KVORUM
compoundSource: Compound governor oz · #575

Update rsETH Price Feeds on WETH and wstETH Markets (Mainnet)

executedApr 27, 2026, 12:47 PM UTCby4D0x4d57…093e

01Summary

AISummary by Kvorumclaude-haiku-4-5

Migrate rsETH price feeds on Mainnet WETH and wstETH markets to a new 'MinMaxConstantPriceFeed' contract that allows the Community Multisig to bound exchange rates or set constant prices in response to the April 18 Kelp rsETH bridge exploit. This is temporary; a follow-up proposal will revert to prior configuration once resolved.

Type
contract upgrade

Key changes

  • Replace rsETH price feed on Mainnet WETH Comet with MinMaxConstantPriceFeed (0x49BB78FBB6ADEbD1fc75296213C8E60EBd434187)(high)
  • Replace rsETH price feed on Mainnet wstETH Comet with MinMaxConstantPriceFeed (0x6407efA45FB767f594e1e966ECcb621176c58b28)(high)
  • Deploy and upgrade WETH Comet implementation to support new price feed(high)
  • Deploy and upgrade wstETH Comet implementation to support new price feed(high)
  • Enable Community Multisig to set bounds (min/max) or constant prices for rsETH exchange rates without cooldown(high)
  • Lift liquidation pause on rsETH/wrsETH collateral in WETH and wstETH markets upon execution(medium)

Notable concerns

  • This is a temporary emergency measure in response to the April 18 Kelp rsETH bridge exploit
  • The new price feed grants significant discretionary power to the Community Multisig to modify bounds or switch to constant pricing without cooldown
  • Audit confirmation pending prior to proposal vote
Contracts0xA17581A9E3356d9A858b789D68B4d866e593aE940x3D0bb1ccaB520A66e607822fC55BC921738fAFE30x316f9708bb98af7da9c68c1c3b5e79039cd336e30x1ec63b5883c3481134fd50d5daebc83ecd2e8779
Generated by Kvorum
model: claude-haiku-4-5
provider: anthropic
profile: anthropic-fast-v1
prompt: v1.0
generated: 2mo ago
Read the description ↗

02Description

304 words

Update rsETH Price Feeds on WETH and wstETH Markets (Mainnet)

Summary

It is proposed to migrate the rsETH price feeds on the Mainnet WETH and wstETH Comets to a new 'MinMaxConstantPriceFeed' contract. This follows Gauntlet's proposal in response to the April 18 Kelp rsETH bridge exploit, and gives the Community Multisig a faster defensive lever than a full governance cycle.

This is intended as a temporary measure. Once the rsETH situation is resolved, a subsequent governance proposal will revert the price feeds to the prior configuration.

New Price Feed

The new feed wraps the existing Kelp exchange rate and operates in one of two modes, set by the Community Multisig:

  1. Bounded exchange rate (default). Passes the Kelp exchange rate through unchanged when it sits between configured 'min' and 'max' bounds. If the rate falls below 'min' or rises above 'max', the feed returns the bound. Setting 'min = 0' and 'max = ∞' reproduces the existing oracle behavior.
  2. Constant price. Returns a fixed price set by the multisig, bypassing the underlying feed. Intended for cases where the exchange rate can no longer be trusted.

Bounds and mode changes are multisig-only, with no cooldown. A cursory review by SSPs was already performed and a final audit confirmation will be linked on the forum prior to proposal vote.

Implementation details: PR #1113.

Proposal Actions

  1. Update the rsETH price feed on the Mainnet WETH market.
  2. Update the rsETH price feed on the Mainnet wstETH market.
  3. Deploy and upgrade the WETH Comet to the new implementation.
  4. Deploy and upgrade the wstETH Comet to the new implementation.

On execution, the liquidation pause on rsETH/wrsETH collateral in these markets will be lifted. A follow-up proposal will revert these markets to their prior price feed configuration once the incident is resolved.

