partnership rather than demanding full payment during the RFP window.— bryancolligan, pennblockchain, Jorstack
- There is no DAO growth strategy or roadmap to justify continued high security spend, making the ROI of the renewal unclear.— bryancolligan, Jorstack, pennblockchain
- OZ's coverage has been incomplete, failing to prevent front-end, governance, and economic-attack incidents despite its broad mandate and cost.— bryancolligan
Unresolved concerns
- Whether OZ should continue services at reduced or no compensation during the RFP transition period remains disputed and unresolved.— bryancolligan, cylon, Jorstack
- No detailed side-by-side comparison of OZ's scope/cost versus alternative vendors (e.g., Aave's security spend) was ever produced to substantiate claims either way.— Jorstack, bryancolligan
- The DAO lacks a clear roadmap or growth strategy tying security spend to future protocol direction, leaving the justification for the budget level unresolved.— bryancolligan, Jorstack
- Concerns about the DAO's dwindling COMP treasury from this and other large recurring asks (e.g., Foundation funding) were raised but not addressed with a mitigation plan.— allthecolors
- Whether a short RFP window (30-60 days) can be completed without introducing new security or continuity risks was questioned but never fully answered.— bryancolligan
Notable participants
- jbass-ozOpenZeppelin's representative who authored the renewal proposal, defended it against criticism, and issued updates including the termination clause revision.
- bryancolliganLead critic who authored a detailed business case against renewal, proposed a dual-provider model, and pushed for reduced/no pay during transition.
- cylonDelegate and former OZ employee who supported a transitional renewal to ensure continuity while an RFP is run, engaging directly with bryancolligan's objections.
- Compound_FoundationAnnounced support for an immediate RFP process, negotiated the reduced termination notice, and later formally triggered the termination clause.
- pennblockchainRepresented FranklinDAO, voiced opposition to renewal on cost/accountability grounds while acknowledging the pragmatic need for transition coverage.
- JorstackRaised concerns about lack of comparative data and a DAO roadmap, repeatedly pressing for justification of the spend.
- allthecolorsSupported renewal but flagged broader concerns about COMP treasury depletion from repeated large DAO asks.
- GozmanGonzalezOffered a supportive legal/compliance-oriented endorsement of the renewal and payment structure.
- dmitriywoofsoftwareWoof! Software representative who emphasized the operational need for continuous audit coverage during the transition.
- ShellyCertora co-founder who signaled vendor interest in participating in a future competitive RFP.
Generated by Kvorum
08Similar proposals
- compoundexecutedOpenZeppelin Security Partnership - Annual Renewal 2025100%
- compoundexecutedOpenZeppelin Security Partnership - Annual Renewal 202491%
- compoundexecutedCompound <> Gauntlet Year 5 Partnership81%
- compoundcanceledOpenZeppelin Security Partnership - 2022 Q2 Adjustment81%
- compoundexecutedOpenZeppelin Security Partnership - 2022 Q2 Adjustment V481%
- compoundcanceledOpenZeppelin Security Partnership - 2022 Q2 Adjustment V280%
- compoundcanceledOpenZeppelin Security Partnership - 2022 Q2 Adjustment V380%
- compoundexecutedWOOF! <> Compound 202580%
- compoundexecutedFinalize Security Service Provider Engagement (2025)77%
- compounddefeatedSecurity Solutions For Compound Governance77%