Request for Proposal (RFP): Oracle Extractable Value (OEV) Solution for Compound Protocol

Request for Proposal (RFP): Oracle Extractable Value (OEV) Solution for Compound Protocol

Authors: Compound Governance Working Group (CGWG)

Motivation

Compound is seeking qualified vendors to submit proposals for Oracle Extractable Value (OEV) solutions that enable the protocol to recapture value lost during oracle-based liquidation events. The selected solution(s) will help Compound DAO reduce value leakage from the protocol to external parties such as block builders and liquidation bots, thereby recapturing revenue currently lost through MEV during oracle-triggered events across various environments (including Ethereum mainnet, Base, Arbitrum, Unichain, Optimism, Polygon, Mantle, Scroll, Ronin, and Linea).

Background

Compound’s design relies on reliable price oracles to assess borrower health and trigger liquidations when loans fall below required collateralization thresholds. When such events occur, the protocol offers a liquidation incentive as a percentage of the repaid loan as compensation to third-party liquidators for retiring the bad debt.

While necessary to ensure solvency, this mechanism introduces an economic inefficiency: the value represented by liquidation bonuses is almost entirely extracted by off-chain actors such as arbitrage bots and block builders, who engage in mempool bidding wars or leverage order flow control to front-run profitable opportunities. This dynamic leads to what is known as OEV, the economic value created immediately after an oracle price update but captured externally, rather than accruing to the protocol or its stakeholders.

Over the past two years, Compound has paid out more than $13M in liquidation incentives across its v3 markets. A large portion of that value has ultimately gone to validators and searchers, representing a persistent leakage of value from the Compound system to external infrastructure providers. The DAO recognizes this as an addressable inefficiency, particularly given that this value is derived from Compound’s design and risk framework but does not flow back to its treasury, lenders/borrows, or COMP holders.

Capturing OEV by introducing coordinated auction mechanisms presents an opportunity to restructure how value is extracted during liquidations. Doing so would reduce systemic leakage, improve protocol-level capital efficiency, and create a new revenue channel that can strengthen reserves or fund future growth initiatives. Several vendor teams (including API3, Chainlink, and RedStone) have begun developing solutions tailored to lending protocols, offering different tradeoffs in terms of latency, decentralization, cross-chain readiness, and revenue share. Dispersed OEV discussions have transpired during community calls and across the Compound forums, but this post is purposed to cohesively aggregate the intent of all of those conversations to establish a single source of information.

The Compound DAO is correspondingly initiating a formal evaluation process to select one or more OEV partners. This Request for Proposal (RFP) aims to solicit responses from qualified providers and guide the DAO in selecting a solution—or set of solutions—that minimizes integration complexity, maximizes recaptured value, and maintains the protocol’s safety, responsiveness, and cross-chain reach across multiple markets.

Timeline & Order of Operations

The duration of this agreement with OEV vendors will last until the end of Q1 2026. The DAO will conduct a retrospective analysis of the program at the start of 2026, inspecting how well the solutions functioned in 2025. A subsequent selection of OEV providers will be put into effect after the evaluation period, or if the DAO decides that the status quo has been sufficient, the structure introduced via this RFP may sustain. The format of this second installment of providers may differ from the one proposed in the current RFP. This program will be revisited in Q1 2026 both to accommodate for innovations on vendors’ OEV solutions as well as to assess the efficacy of the solutions selected for the current year.

The retrospective analysis will assess vendors based on, but not limited to, the following dimensions:

  • Value recaptured by the protocol, net of vendor share.
  • OEV solution’s ability to respond during critical periods—i.e. timeliness and completeness of liquidation execution, particularly during high-volatility or stressed conditions.
  • System uptime, including the percentage of oracle updates and liquidation opportunities that were successfully auctioned and executed without fallback.
  • Frequency and nature of fallback events, such as failed auctions or missed liquidations; vendors must disclose how often their system defaulted to a non-OEV mechanism and why.
  • Transparency of incident reporting and mitigation, with a strong preference for vendors who maintain clear disclosures, postmortems, and support open-source observability tools.

We will coordinate with the selected vendors after conclusion of the on-chain votes to publish a running forum thread, containing periodic uptime and value capture metrics, along with timely incidence reports. A later portion of this RFP asks vendors to detail their reporting capabilities.

RFP Duration May 21 - June 4 (end of day, UTC):

  • All vendors are meant to complete the “Required Responses” section of this RFP in the current forum post.
  • Failure to answer all of the above questions will automatically disqualify your proposal.
  • After a proposal has been submitted by a team, the CGWG will check that all of the required questions have been thoughtfully answered, allowing the proposal to proceed to the OpenZeppelin review.

OpenZeppelin Review:

  • After the 2-week submission period, the OpenZeppelin team will conduct a review of the qualified applicants, providing them and the DAO with an analysis of their assessed risks regarding the adoption of the given solutions.

Snapshot for OEV Solution Selection per Chain:

OEV provider coverage of each network’s markets will be determined by multiple Snapshot votes. Delegates will have the opportunity to vote on which vendors they prefer to utilize on a per-chain basis. As the RFP and subsequent OpenZeppelin review conclude, we will publicize the optimal structure for how the Snapshot votes will be coordinated.

On-chain Vote & Implementation Coordination:

  • The WOOF! team will work hand-in-hand with the favored vendors from the Snapshot vote to operationalize the actual implementation of the OEV solution(s) and the administration of the on-chain votes.

Scope of Proposals

Proposal should cover:

  • Technical design and architecture of the OEV mechanism
  • Integration plan with Compound V3 deployments
  • Economic model and value sharing terms
  • Cross-chain deployment support
  • Security assumptions, audits, and risk mitigations
  • Operational responsibilities and maintenance commitments

Please follow the order of questions provided in the below section under the three overarching categories: technical questions, economic considerations, and security/risk assessment.

For the sake of standardization, please reply to this forum post using the “Required Responses” template:

  • General Overview
    • Background Questions
  • Section 1: Technical Questions
    • 1a)
    • 1b)
    • etc.
  • Section 2: Economic Considerations
    • 2a)
    • etc.
  • Section 3: Security and Risk Assessment
    • 3a)
    • etc.

Required Responses

General Overview

  • Company/Protocol Name and Brief Background:

  • List Existing Associations with Compound Protocol/DAO:

  • Explicitly list ALL of the chains that you are intending on applying for integration on (options include Ethereum mainnet, Base, Arbitrum, Unichain, Optimism, Polygon, Mantle, Scroll, Ronin, and Linea):

Section 1: Technical Questions

1a) Technical Overview:

Please provide a technical overview of the solution specifically as it relates to Compound. This description should cover the entire liquidation process. Please ensure that all components (on- and off-chain) are identified and all value accruals to actors within the system are explained.

1b) Integration & Compatibility:

What exactly is required to integrate your solution into Compound? For instance, do we simply change price feed addresses, or must we deploy new contracts or off-chain services? Please outline the deployment steps on each chain and whether any Compound contract upgrades are needed (maintaining no code changes is preferred).

1c) Fallback and Resilience:

In the event your auction process fails (no bids, infrastructure outage, etc.), what exactly happens? We’d like to know the fallback logic in detail (e.g., “after X seconds, we post the price normally” or “liquidation proceeds with standard bonus”).

1d) Existing Price Feed Compatibility:

Does your OEV mechanism require replacing existing Chainlink price feeds entirely, or can it wrap/interleave with them? In the case of partial integration, how do you ensure seamless fallback to canonical price feeds in the event of malfunction?

1e) Auction Details:

Can you explain how the auction is run and how it is protected from manipulation? What safeguards are in place to ensure fairness, prevent bid manipulation or censorship, and mitigate risks such as coordinator bias, network latency, or timing-based exploitation like last-minute bid sniping? If your system involves a central relay, sequencer, or coordinator, whether on-chain or off-chain, how is it governed? Ultimately, why do you believe your auction design will reliably extract competitive value while minimizing operational and trust-related risks?

1f) Auction Timing & Block Coordination:

  • How does your system determine when to initiate an auction? Is it based on deterministic thresholds, time intervals, or continuous monitoring of off-chain prices?
  • How do you ensure that an oracle update and its corresponding liquidation are confirmed in the same block or atomically? If they land in separate blocks, how is consistency ensured and frontrunning avoided?

