OpenZeppelin Security Partnership - 2025 Q1 Update

1

2025Q1Summary
2025Q1Summary1920×1080 110 KB

Summary

During Q1 2025, OpenZeppelin delivered 19 reviews in which we identified 86 total issues, including 2 critical and 7 high severity issues. We reviewed 38 governance proposals, audited 15 unique scopes, and enhanced monitoring to cover 4 new markets, 10 new assets, and 3 new networks. Compared to previous quarters, our completed audits this quarter represent a 114% increase over the quarterly average in the last year. Notably, we identified a critical severity issue in the Linea USDC Market deployment which would have exposed 100k USDC of bridged funds after proposal execution to theft and allowed an attacker to seize control of the Compound deployment on the Linea network.

Initiatives

Audits

Completed Audits (In chronological order by publish date)

Advisory

Community Multisig Management - We created transactions to update the membership of the community multisigs on each network to include latest member addresses, performing 14 updates across 5 networks, ensuring these critical security components remain up-to-date and properly maintained.

Monitoring

Our main focus in Q1 has been on internal refactoring of our monitoring systems to improve deployment speed for new markets. We’ve refactored 4 monitors: Governance Proposal Audits, Collateral Assets Monitor, Governance Automation, and L2 Governance Automation. We’ve expanded our monitoring coverage to 25 markets across 9 networks in total. Our governance automation queued 24 proposals and executed 23 proposals.

Our Request to the Community

As always, we’d like to ask the community to read our updates and feel welcome to get involved and provide feedback. We ask for the following:

  1. Keep us informed of any protocol changes we might need to audit in the future and weigh in on our current priorities in the backlog.
  2. Stay subscribed to the Compound Discord Monitoring Feeds.

As usual, feel free to share your feedback below or reach out directly to me on Discord, Telegram, or email:

2 Likes