03Mismatch analysis

AIMismatch analysis by Kvorumclaude-sonnet-5
Consistent

The description lists exactly four actions: (1) update rsETH price feed on WETH market, (2) update rsETH price feed on wstETH market, (3) deploy/upgrade WETH Comet, (4) deploy/upgrade wstETH Comet. The decoded calldata contains exactly four actions in the same order: two updateAssetPriceFeed calls targeting the Configurator for the rsETH asset on two distinct Comet proxy addresses, followed by two deployAndUpgradeTo calls on the same two Comet proxy addresses (via the Configurator/CometFactory pattern). The asset address (rsETH) is identical across both price feed updates, and the Comet proxy addresses used in the upgrade calls match those used in the price feed updates, confirming the WETH and wstETH markets are consistently referenced across both pairs of actions. There are no numeric parameters (percentages, bounds, fees) in either the description or calldata to cross-check, since bounds/mode are set by the multisig post-deployment via the new price feed contract, not via this proposal's calldata. No extra actions, omissions, or target mismatches were found. The proposal's narrative about temporary measures, multisig-controlled bounds, and a future reversion proposal are forward-looking statements not expected to appear in this proposal's calldata, so their absence is not a discrepancy. Overall the description accurately and completely represents the on-chain actions.

Generated by Kvorum
model: claude-sonnet-5
provider: anthropic
profile: anthropic-strong-v1
prompt: v1.0
generated: 2mo ago
Review the decoded actions ↗

04Actions

4 total
#0updateAssetPriceFeed(address,address,address)chain 0x1
Target
0x316f…36e3
Value
0 wei
Function
updateAssetPriceFeed(address,address,address)
Arguments
{
  "asset": "0xA1290d69c65A6Fe4DF752f95823fae25cB99e5A7",
  "cometProxy": "0xA17581A9E3356d9A858b789D68B4d866e593aE94",
  "newPriceFeed": "0x49BB78FBB6ADEbD1fc75296213C8E60EBd434187"
}
Calldata
#1updateAssetPriceFeed(address,address,address)chain 0x1
Target
0x316f…36e3
Value
0 wei
Function
updateAssetPriceFeed(address,address,address)
Arguments
{
  "asset": "0xA1290d69c65A6Fe4DF752f95823fae25cB99e5A7",
  "cometProxy": "0x3D0bb1ccaB520A66e607822fC55BC921738fAFE3",
  "newPriceFeed": "0x6407efA45FB767f594e1e966ECcb621176c58b28"
}
Calldata
#2deployAndUpgradeTo(address,address)chain 0x1
Target
0x1ec6…8779
Value
0 wei
Function
deployAndUpgradeTo(address,address)
Arguments
{
  "cometProxy": "0xA17581A9E3356d9A858b789D68B4d866e593aE94",
  "configuratorProxy": "0x316f9708bB98af7dA9c68C1C3b5e79039cD336E3"
}
Calldata
#3deployAndUpgradeTo(address,address)chain 0x1
Target
0x1ec6…8779
Value
0 wei
Function
deployAndUpgradeTo(address,address)
Arguments
{
  "cometProxy": "0x3D0bb1ccaB520A66e607822fC55BC921738fAFE3",
  "configuratorProxy": "0x316f9708bB98af7dA9c68C1C3b5e79039cD336E3"
}
Calldata

05Tally

Summed from votes

Voters16
VP participating737.8K
Outcome (current)For
Current support100%

06Voters

16 total
Filter:
VoterChoice% of totalRationale
3F0x3fb1…4c8aFor104.8K14.20%—7mo ago
660x66cd…65f9For80.2K10.87%—7mo ago
B30xb356…c826For60.3K8.18%—7mo ago
B40xb49f…7948For60K8.13%—7mo ago
050x0579…ca09For60K8.13%—7mo ago
170x1729…b879For60K8.13%—7mo ago
B70xb792…89d7For60K8.13%—7mo ago
B90xb933…8dd1For60K8.13%—7mo ago
D20xd2a7…5a0cFor60K8.13%—6mo ago
070x0703…961bFor51.7K7.01%—7mo ago
2B0x2b38…bf33For50.3K6.81%—6mo ago
130x13bd…8548For30K4.07%—6mo ago
1F0x1f3d…0591For440.70.06%—6mo ago
9F0x9f77…2768For0.90.00%—6mo ago
2F0x2f2f…f78aFor0.50.00%—7mo ago
140x1402…d132For0.10.00%—6mo ago
Showing 16

07Forum

AIForum synthesis by Kvorumclaude-haiku-4-5
sentiment · mixedthread · constructive