1g) Timeliness of Liquidations:

How does your auction mechanism ensure liquidations remain prompt? Specifically, what is the delay between a price crossing a threshold and the liquidation execution in your system? If there is a delay, why is that safe and how do you prevent that from causing any bad debt if prices continue to move?

1h) Latency Optimization Techniques

What techniques do you use to minimize the time between price deviation detection and auction completion? For off-chain systems, how do you mitigate API latency, relay delays, or bottlenecks in solver responsiveness? On chains with faster block times (like Arbitrum, Base), have you benchmarked auction speed and success rate? Please share any performance tuning insights.

1i) Auction Participation & Incentive Design:

How is the auction designed to encourage wide participation by liquidation bots or searchers? What measures have you taken to prevent bidder concentration or cartel behavior? Are there any incentives, like rebates or fee reductions, to onboard new participants and maintain auction competitiveness over time?

1j) Cross-Chain Operations:

How does your solution handle cross-chain deployments? Do you natively support all ten of Compound’s target networks (Ethereum, Arbitrum, Base, Polygon, etc.) right now, or will some require development work? If not live on a chain yet, what’s the tentative timeline? And will performance, like auction speed, differ on different chains (for instance, due to varying block times or absence of Flashbots on some networks)?

1k) Market Support & Asset Readiness:

For the chains that you are opting in for, please specify if your solution is not capable of supporting any of its constituent markets (defined as a borrowable asset and its supported collateral assets) on that given chain. Are there any assets for which you do not yet have reliable price feeds deployed? If so, please provide your expected deployment timeline or inability to accommodate a particular market.

1l) Emergency Controls:

Does your system allow the Compound DAO to disable or pause OEV auctions in the event of unexpected behavior, market stress, or a governance decision? Who has control over those mechanisms today, and how are they governed (via multisig, DAO vote, timelock)?

Section 2: Economic Considerations

2a) Revenue Split and Fees:

What is the proposed revenue share model between your platform and Compound DAO? Please specify:

  • The base revenue split (e.g., 80/20, 90/10)
  • Whether the split is fixed or dynamic across different markets
  • Any creative or performance-based pricing models you can offer to make the proposal more attractive to Compound (e.g., tiered splits based on liquidation volume like 90/10 for <$1M/year, 80/20 for $1M–$5M/year, etc.)

2b) Additional Costs:

Apart from the value share, will Compound need to pay any subscription or service fees to use your oracles? If, for example, Compound adds new markets, will there be any cost to initiate new feeds?

2c) Expected Value Capture:

Based on your observations or deployments so far, what percentage of liquidation bonus do you expect to consistently capture for Compound?

  • For example, Chainlink might cite ~40% from Aave’s data, API3 might cite ~90%+ in smaller markets, etc. Provide any data or simulations to back this up. If possible, give projections for Compound’s case, perhaps using past Compound liquidation data as a benchmark.

2d) Revenue Distribution & DAO Accounting:

How will the captured OEV be paid to Compound DAO? Is it automatically sent to a designated treasury address, or does it require manual claiming? What asset is the revenue in (ETH, stablecoins, native tokens)? How frequently can the DAO expect distributions, and can they be programmatically tracked for treasury accounting?

Section 3: Security and Risk Assessment

3a) Trust Assumptions:

Outline any new trust assumptions that Compound would be taking on by using your solution. For example, who are the actors we need to trust, and what could go wrong? Who operates the oracle nodes that your solution relies on for pricing data? Please specify whether these nodes are operated by your team, third parties, or a decentralized network. If one of your components misbehaved (oracle posting wrong data, coordinator censoring bids, etc.), what are the consequences and mitigations?

3b) Audits:

What audits have been completed on your OEV mechanism (and associated contracts/infrastructure)? Please provide links or summaries of findings. If certain parts are closed-source or proprietary (like some off-chain logic), how can we be assured of their security?

3c) Production Testing and Simulations:

How has your product undergone testing? Has your system been tested in production through major volatility or simply through simulations? Are there any post mortem analyses that you can link to your services being used elsewhere? Transparency is valued, even if minor issues occurred (perhaps a stalled auction that fell back to normal, etc.), describing them and how they were resolved will build trust.

3d) Oracle Accuracy and Manipulation Resistance:

Since these solutions involve the oracle layer, how do you ensure the price being used for liquidations is accurate and not manipulable? For example, could a malicious actor attempt to feed a wrong price to trigger liquidations in your system? Essentially, confirm that the OEV mechanism does not open up a backdoor for price spoofing attacks.

3e) Failure Modes:

Describe worst-case scenarios. For instance, what happens if your auction system completely fails during a period of extreme market volatility? Do liquidations revert to the normal Compound mechanism automatically? Will there be any period where liquidations cannot happen, which could cause bad debt? Each provider should walk through a hypothetical “nightmare scenario” and explain how their design copes with it.

  • For example: “If our coordinator node goes down, the next price update just comes on chain normally within N seconds, so at most N seconds delay.”

We want to be sure that no single failure can adversely affect Compound.

3f) Insurance and Recourse:

Do you offer any insurance or recourse if your system causes a loss to Compound? Are you willing to instate an insurance fund to cover events like an incorrect liquidation? For example, if a bug in your auction allowed an underpayment or prevented a necessary liquidation and Compound incurred bad debt, would your team compensate the DAO? Do you propose setting aside a portion of the overall revenue for insurance? While we hope such situations never occur, knowing your method of potential recourse upfront is important.

3g) Upgrade and Maintenance Security:

If your solution requires upgrading contracts or off-chain systems over time, how are those upgrades governed or managed? We want to avoid a scenario where a silent update on your side introduces a bug that affects Compound. So clarity on how changes are controlled and communicated is key.

3h) Responsible Disclosure:

Do you have a responsible disclosure program in place? Please provide links to any current bug bounties or responsible disclosure guidelines. If no official links are available, please describe how the responsible disclosure process is handled.

3i) Security Incident Monitoring and Management:

What is your current protocol for security incidents? Please provide links to, or describe, the way in which security incidents are handled and communicated to clients. How do you continuously monitor for security incidents?

3j) Developer Support:

Please provide links to your developer documentation and best practices. Do you provide developer support and, if so, what form does this take? Who is the contact person who can answer questions in relation to this proposal?

3k) Real-time Metrics:

Can you provide real-time metrics on liquidations and OEV extracted for the protocol’s benefit? If so, please explain how the data is sourced and the metrics calculated (i.e., how could this be independently verified by DAO members?). How would this be shared with the DAO?

Final Considerations

Is there anything about your approach that you believe we’ve missed asking about? This can include anything that represents a competitive edge, unique design principle, or deeper alignment with Compound’s architecture or mission?

Feel free to post a link to any relevant articles or videos describing your solution—but do answer all of the above questions in the provided setup and sequence on this forum page. Failure to answer all of the above questions will automatically disqualify your proposal. Please keep the final considerations section brief and to the point, if applicable.

8 Likes

RedStone OEV

Hi all, I am Mike Massari, Strategic Advisor at RedStone and leading the OEV stream. Previously, I was Director of Platform and Integrations at Chainlink from 2022 to 2024. Below, please find the RedStone proposal for OEV feeds on Compound. If you have any questions please feel free to reach out.

  • General Overview
    RedStone is the fastest growing Modular Oracle with $10B+ Total Value Secured (TVS) across 70 chains, used by some of the most renowned protocols in the DeFi space such as Spark, Morpho, Pendle, Venus, Compound, Veda, Silo, Sommelier, Gearbox and many others. Apart from delivering blue chip assets price feeds, we specialize in yield-bearing collateral for lending markets, closely cooperating with protocols like Lombard (LBTC), Renzo (ezETH), Ether.fi (weETH), Kelp (rsETH), Puffer (pufETH), Ethena (USDe & sUSDe) and many more. RedStone is live on 70+ chains. A non-exhaustive list of our current Partners can be found here.
  • List Existing Associations with Compound Protocol/DAO:
    RedStone feeds are currently utilized by Compound on Unichain

  • Explicitly list ALL of the chains that you are intending on applying for integration on (options include Ethereum mainnet, Base, Arbitrum, Unichain, Optimism, Polygon, Mantle, Scroll, Ronin, and Linea):
    Unichain, Polygon, Base, Arbitrum, Optimism

Section 1: Technical Questions

1a) Technical Overview:

Components

Fastlane Infrastructure: Fastlane is purely a data source for OEV, RedStone relayers themselves can generate and propagate Atlas transactions that can be sent to any public or private mempool.

