[GIP - 114] Spearbit - Gearbox Security Review Proposal

This proposal aims to request a budget from the DAO in size of 300,000 USDC, in order to pay for Spearbit Security Review. This budget covers the current request from Spearbit team (251,786 USDC), as well as an additional budget in case of fixes or minor code changes (approx. ~25% buffer on top of current request).

Spearbit Security Review Proposal

This proposal aims to request a budget from the DAO in the size of $251,786 USDC, in order to pay for a full comprehensive security review for the scope: https://github.com/Gearbox-protocol/core-v3. The audit will be conducted by Spearbit for 3 weeks starting on May 13th 2024.

About Spearbit

Spearbit is a distributed security firm providing security services to web3 clients. Our members include some of the most prominent Security Researchers in the industry.

We provide the full end-to-end offering of security services, for this particular proposal we will look to facilitate a Security review. We’ve worked on high profile clients, top projects like Uniswap, Morpho, AAVE, MakerDAO, Polygon zKEVM, OP, zKSync and many more on securing their protocols.

Links:

Website - https://spearbit.com/ Portfolio- https://github.com/spearbit/portfolio

The proposal:

We will conduct a comprehensive review of Gearbox’s security posture, including the smart contracts, the architecture, and the development framework.

Spearbit will manage the quality control, and structure teams based on required skill sets and expertise to ensure security reviews are conducted to the highest standards.

We have scoped on request by Gearbox for the repo: GitHub - Gearbox-protocol/core-v3 this has been scoped according to complexity and matched them with the appropriate security researcher team.

The engagement will have a full Spearbit team consisting of 2 Lead security researchers, 1 Security researcher and 1 Associate SR (team of 4) for a 3 week security review period.

The total cost of the security review will be: $251,786 USDC

After the review, we will look to follow up on a separate engagement for a fixed review period, to validate and review any fixes made from any issues found on the security review period.

The final sum including all re-audits will be posted on Discord once the audit concludes.

Legal Agreement

Legal agreement regarding this engagement will be signed between Spearbit inc. (our entity) and Gearbox Foundation.

Voting

Approve/Reject