Arguments for

  • The proposal provides a necessary mechanism for the protocol to respond rapidly to rsETH repricing events without waiting for a full 7-day governance cycle, protecting liquidated positions from cascading failures driven by sudden exchange-rate steps.— Gauntlet
  • The new oracle design is a strict functional superset of the current oracle that preserves normal liquidation mechanics when the feed is trustworthy while enabling emergency override only if conditions require it.— Gauntlet
  • The measure is explicitly temporary and scoped narrowly to rsETH in only two specific comets (Ethereum WETH and wstETH), with a clear intent to revert to standard pricing once the Kelp incident resolves.— Gauntlet, allthecolors
  • The multisig's historical track record of engaged and effective stewardship, combined with overwhelming evidence of good governance practices, demonstrates trustworthiness sufficient to justify the temporary elevation of capabilities in this acute emergency.— allthecolors
  • The rsETH backing rescue coordinated by DeFi United partners is already substantially committed and substantially de-risks the scenario this proposal was designed to handle.— allthecolors

Arguments against

  • The multisig override grants a single-block, no-timelock authority to set rsETH to an arbitrary price, enabling the 5-of-9 signers to drain the protocol by manipulating the oracle without governance recourse, fundamentally changing their power from pausing to asset liquidation.— ugurmersin
  • Recent industry attacks targeting multisig signing flows (Bybit, Radiant Capital, Wazirx, etc.) demonstrate that supply-chain compromises of exactly this type of signer infrastructure are an active threat, and this proposal increases the value of compromising those signers from a denial-of-service target to a protocol-draining target.— ugurmersin
  • The multisig's jurisdictional concentration (5 of 9 US-based, meeting the 5/9 threshold alone) creates a single point of regulatory vulnerability, and the proposal introduces a mechanism that can be compelled by court order (as precedent shows with Summer.fi and currently with Arbitrum), transforming the multisig into a §1610(g) custodian subject to asset seizure orders.— ugurmersin
  • The proposal is unnecessary given that the rsETH rescue campaign is already 80% committed and likely to close the hole before Kelp's loss-allocation decision, making the emergency justification for extending multisig power evaporate.— ugurmersin
  • Gauntlet applies different risk standards to rsETH across its own Morpho vaults (deliberately kept to rounding errors due to liquidity and track-record concerns) versus Compound (where rsETH exposure became material enough to require an emergency workaround), revealing a principal-agent misalignment that calls into question Gauntlet's judgment as a core multisig member.— ugurmersin
  • The multisig itself holds veto authority over governance proposals, meaning COMP holders cannot remedy this arrangement if the multisig is compromised or compelled, creating a permanent lock-in of concentrated power.— ugurmersin

Unresolved concerns

  • What hardcoded constraints on the multisig's ability to set extreme constant prices (low enough to drain collateral or high enough to mint unbacked positions) would be sufficient, and can they be implemented generically when the definition of 'extreme' varies by asset?— allthecolors
  • Given precedent of regulatory bodies compelling multisig action (Arbitrum's security council, Summer.fi), how can the protocol guarantee that US-resident signers won't be compelled to misuse this oracle authority, and what recourse would exist if they were?— ugurmersin
  • Why is Compound proposing this elevated multisig authority when Aave and other affected protocols have not pursued similar oracle reconfigurations, and what is the principled difference in their risk postures?— ugurmersin

Notable participants

  • GauntletProposer of the oracle migration; provided technical design, security rationale, and commitment to revert the mechanism once rsETH stabilizes.
  • ugurmersinPrimary critic who raised and sustained the case against the proposal, focusing on multisig power concentration, supply-chain attack vectors, regulatory compulsion risk, and principal-agent misalignment.
  • allthecolorsBalanced voice who acknowledged both the legitimacy of ugurmersin's concerns and the urgency of reopening markets, ultimately supporting the proposal but recommending against it becoming precedent.
  • CuriaClosing voice who reflected on the thread's substantive debate, credited all participants' contributions, and called for calmer future planning to avoid emergency conditions.
Generated by Kvorum
model: claude-haiku-4-5
provider: anthropic
profile: anthropic-fast-v1
prompt: v1.0
generated: 2mo ago
Open the thread ↗