Atlas: Atlas is a multicall or ERC-4337-like smart contract framework for customizing auctions that settle on-chain using a try/catch loop of many bidders. Notably, Atlas enables single atomic transactions that contain both a data feed update, and OEV-capturing liquidations. The atomicity of operations within Atlas, and the RedStone relayer itself sending the transaction to the regular mempool, ensures that the individual data feed operations cannot be re-ordered, or delayed by a third party RPC service. If all Atlas liquidations fail, the Atlas smart contracts ensure that the standard feed update is still processed in the same transaction, so Compound can fall back immediately to non‐auction liquidations.

Off-Chain Process

Auction Trigger: RedStone OEV enables “push” data feeds to also respond to liquidator-triggered data feed updates coming from a low latency pull oracle. These OEV-triggered data feed updates occur between deviation thresholds and heartbeats. Each time the price changes off-chain in the RedStone pull oracle, this price is delivered to Fastlane and an OEV auction is hosted.

Auction Operator: A single operator—Fastlane Labs, a long‑term RedStone partner—runs the 200ms off‑chain auction; if Fastlane fails to respond back to RedStone within 300ms from the new off-chain price being pushed, RedStone relayers immediately fall back to sending a standard feed update.

Auction Filtering: Every OEV bidder is split into two tiers; a high-reputation tier, and a low-reputation tier. Any new bidder who joins will be immediately placed into the low-reputation tier. The top 5 bidders from each reputation tier (10 bidders in total) are selected for on-chain auction settlement. These top 10 bidders are then aggregated together and ordered by bid amount regardless of their reputation. This ensures a high bidding but low reputation solver can be ordered first, and has a fair shot at winning the auction.

Transaction-Inclusion: The RedStone relayer itself, not a third‑party builder or liquidator, broadcasts the OEV transaction to any mempool (public or private).

On-Chain Process

Auction Settlement: RedStone OEV auctions are uniquely settled on-chain (i.e the winning bidder is determined on-chain) using the Atlas smart contract framework. Atlas executes multiple liquidator operations on-chain in a try/catch loop immediately and atomically, ordered by their bid amount.

  • If a solver fails to pay its bid within the allocated gas, their actions (liquidation) are reverted and the next solver in line is tried.

    • The gas cost of a solver operation is subtracted from the solver’s escrowed balance regardless of whether they fail or succeed, and is paid to the transaction sender.
    • A successful solver must pay the gas cost of the entire transaction minus the gas costs incurred by any failed solvers.
  • The Atlas contract enforces per-operation gas limits, preventing one malicious liquidator from jeopardizing other liquidators, or the standard data feed update.

  • To be considered eligible for inclusion in the array of Atlas SolverOperations, a solver must only “escrow” funds in advance to cover gas costs. This escrowed balance is used to atomically repay the upfront gas costs of the transaction back to the oracle operator who sent it.

  • If all Atlas liquidation attempts fail, the data feed update will still be processed by Atlas, and available to Compound without delay.

Value Accrual: Value is distributed on-chain atomically at the end of every Atlas transaction to two parties: RedStone, Fastlane. The value flow can be clearly followed on-chain, and the fee splits are configurable parameters on-chain.

1b) Integration & Compatibility:
No changes to the data feed are required, Compound must simply use existing RedStone data feeds.

1c) Fallback and Resilience:
Auctions may begin anytime the off-chain RedStone price changes. If 300ms has passed since the RedStone off-chain price change without any valid auction result response from Fastlane (this encompasses both no bids and infrastructure outage), the price is posted normally by RedStone. Liquidations using the standard bonus can then occur immediately, backrunning the RedStone update. Note that we plan to reduce the fallback time from 300ms to 200ms in the near term, which should help ensure RedStone OEV does not delay liquidations even a single block (even on most L2s).

1d) Existing Price Feed Compatibility:
The RedStone OEV mechanism does not inherently require replacing Chainlink feeds entirely. The Resilient Price Oracle design pioneered by Venus Protocol could allow RedStone to act as the main oracle, providing all of the benefits of RedStone OEV, while allowing Chainlink to function as a fallback oracle in the event that the RedStone price deviates from the Chainlink price by greater than X%. Compound DAO can configure the deviation that must be upheld between RedStone and Chainlink before the price falls back to Chainlink.

1e) Auction Details:

  • Connecting as a bidder is permissionless, you simply start reading from a websocket and utilize the searcher SDK to submit bids.
  • RedStone auctions are uniquely settled on-chain. This provides transparency into the top X (~10) bidders in the auction, and will make it easy for the public to identify censorship or mis-behaviour from Fastlane as the auctioneer. In addition, Fastlane has operated MEV auctions for the majority of the top validators on Polygon PoS including Coinbase, Binance, Figment, and over 70% of Polygon PoS stake for years, maintaining a stellar reputation.
  • Time-based exploitation and last-minute bid sniping is not possible as it is a sealed-bid auction.

Settling the auction on-chain has the fewest trust-assumptions, risks, and points of failure. This is the only way to achieve sufficient guarantees of value capture in highly adversarial environments, and to lower the latency of data feeds and liquidations.

  • Ensures operation ordering (i.e OEV liquidations directly preceding oracle updates) is respected without trusting anyone, even the validator. This removes the requirement for on-chain time-based fallbacks as implemented by SVR and API3, instead the data feed can always return the most recent price. This is a core principle that is required to lower the latency of liquidations.

  • Ensures that without trusting any off-chain simulation, prediction, or escrow, the auctioneer can find the truly highest paying bidder in a trustless way on-chain. This is a core principle that is required to operate permissionless OEV auctions without requiring liquidator bid escrow. As described above, any bidder can immediately connect to the auction and will have a fair chance at being included in the 5 low-reputation slots.

  • Ensures there is no uptime reliance on centralized third party mempool services, and no ability to delay the data feeds or liquidations outside of Fastlane itself.

This results in RedStone OEV having the easiest to understand risk-profile—it’s simply the SLA between RedStone and Fastlane—and the best “worst-case” scenario thanks to our 300ms low-latency auction window and instant fallback to a vanilla price push..These properties make RedStone OEV the most resilient auction to adversarial behaviour; the single most important property for time-sensitive operations such as liquidations.

1f) Auction Timing & Block Coordination:

  • Auctions are constantly being run every time the off-chain price deviates by any amount. This happens every 300ms-2s on average.
  • The oracle update and the liquidation are “operations” within a single Atlas transaction. There is no possibility of re-ordering within the block, or landing in separate blocks.

1g) Timeliness of Liquidations:
The mechanism is designed such that liquidations can only occur faster than they otherwise would have, by allowing them to be triggered at any time by a low-latency pull oracle, rather than after a deviation threshold. The auction delay can be handled such that it never causes an oracle update to be delayed by a single block, even on chains with block times > 400ms, again we expect to lower this to 250ms to encompass L2s.

1h) Latency Optimization Techniques
Fastlane utilizes infrastructure and reputation mechanisms developed from years of running MEV auctions to ensure high value-capture and low latency. RedStone price relayers are co-located with the auction infrastructure to minimize latency. Solvers can also co-locate with the auction service.

1i) Auction Participation & Incentive Design:
On-chain auction settlement ensures that the auction can remain permissionless on any EVM chain regardless of the market microstructure to transaction inclusion (ETH mainnet vs. L2). Fastlane and RedStone will never compromise on permissionless participation for liquidators.

The auction has very minimal barriers to entry, only escrowing enough funds for a single transaction’s gas costs. By allowing participation without significant escrow, bidder participation should be very diverse, and dominant players cannot compound their gains into structural advantages.

