OpenZeppelin Security Partnership

The Venus community delegators are submitting this proposal on behalf of OpenZeppelin.

Summary

OpenZeppelin has proposed a Security Partnership with Venus protocol for performing security audits on retainer.

OpenZeppeling currently planned list of audits for Venus new product releases are:

-New Liquidator contract -Diamond Comptroller -Automatic allocation of income and Prime contract -Collecting needed tokens and Shortfall handling (Automated Treasury Management)

As Venus’s trusted security partner, OpenZeppelin will perform continuous security audits of Venus codebases and provide actionable feedback to help the development team improve smart contract security. They offer a total of 24 weeks of security research time to be used over the next 6 months for audits as directed by the Venus dev team, which includes fix reviews and a high-level analysis of current protocol security. The total cost is $554,400 to be paid in USDC on a quarterly schedule from the Venus treasury, starting with $277,200 at the start of Q3 2023 followed by the same amount at the start of Q4.

About OpenZeppelin

OpenZeppelin is a leading blockchain infrastructure security firm that performs security audits and provides developer tools for decentralized systems that power multimillion-dollar economies. OpenZeppelin has set industry standards for building secure, decentralized systems and has gained the trust of industry leaders including Coinbase, the Ethereum Foundation, Matter Labs, and the original Compound protocol. OpenZeppelin built and maintains the world’s leading Open Source library for smart contract development with more than twenty millions downloads and 200 contributors.

OpenZeppelin has already seen success in security partnerships with DAOs including Compound, which forms the backbone of the Venus Protocol codebase. They have already leveraged their existing expertise in lending protocol security to audit the Venus SwapRouter and Oracles codebases for Venus in which they reported 25 total security issues.

Partnership Offerings

Continuous Security Audits on Retainer: As Venus’s trusted security partner, OpenZeppelin will do a continuous security audit of our codebases. Unlike individual audit engagements, their security researchers will be assigned to work on Venus for the duration of this engagement. This provides scheduling flexibility, enhances auditor knowledge of Venus codebase and builds a more collaborative client-auditor relationship to produce better results. In addition to formal auditing, OpenZeppelin will offer Venus protocol security advisory on Web3 best practices to improve secure code development going forward.

For the full details on OpenZeppelin proposal and offer, please see their article on the Venus community forum using the link below.