Michael Lewellen

OpenZeppelin Security Partnership - Annual Renewal 2025


## Background

OpenZeppelin has secured Compound since December 2021, establishing a proven track record of comprehensive protocol protection. In our current annual term (July 2024-June 2025), we’ve completed 40+ security audits, reviewed 180+ governance proposals, and identified 6 critical vulnerabilities while maintaining zero protocol losses due to security exploits.

Throughout this partnership, we’ve maintained Compound’s ecosystem security while flexibly responding to incidents and adapting to the DAO’s evolving development needs. Our collaborative approach with key contributors has optimized processes and enabled early risk mitigation across protocol operations.


This renewal continues our [comprehensive security services](https://www.comp.xyz/t/openzeppelin-security-partnership-renewal-2025/6855#p-17213-services-2) with more detailed specifications of the coverage we’ve been providing to Compound, making our commitments more explicit.

## Compensation Structure

Previously OpenZeppelin used the Vendor Payment Aera Vault adopted in [Proposal 249](https://www.tally.xyz/gov/compound/proposal/249). With the deprecation of the Vendor Payment Aera Vault, Woof! Software proposed a [USDC-price-adjusted COMP streaming mechanism](https://www.comp.xyz/t/payment-streamer-audit/6779). This approach provides several benefits: 

* Reduced governance overhead for voters 
* Payment of USDC obligations using COMP 
* DAO clawback of unvested assets 
* DAO capture of net COMP appreciation

OpenZeppelin will continue its annual renewal model for our Security Partnership adopting the same streaming approach. Our governance proposal will initiate a deposit of 110% of the 4M USDC equivalent in COMP, using a [30-day TWAP price at week of proposal submission](https://dune.com/idle.finance/twap-calculator?1.+End+Date_db9004=2025-06-20+00%3A00%3A00&2.+Rolling+Average+Timeframe_n71719=30&3.+Token_t1ab42=COMP), to be streamed over the course of a year starting at the beginning of Q3 2025.

The 10% buffer is designed to accommodate potential price fluctuations while balancing capital efficiency. **OpenZeppelin will only receive the prorated portion of the $4M annual value based on actual service duration**.

Governance may initiate early termination through a subsequent on-chain governance proposal with at least three months advance notice. Unvested funds can be transferred to the DAO by anyone 10 days or more after the term ends or after the notice period expires.

This proposal grants COMP from the Comptroller to the [payment streamer contract](https://etherscan.io/address/0xf6e94c13f07a50b3aafe55e5785edc2be6c9620c#code), created by the [Streamer Factory](https://etherscan.io/tx/0x76338697eb4da86a002d438058668c1f411bb3c47275f90c8cc1ec137342f584) ([Audit Report](https://www.comp.xyz/t/compound-streamer-audit/6925)), and initializes the stream.

More detail in this [forum post](https://www.comp.xyz/t/openzeppelin-security-partnership-renewal-2025/6855).

By approving this proposal, you agree that any services provided by OpenZeppelin shall be governed by the [Terms of Service](https://docs.google.com/document/d/1eDcvirf0bdzpjIkfxQHm7fcV05O1IcLXL-Dl-U52Y4k) that were updated as of Sep 19th, 2023.