After adoption of RedStone OEV, the process of executing Compound liquidations will become identical across chains. By abstracting chain-specific nuances to liquidations, such as bidding to block builders on ETH mainnet vs bidding via complex spam tactics on OP stack, this should help unite a fractured Compound searcher network across many chains into a single unified network.

1j) Cross-Chain Operations:
RedStone OEV can support any EVM chain in a maximum of a 2 week timeframe. The mechanism, performance specs, and risks of the OEV service will remain the exact same across chains. This enables Compound to quickly scale OEV across a wide array of chains without governance overhead each time.

1k) Market Support & Asset Readiness:
RedStone OEV can currently support every market on the proposed chains.

1l) Emergency Controls:
RedStone OEV uniquely enables Compound to turn OEV on/off without changing the data feed contract that the Compound protocol utilizes. RedStone is in control of turning off the OEV mechanism, and the ability to trigger RedStone to do this can be implemented in any way deemed best. At any time, a risk management service provider or risk council can alert RedStone, and OEV can be turned off immediately, leaving Compound protocol in a default state without any delays to data feeds. Compound could implement an on-chain kill-switch, similar to the one being proposed related to LST failures, to do this.

Section 2: Economic Considerations

2a) Revenue Split and Fees:
– 60 % → Compound treasury
– 20 % → RedStone
– 20 % → RedStone (in the form of delegated COMP)

Split is fixed on every market

2b) Additional Costs:
There are no additional costs.

2c) Expected Value Capture:
As RedStone OEV has not had a deployment with outside liquidators, we cannot make claims based on previous deployments. In Fastlane’s experience operating MEV auctions for multiple years, and viewing public MEV-Boost data for Compound and other similar protocols, we expect re-capture rates of ~90%.

2d) Revenue Distribution & DAO Accounting:
Currently, the revenue is captured by RedStone and then split as per the above breakdown. Value can be sent on a weekly basis to a Compound treasury address.

The revenue is currently in native tokens, although the auction can specify any asset to be used (i.e USDC or COMP). The proceeds can be easily tracked and the movement is fully transparent on-chain.

Section 3: Security and Risk Assessment

3a) Trust Assumptions:
The sole new trust assumption Compound would take on is that Fastlane upholds its SLA with RedStone regarding uptime, and fairly operating the auctioneer role. Fastlane can in no way manipulate the data. If Fastlane suffers downtime, the worst that could happen is that Compound will not capture OEV, and liquidations may at worst be delayed by 300ms. If Fastlane unfairly hosts the auction, again the worst that could happen is Compound will not capture OEV, but liquidations will occur without delay. There are clear and strong consequences for Fastlane mis-behaviour in terms of reputation, as this could cause a loss of all existing Fastlane business including operation of auction for ~70% of Polygon PoS stake, and future Fastlane endeavours in MEV auctions for Monad validators, and other Atlas customers. Operating MEV auctions is Fastlanes core business, and mis-behaviour effectively would cause the company to lose all value.
RedStone oracles nodes are operated by third-parties in a decentralized fashion.

3b) Audits:
A comprehensive audit of the v1.5 Atlas smart contract framework was completed by Certora, with another audit completed by Spearbit for some recent changes in v1.6 atlas/audits/Atlas v1.5 - Certora.pdf at main · FastLane-Labs/atlas · GitHub, atlas/audits/Atlas v1.6 - Spearbit.pdf at main · FastLane-Labs/atlas · GitHub. The off-chain architecture is closed source, but as we stated earlier, the auction settles on-chain in a transparent fashion that would allow any party to audit the auction behaviour very thoroughly.

3c) Production Testing and Simulations:
A RedStone OEV alpha trial phase was conducted on the BNB and BTC data feeds of the Venus Protocol on the BNB chain from November 2, 2024 until December 5, 2024. This alpha trial notably did not include any outside liquidator bots. Liquidator bots were only operated by the RedStone and Fastlane teams during this period, so OEV re-capture rates will not reflect the re-capture that can be expected in future iterations. That being said, this alpha trial did serve as a way to stress test the Atlas system and its ability to consistently land OEV-capturing liquidations.

KPIs

Total Volume Liquidated by RedStone OEV: $157,887.14

Total OEV Captured by RedStone OEV (BNB) = 6.44

Total OEV Bid Amount: $4,325.90 (Calculated using BNB prices where applicable: $672.98, $632.15, and $717.26)

Total OEV Available: $8,649.66

Volume Missed by RedStone OEV: 65909.71

Post-Mortem of Missed Volume

No issues to the core RedStone OEV processes were detected in the trial period. The reasons for missed liquidation volume fall into two categories:

  1. BNB chain node issues that caused faulty simulations in the Fastlane Auctioneer and RedStone Relayer.
  2. Downtime or bugs in the Fastlane liquidator implementation.

Since auctions settle on-chain, simulations are not necessary and are strictly a nice-to-have. Dependencies on simulations can be removed for RedStone OEV, and liquidator bot issues will be corrected by on-boarding permissionless liquidators. Outside of these issues, no delays were caused in any liquidations during this period by the core Atlas architecture.

The fallback method functioned properly in all cases, fallback standard data feed updates were sent on-chain by the RedStone relayer after 500ms without a valid auction response from Fastlane (reduced to 300ms now). The following will explain the reasons why fallback updates occurred when in fact there was OEV available (missed OEV volume).

3d) Oracle Accuracy and Manipulation Resistance:
RedStone OEV uses the exact same feed architecture that already secures ~10bn of TVS, and that has a track record of working for the past 3 years without any incident.

3e) Failure Modes:
Liquidations cannot be delayed by RedStone OEV past 300ms in the absolute worst-case. If Fastlane infrastructure is offline or malfunctioning, RedStone relayer will deliver the price in the regular fashion after at most 300ms. This being said, at any time if issues prevent themselves, RedStone OEV uniquely can be turned off immediately by a kill-switch triggered by RedStone themselves, Gauntlet, or others.

3f) Insurance and Recourse:
For the Pilot, we won’t include an insurance buffer in order to move quickly and validate performance. For a full rollout on major Compound markets, we’re happy to set aside an insurance fund—drawn from a percentage of OEV revenue—to cover any protocol losses (e.g. under-payment bugs or wrongful liquidations) resulting from system errors or bugs

3g) Upgrade and Maintenance Security:
The Atlas related contracts are public and immutable. Fastlane would be happy to agree to alert Compound to any changes made to the off-chain architecture.

3h) Responsible Disclosure:
Responsible disclosures are currently handled through the publicly advertised Discord, X, and email channels for RedStone. RedStone and Fastlane are currently developing a bug bounty program.

3i) Security Incident Monitoring and Management:
24/7 monitoring is in place, and security incidents are reported to a shared channel with clients. This is implemented by a pager-duty system with engineers constantly on call, and being alerted to a number of potential issues or events within the system.

3j) Developer Support:
There are no code changes required to integrate the solution. RedStone documentation could be found here — Introduction | RedStone Documentation

3k) Real-time Metrics:
Real-time metrics on % of value captured relative to value available, and % of volume liquidated relative to volume available will be provided in a Dune dashboard that can be independently verified by DAO members. In addition to this, Fastlane can provide an open source script to the DAO that will present more detailed analysis of gas pricing, gas usage, auction competitiveness, and inclusion time.

Final Considerations

RedStone provides the only OEV service that actually makes the core Compound product better by enabling faster liquidations than the status-quo, with extremely minimal potential for delays. In comparison, other OEV solutions can at best execute liquidations at the same speed as the status-quo—and at worst suffer multi-block or multi-second delays.

As was stated in this article from Gauntlet on DeFi liquidations: in an environment where money markets compete aggressively in capital efficiency, the protocol with the fastest and most robust liquidation engine will face the least bad debt over the medium term, and provide the most value to users. By allowing faster liquidations without trade-offs, RedStone OEV can enable Compound to offer less conservative risk parameters—critical, as this analysis shows, to competing head-to-head with Aave. This presents Compound with an opportunity to adopt a superior OEV compared to SVR, and to gain a competitive advantage over Aave.

Finally, our vision is that to win monolithic lending it will require close relationships and alignment between the DAO’s service providers—especially the oracle. RedStone and Fastlane have driven real innovation in this space, and we’re already collaborating with WOOF! and Platonia on future advances like partial liquidations, and dynamic liquidation-penalty feeds. We believe these tools will unlock new composability and capital-efficiency gains for Compound v4 and beyond, and look forward to partnering tightly with your developers and mechanism designers to iterate faster and outcompete Aave.

5 Likes

Gm everyone

We want to formally thank the CGWG (Abdullah :crown:) for taking ownership of the OEV discussion and creating a clear path forward for Compound to start recapturing this value. We know it takes real effort to coordinate all the moving parts here and it’s great to actually see that work paying off.

Below is our proposal in response to the RFP. If you’re a delegate, the executive summary probably covers what you need. But if you’re curious about how this works under the hood and why it actually captures value, feel free to dig into the full thing:

Beyond Data Feeds

If anything’s unclear or you want to chat, just reach out on the forum, twitter, or telegram

cheers

6 Likes

Compound x Chainlink SVR Integration Proposal

Hi everyone, Ash here. The following post is our proposal for Compound Finance to integrate Smart Value Recapture (SVR) to recapture oracle-related liquidation MEV for the Compound protocol. We’ll start by providing context on Compound’s historical usage of Data Feeds and the implications involved in choosing an OEV solution, before diving into the full proposal.

It’s important to note that this RFP process isn’t just about which OEV recapture solution the Compound protocol should integrate, but also which price oracle provider Compound deployments should use, as the two are intrinsically tied together (i.e., using an oracle provider for OEV recapture also means using the same oracle provider for market pricing data).

While recapturing OEV presents a real and tangible revenue opportunity for the Compound community, modifying the core price oracle system used by Compound markets has serious security implications that could increase the risk of bad debt and insolvent markets. This could result in a loss of user funds (which currently sits $3B+ in user deposits) if not considered carefully. Thus, it’s important to analyze this situation from a holistic perspective, given the combined security implications of choosing both a price oracle provider and an OEV recapture provider.

Background

Compound originally upgraded its price oracle mechanism to Chainlink Data Feeds back in June 2021, starting with the Compound V2 market on Ethereum before extending it to Compound V3 as part of its Ethereum launch in August 2022. The Compound community adopted Data Feeds after $89M in user positions were incorrectly liquidated due to the Coinbase Oracle (Compound’s former oracle provider) misreporting the price of DAI, leading to value being siphoned from users.

Chainlink Data Feeds have since become the default price oracle solution for Compound market deployments across chains, and continues to secure the primary and largest V2 and V3 markets on Ethereum, accounting for the vast majority of the protocol’s TVL. Since this upgrade four years ago, there have been zero oracle-related exploits or loss of user funds across Compound markets, with Data Feeds securing $12B in Compound TVL at its peak.

Throughout our long-standing collaboration, we’ve always taken a security-first approach to ensure Compound markets have accurate market data via Chainlink’s Decentralized Oracle Networks (DONs). DONs leverage multiple layers of decentralized data aggregation, including the use of multiple independent oracle node operators, who fetch and aggregate data from multiple professional data aggregation firms via premium data API subscriptions to create accurate, tamper-proof oracle reports that are reliably published onchain, even during the most extreme market volatility and blockchain network congestion conditions (e.g., FTX collapse, major airdrops & NFT mint events).

It’s important to re-emphasize that integrating a particular OEV recapture solution is inextricably linked to the oracle solution it uses for market data. It’s critical for protocols to not compromise on security by integrating an OEV solution linked to an unproven price oracle, as the risks to the protocol greatly outweigh the potential of additional revenue recapture.

As the most widely adopted oracle in DeFi, with 67%+ market share as measured by Total Value Secured (TVS), we cannot afford to put DeFi at risk by taking shortcuts when creating and improving critical services. When developing Chainlink SVR—the OEV recapture solution native to Data Feeds, which runs on the same proven DON infrastructure—we took a systematic approach to ensuring security and reliability after researching MEV mitigation solutions for a number of years, including Fair Sequencing Services (FSS) and Protected Order Flow (PROF).

Rather than rush a product to market, we engaged in multiple cycles of R&D and collaborated with industry-leading organisations such as BGD Labs and other key participants of the Aave DAO to arrive at an initial design that maximizes security, reliability, and long-term economic viability using Flashbots infrastructure. SVR is now the largest OEV recapture solution on the market and used in production on the Aave V3 Ethereum deployment, securing $9B+ of TVL on Ethereum without meaningfully changing the protocol’s risk profile.

Since SVR launched in production earlier this year, the average OEV recapture rate has increased 2x (~25% to ~50%) while the total value secured grew 20x (~$400M to ~$9B+). SVR markets have processed over 200 liquidations in 2 months that paid out ±$310K in liquidation bonuses. In parallel, the number of independent searchers on SVR has continued to increase, helping increase SVR’s decentralization and supporting a healthy, competitive searcher market. In working closely with the Chainlink user base, we have gained valuable experience and in-production data that we used to inform our proposal to the Compound community.

The implementation of SVR on Compound can progress swiftly according to the following estimated timeline:

  • RFP finalization - Mid to end of June: Finalization of the RFP, including DAO feedback. Final vote and decision by the DAO to move to implementation phase
  • Preparation & Setup - End of June to beginning July: Discussions with Compound DAO members and key stakeholders. Deployment and testing of SVR-specific contracts with WOOF software; Security review with Gauntlet, Openzeppelin, and Platonia.
  • Governance Approval & Integration - Mid to end of July: Compound DAO governance proposal and vote to update price feed addresses to SVR feed addresses; Comprehensive testing and monitoring of SVR feeds.
  • Go-Live & Monitoring - End of July: Continuous monitoring of performance; Weekly reports published on Compound forum.
  • Further product expansion - Post end of July: Expansion of SVR across more chains as aligned with the DAO

Below, we describe SVR in more detail using the requested RFP structure.

General Overview

Company/Protocol Name and Brief Background:

  • Chainlink is the most widely adopted oracle platform across both DeFi and TradFi, providing protocols and organizations secure access to on-chain data delivery, cross-chain interoperability, offchain computation, and legacy system connectivity. Major financial market infrastructure and institutions such as Swift, DTCC, J.P. Morgan, UBS, SBI, Fidelity International, and ANZ Bank, as well as top DeFi protocols including Aave, Compound, Kamino, Jupiter, Morpho, Fluid, and hundreds more work with and use this standard to power advanced blockchain applications and transactions. Chainlink has enabled $21T in transaction value, secured over $75B in DeFi TVL at its peak, and has captured 67%+ market share in DeFi for oracle infrastructure, while operating the largest OEV recapture solution in production by value secured.

List Existing Associations with Compound Protocol/DAO:

  • The Compound protocol uses Chainlink Data Feeds to access financial market data, which is used to help ensure protocol solvency. This includes for its largest market deployments of Compound V2 and V3 on Ethereum, which secure billions in user deposits, as well as markets on Base, Arbitrum, Optimism, Polygon, Ronin, Scroll, and Linea. We have supported the Compound community over the years through custom oracle solutions and improvements, including the UAV and UAV V2.

Explicitly list ALL of the chains that you are intending on applying for integration on (options include Ethereum mainnet, Base, Arbitrum, Unichain, Optimism, Polygon, Mantle, Scroll, Ronin, and Linea):

  • We will integrate SVR on Compound on every chain except Unichain. In order to ensure a well coordinated and safe implementation, we will roll this out gradually.

Section 1: Technical Questions

1a) Technical Overview:

Smart Value Recapture (SVR) is an extension of Chainlink Data Feeds that enables DeFi protocols to recapture non-toxic, oracle-related MEV (e.g., liquidation MEV). The initial version of SVR was built in collaboration with BGD Labs, Flashbots, and other contributors to the Aave DAO. SVR is modular and future-proof in its ability to leverage multiple Order Flow Auction (OFA) providers, starting with support for Flashbot’s MEV-Share, but can expand to additional established providers over time.

By using established OFA providers, SVR is able to support an open, decentralized searcher ecosystem. This helps ensure competitive bidding and market-driven recapture rates as opposed to closed or single-searcher models, which can artificially inflate recapture rates and introduce single points of failure. Notably, SVR’s open approach is aligned with Compound’s existing ethos of having a permissionless, decentralized liquidation process, where any account address can liquidate eligible positions. The same searchers who facilitate liquidations on the Compound protocol today can permissionlessly integrate with SVR to continue supporting the protocol’s solvency.

Price Update & Liquidation Process:

  • SVR feeds produce price oracle reports in exactly the same way that reports are generated today for standard Data Feeds. This means a decentralized committee of independent oracle node operators fetch and aggregate data from multiple premium data providers to produce a cryptographically signed aggregated oracle report that is verified onchain. The difference with SVR is how onchain data transmission takes place.

  • An oracle report update for SVR feeds is transmitted onchain via an OFA (e.g., Flashbots MEV-Share), where the right to bundle a liquidation transaction with the oracle report update is auctioned to searchers in a permissionless manner. In parallel, the same oracle report for standard Data Feeds is transmitted onchain via the public mempool, which serves as a fallback to mitigate potential risk scenarios via the DualAggregator contract. Users of the standard Data Feed are completely unaffected by anything SVR-related, as it is opt-in to allow for phased SVR adoption.

The flow in the figure below is as follows:

  1. The Chainlink Data DON produces a price oracle report exactly as today (i.e., by a heartbeat and/or deviation threshold). However, the price report is transmitted twice, from different accounts.
    1.1 One price report is transmitted to the standard Data Feed via the public mempool (the same as today).
    1.2 Another price report is transmitted to an SVR Price Feed contract through a Flashbots Protect RPC endpoint.

  2. MEV-Share is an open-source protocol that selectively shares data about transactions (e.g., price oracle updates) with searchers, who then bid to include the transactions in bundles. The bundles are shared with builders, who then select the highest searcher bid and include the relevant backrun and liquidation transactions in a block. If no bid is placed, then the price oracle report is published onchain without any backrunning liquidation transaction.
    2.1 When the price report and the backrunning liquidation transactions are published onchain, then:
    2.1.1 The price report updates the SVR Price Feed.
    2.1.2. The backrunning transaction uses the price update to liquidate the relevant positions.
    2.1.3 Value is recaptured by Compound and Chainlink.

  3. In the described example, the SVR feed returns an updated price. However, if no fresh price is available (e.g., if MEV-Share fails), the feed contract connected to Compound has a fail-safe mechanism that returns a price from the standard Data Feed at an adjustable delay.

Onchain Components:

  • DualAggregator: An onchain aggregator contract that stores both SVR Price Feed updates and standard feed updates. This contract provides users the right price depending on if they come through the normal FeedProxy or the OEVFeedProxy.
  • OEVFeedProxy: A proxy contract that points to the SVR DualAggregator, which has the same interface that Compound already uses.

Offchain Components:

  • Decentralized oracle network (DON): A distributed collection of independent Chainlink oracle node operators responsible for fetching and aggregating data, coming to consensus, producing cryptographically signed oracle reports, and delivering oracle reports to an intended destination (onchain or offchain).
  • Flashbot MEV-Share: MEV-Share is an open-source protocol for users, wallets, and applications to internalize the MEV that their transactions create (i.e., orderflow auction). It allows users to selectively share data about their transactions with searchers, who then bid to include the transactions in bundles. Users can choose how the searcher’s bid is redistributed—between themselves, validators, or other parties.

Value Accrual:

  • Recaptured OEV is distributed between Compound and Chainlink based upon a pre-agreed upon fee split. Compound’s portion of recaptured OEV fees will be automatically sent to the Compound DAO treasury address. Distribution will occur in the asset received from the auction (typically the native gas token). Distributions can be made on a frequent basis. Since distributions take the form of onchain transactions, payments can be programmability tracked.

1b) Integration & Compatibility:

Integrating Smart Value Recapture (SVR) into Compound V3 is straightforward, leveraging Compound’s existing infrastructure and longtime compatibility with Chainlink Data Feeds. The upgrade is as simple as updating the current Data Feed address to point to a new SVR-enabled Price Feed address for each desired market. This process utilizes Compound’s established governance, requiring no changes to Compound’s core smart contract code or the deployment of new Comet instances for your existing markets.

Chainlink Labs will deploy the necessary SVR-specific contracts (like the DualAggregator and OEVFeedProxy) on each requested chain. Compound’s main action is the governance-approved configuration update to switch to these new SVR feed addresses. This maintains the DAO’s preference for minimal integration complexity and no disruptive contract upgrades, offering a seamless path to recapturing OEV by effectively just redirecting to an enhanced version of the Chainlink feeds already trusted and used for years.

1c) Fallback and Resilience:

In the case of a transmission failure by the SVR-enabled Price Feed (i.e., MEV-Share failure), there is a fail-safe mechanism to ensure that the feed can still report a price to the DeFi protocol. When the SVR-enabled Price Feed is determined to be stale by a defined time period (e.g., 6 blocks on Ethereum), it will return the latest price report from the standard Data Feed before the cutoff point. This delay is necessary to avoid liquidators extracting value by bypassing the value recapture mechanism provided by SVR.

1d) Existing Price Feed Compatibility:

SVR serves as an official extension of Chainlink Data Feeds and does not require “wrapping” or replacing existing infrastructure; instead, only pointing to a SVR-activated feed address. SVR uses the same oracle reports produced by DONs for standard Chainlink Data Feeds in the DualAggregator, but uses a different onchain transmission path (e.g., Flashbot MEV-Share). The fallback to standard Chainlink Data Feeds is handled within the DualAggregator contract.

1e) Auction Details:

Our approach prioritizes decentralization, security, and efficiency by integrating with existing, well-established Order Flow Auction (OFA) providers. Initially, this includes support for Flashbots’ MEV-Share, which has a proven track record having processed more than 26 million of MEV transactions, demonstrating its robustness and wide adoption.

How the Auction is Run:

  1. Submission: Chainlink DON submits the SVR-dedicated price report to OFA providers, such as Flashbots’ MEV-Share. (A standard, non-SVR price report is also sent to the public mempool for the fallback mechanism).
  2. Report Disclosure: The OFA providers stream the SVR report data to its network of searchers. For example, see Flashbots’ Event Stream. Importantly, the report shared with searchers does not include its signature, preventing searchers from taking the report and using it outside the OFA.
  3. Bidding & Bundling: If an opportunity exists, searchers submit “bundles” back to the OFA. These bundles consist of the SVR price report, along with their own backrun tx designed to capture this value and place a “bid”.
  4. Forwarding: The OFA forwards these competing bundles to its network of subscribed builders. These bundles come with the condition that a designated portion of the captured value is refunded to a pre-designated address (benefiting Compound and Chainlink).
  5. Builder Auction: Builders then determine the most profitable valid bundle and include it in the next block they propose.

*The Auction process may differ on other chains, which will be adapted accordingly.

Searcher Bidding Dynamics:

  • Permissionless Access: OFAs like Flashbots offer permissionless access to searchers. This fosters a large, diverse, and highly competitive market, significantly reducing risks of collusion or monopoly.
  • Private System: With OFAs directly integrated with builders, searchers’ bundles are protected from the risk of “front-running” or “sandwiching attacks”. This is particularly important because most liquidation transactions include a number of swaps in order to be able to liquidate the under-collaterized loan or repay the flash loan.
  • Programmable Privacy & Composability: MEV-Share allows for controlled information sharing, which can enable sophisticated strategies where searchers choose to share some information with other searchers to allow them to backrun their bundle. This leads to more efficient MEV capture and higher overall refunds.
  • Builder Auction Dynamics: Since builders receive many competing bundles for the same opportunity and profit only when landing the most profitable valid bid onchain, each builder has a strong economic incentive to include the highest-paying valid bundle before any other builder. This makes it difficult for even a set of builders to censor high bids or manipulate the outcome.

Mitigating Risks:

  • “Builders” as the Auctioneer: By having builders be the auctioneer on the searchers’ bundles, SVR requires no onchain auction execution. This increases revenue for all participants by decreasing gas and operational costs.
  • Coordinator Bias: We deliberately avoid any centralized Chainlink coordinator. The DON submits the SVR price report directly to Flashbots. While trust is a factor with Flashbots (as with any relay), their reputation of operating as a research organization focused on neutrality minimizes a single point of bias. Furthermore, Flashbots’ wide integration (over 20 builders covering 90%+ of blocks) and the fact that builders run the auction on the received bundles ensures decentralization of the auction process.
  • Network Latency: By integrating Flashbots, we leverage their existing, low-latency network for connecting searchers and builders.

1f) Auction Timing & Block Coordination:

New price oracle reports are generated based on both a deviation threshold (percentage difference of the offchain price since last onchain update; e.g., 0.5%) and a heartbeat value (time elapsed since last onchain update; e.g., 10 minutes). When a new price report is generated, the SVR copy is sent to MEV-Share. MEV-Share holds an offchain auction every block, where searchers determine if there is a profit opportunity associated with the update. MEV-Share infrastructure allows SVR to specify that only backruns are allowed, and then bundles the transactions for inclusion by a builder. MEV-Share does not allow front-running transactions.

1g) Timeliness of Liquidations:

Auctions on MEV-Share occur every block, after which the bundle is immediately sent to builders. We measure inclusion delay as the difference in blocks between the SVR and non-SVR price report landing on the chain. Our in-production implementation on Ethereum shows that there is no block inclusion delay, or even a 1 block speed up on SVR compared to normal price report inclusion (in 7.5% of cases the price report is delayed by 2 or more blocks). Since the integration of SVR, there has been no bad debt accrual to the protocol.

The delay allows for the offchain process to accrue and collect bids from searchers before bundles of oracle updates and liquidations are published onchain. Further analysis has been published by the Chainlink Labs economics team here. The results suggest that, with no or minor calibration from integrating protocols, lending protocols can benefit from integrating SVR while still preserving their current risk profile.


Source: LlamaRisk SVR Dashboard

1h) Latency Optimization Techniques

As explored in previous questions, latency optimization is achieved through leveraging performant, low-latency OFAs (e.g., MEV-Share) and optimized Chainlink DON reporting. As soon as a Chainlink DON generates a new oracle report, it is sent to the OFA (e.g., Flashbots MEV-Share). Highly performant searchers can generally provide bids on the order of 200ms to a few seconds. The MEV-Share auction closes 3 seconds before a new block is generated, after which the winning bid is bundled and forwarded to builders. On faster chains (Arbitrum, Base), the auction will run for a few seconds to maximize searcher participation before closing the auction.

1i) Auction Participation & Incentive Design:

Chainlink SVR is able to facilitate wide participation by searchers by leveraging open OFAs with existing searcher bases (e.g., MEV-Share). The open, competitive nature of established OFAs naturally mitigate concentration risks through a permissionless bidding process. The primary incentive for searchers is the OEV opportunity itself and guaranteed bundled execution. No additional Chainlink-provided rebates are currently being provided. In the pilot period, we’ve seen 8 unique searchers win bids, and confirmed with 6 more that they are onboarded and actively searching for opportunities.

1j) Cross-Chain Operations:

Each chain has a unique OEV landscape due to factors such as DEX liquidity, active searchers on the chain, and mechanics around providing ordering guarantees. SVR maximizes ordering guarantees and recapture rates on each chain by operating natively and keeping the auction mechanics modular. SVR can operate natively on each chain that Chainlink Data Feeds operate on. Currently, SVR is live in production on Ethereum mainnet, providing OEV recapture for the Aave protocol. Support for Base is planned within the next few weeks, while Polygon, and Arbitrum are also high priority for integration and expected within the next few months. Optimism, Mantle, Scroll and Linea are expected to follow shortly after.

1k) Market Support & Asset Readiness:

Chainlink provides Data Feeds for all assets on all chains we are proposing SVR to be integrated. Once SVR is deployed on a chain, the process to deploy an SVR feed takes the same amount of time as a normal Chainlink Data Feed.

1l) Emergency Controls:

SVR has a built in fallback mechanism that brings the SVR feed in line with the normal feed fed through the public mempool after a predefined amount of seconds. This helps ensure that even in the worst case scenario the SVR feed will trail the normal one by a set amount of seconds.

Separately, Chainlink Labs can collaborate with the Compound DAO to create a guardian contract that can swap from the SVR proxy to the normal proxy instantly based on e.g. a multisig transaction by the governance guardian.

to be continued in next post


3 Likes

continued from previous post.

Section 2: Economic Considerations

2a) Revenue Split and Fees:

This proposal offers a split of 55% of net recapture OEV (after builder payments by searchers) to the Compound DAO and 45% to the Chainlink Network. This is proposed to be a fixed split across markets. The fee split presents a new revenue opportunity for the Compound DAO while supporting the economic sustainability of the Chainlink oracle infrastructure that powers Compound and the wider DeFi ecosystem.

2b) Additional Costs:

No additional subscription or service fees are required for integrating SVR.

2c) Expected Value Capture:

Based on data generated from Aave’s ongoing usage of SVR for recapturing liquidation MEV in select markets on the Aave V3 Core and Prime on Ethereum mainnet, we project SVR can enable Compound to consistently capture ~40-50% of the total liquidation bonus OEV that is currently leaked (total recaptured OEV, before the 55/45 split). By using established OFA providers, SVR is able to support an open, decentralized searcher ecosystem that helps ensure competitive bidding and market-driven recapture rates, as opposed to closed or single-searcher models that can artificially inflate recapture rates and introduce single points of failure. We will continue to onboard additional searchers to SVR, which can help increase recapture rates.

Applying these recapture projections to past Compound liquidations projects a sizable opportunity for Compound. Using onchain data paired with historical pricing data from Chainlink feeds, we estimate that Compound V3 on Ethereum has generated ~$7.0M in OEV since December 2022. Pace has increased in recent months: ~$6.2M (or ~89%) of OEV has been generated since the start of 2024, equivalent to an annualized rate of ~$4.3M in OEV / year.

Integrating SVR could unlock an estimated ~$1.0 - $1.2M annual revenue opportunity for Compound DAO, based on the following assumptions:

  • Compound V3 on Ethereum generates ~$4.3M in OEV / year (average from January 2024 - May 2025)
  • 40-50% of OEV is recaptured by SVR
  • Compound DAO receives 55% of captured OEV as revenue

This revenue estimate is provided for Compound V3 on Ethereum based on historical TVL and OEV rates, which could fluctuate in the future. Expanding the use of SVR to multiple chains would grow the OEV recapture opportunity accordingly. It should be noted that OEV is highly volatile and difficult to predict. Past revenue over a set duration (monthly, annual) may not accurately predict future revenue.

2d) Revenue Distribution & DAO Accounting:

Compound’s portion of recaptured OEV fees will be automatically sent to the Compound DAO treasury address. Distribution will occur in the asset received from the auction (on Ethereum mainnet that is ETH). Distributions are made on a weekly basis. Since distributions take the form of onchain transactions, payments can be transparently tracked. We will publish a weekly update on the Compound forum on SVR’s performance, and in parallel work on a near real-time dashboard. Additionally, third-party service providers can provide data analytic dashboards, such as those that have been built for within the Aave community: https://svr.llamarisk.com/.

Section 3: Security and Risk Assessment

3a) Trust Assumptions:

Given Compound already uses Chainlink Data Feeds to secure the vast majority of the protocol’s TVL on its largest markets (e.g., Compound V2 and V3 on Ethereum), and the fact that SVR is a native extension to the existing Data Feeds, little-to-no additional trust assumptions would be introduced to the Compound Protocol. SVR leverages the existing trust placed in Data Feeds and the decentralized oracle networks that power those feeds. Trust in the OFA infrastructure (e.g., Flashbots MEV-Share) is minimized through the automatic fallback mechanism to standard Data Feeds, while also providing the option for Compound to revert back to standard Data Feeds manually (e.g., via DAO vote or admin action) at any time.

The same independent node operators that secure standard Data Feedsare used for SVR feeds, as the same oracle reports are used for both (i.e., the same oracle report is sent to standard Data Feedsand SVR feeds simultaneously via the DualAggregator contract). These node operators can be viewed on a per-feed & per-chain basis on the following analytics site: Decentralized Data Feeds | Chainlink.

The oracle node operators used in the DONs powering Data Feedsand SVR feeds include traditional Web2 telecommunication providers, leading data providers, and Web3 infrastructure providers, such as Deutsche Telekom T-Systems, Swisscom, Vodafone, and Infura. The same security that applies to the existing Data Feeds used by Compound also applies to SVR feeds. In situations where the OFA fails to operate as expected, SVR’s recapture efficiency would decrease or Compound would fall back to using standard Data Feeds; meaning protocol solvency would not be at risk.

3b) Audits:

NCC Group conducted an audit of Chainlink SVR in November 2024, focusing on the changes introduced between the original OCR2Aggregator.sol and the updated DualAggregator.sol at commit ee7f7ad. The review identified a total of three findings: two low-risk and one informational. Of the low-risk findings, one was determined to be a false positive, and the other was accepted after risk evaluation. The informational finding was addressed and resolved. Both the offchain Chainlink node software and the onchain smart contracts are source available, along with Flashbot MEV-Share.

3c) Production Testing and Simulations:

SVR is currently being used in production on Aave V3 Core and Prime markets on Ethereum mainnet, covering ~30% of Aave’s TVL on Ethereum. Initially activated on March 29 for a limited set of markets (LBTC, tBTC, LINK, and AAVE), and later expanding on May 12 (eBTC, cbBTC and WBTC on the Aave V3 Core & USDC, WETH, rsETH, ezETH and wstETH on the Aave V3 Prime).

SVR has recaptured $25K+ in liquidation MEV and processed $1.8M+ in liquidations across 88 transactions, with zero bad debt accrual. This encapsulated a time period of providing SVR coverage during a price range of $74K-$100K in BTC/USD, including periods of heightened market volatility. More data can be found on SVR dashboards. In the past 30 Days ±57% of the liquidation bonuses paid out have been recaptured by the system with 8 unique searchers having successfully won a bid via SVR out of 23 across Aave in total. This means Aave has managed to almost cut their liquidation bonuses in half in some markets over that timeframe.

3d) Oracle Accuracy and Manipulation Resistance:

Since SVR feeds use the same Chainlink DON infrastructure that secure existing Data Feeds, including those used by the Compound protocol to secure billions of dollars in TVL over the past four years, the same rigorous level of security and reliability apply. Data Feeds, including SVR feeds, leverage multiple layers of decentralized data aggregation at the data provider, node operator, and network levels to mitigate central points of failure and manipulation. Oracle reports are cryptographically signed by a quorum of independent node operators and validated onchain before any price oracle reports can be made available to consuming protocols, preventing price spoofing attacks. More information on the security model of Chainlink Data Feeds, which encapsulate SVR feeds, can be read here.

3e) Failure Modes:

We want to be sure that no single failure can adversely affect Compound.

As noted above, in the event of an auction or transmission failure of SVR-enabled Price Feeds (i.e., MEV-Share failure), the DualAggregator contract will fall back to providing data from standard Data Feeds, which are delivered onchain directly by Chainlink DONs. In these situations, the liquidation process would revert back to how existing liquidations occur in existing non-SVR activated Compound markets. For example, with the SVR delay set at a maximum of 6 blocks on Ethereum, the maximum delay for liquidations to occur would be 6 blocks.

3f) Insurance and Recourse:

Security is the number one priority for our ecosystem; a value we do not and will not compromise upon. As such, all Chainlink services are rigorously audited by multiple leading security auditing firms, along with operating multiple bug bounty programs with a maximum bounty reward of $3M. By taking a security-first approach to oracle infrastructure, there have been zero instances of oracle-related losses on Compound markets powered by Data Feedsover the past four years. In this proposal, we do not propose a specific insurance fund, but are open to discussing how Chainlink approaches comprehensive risk management.

3g) Upgrade and Maintenance Security:

The upgradability processes used for SVR feeds follow the same standard practices used for existing Data Feeds used by the Compound protocol. Oracle networks are not static but rather require regular updates and adjustments to maintain a high level of security and reliability. The ability for adjustments to be made in response to unpredictable externalities is how Chainlink has securely scaled to over 1,000 independent oracle networks while securing tens of billions of dollars in DeFi TVL and can continue scaling to help secure onchain markets. More information about upgradability processes for Data Feeds and SVR can be read on the Chainlink FAQ.

3h) Responsible Disclosure:

Chainlink has multiple bug bounty programs in place, including Immunefi and HackerOne which cover all services, with a maximum bounty reward of $3M. More information can be found on each corresponding bug bounty page.

3i) Security Incident Monitoring and Management:

All Chainlink services, including the Data Feeds used by Compound today and the SVR feeds within this proposal, undergo extensive real-time monitoring. For SVR feeds, this includes real-time monitoring and alerting for all the DONs, OFA streams, and onchain activity. Additionally, SVR feeds are supported by 24/7/365 on-call rotations with subject matter experts, which is aligned with industry-standard best practices, along with the support of hundreds of engineers at Chainlink Labs. As previously mentioned, if there is any transmission issue with SVR fees (e.g., MEV-Share failure), the DualAggregator will fallback to providing data from standard Chainlink Data Feeds.

3j) Developer Support:

Documentation on SVR feeds and all other Chainlink services, including Data Feeds, can be found in the Chainlink documentation webpage: Smart Value Recapture (SVR) Feeds | Chainlink Documentation. A dedicated team at Chainlink Labs on call is in contact with the relevant parties in the Compound community. Additionally, there is a dedicated SVR developer relations team available to support searcher onboarding.

Dedicated Chainlink Labs personnel can be contacted on Telegram at @CL_Raoul and @ash_cll.

3k) Real-time Metrics:

As a part of this proposal, we plan to create a near real-time dashboard that can allow the community to track SVR performance on SVR. We are happy to collaborate with the community on the specific metrics desired but the following is our initial expectations:

Dollar adjusted values

  • Recapture Chance: the % chance that a dollar of liquidation bonus flows through SVR
  • Recapture Rate: the % of a recaptured dollar that received as a bid via the auction

Absolute values:

  • Total collateral liquidated: SUM of collateral_liquidated via SVR price updates
  • Total liquidation bonus: SUM of total liquidation bonus via SVR price updates
  • Total value recaptured: SUM of value_recaptured
  • Number of liquidations: COUNT of liquidations triggered by SVR price updates

Metrics would be sourced and calculated based on onchain data via transaction logs and can be verified by independently calculating the same metrics using onchain data. There are third parties, such as LlamaRisk, who have set up SVR dashboards for other users, we are happy to work with third parties if desired for the creation of a dashboard.

Final Considerations

Based on Compound’s existing usage of Chainlink Data Feeds for the past four years, we believe that the battle tested Smart Value Recapture (SVR) serves as the optimal OEV recapture solution for the Compound protocol given its built on the same Decentralized Oracle Network (DON) architecture that has secured billions in DeFi. SVR is already being adopted by the Aave protocol, where it currently secures $9B+ in TVL, recapturing OEV without meaningfully changing the protocol’s risk profile. Since deployment, we have seen recapture rates increase 2x (~25% to ~50%) and we expect recapture rates to continue improving as more searchers are onboarded.

SVR is currently live on Ethereum mainnet, with plans to rapidly expand its presence onto more chains in-scope in this proposal in the coming weeks and months. Notably, SVR’s modular design allows it to support multiple established Order Flow Auction (OFAs) providers, enabling the best OFA solution to be used on each supported blockchain network. Furthermore, a future, fully custom implementation is planned to introduce further improvements, including increased decentralization, a DON-based auction system, enhanced gas efficiency, and cross-chain capabilities.

Chainlink SVR’s design is aligned with Compound’s existing ethos of permissionless, decentralization liquidation processes, helping ensure a competitive searcher market that supports the solvency of the Compound protocol by tapping into established OFA providers and their searcher networks.

We look forward to our continued collaboration with the Compound community on integrating secure oracle infrastructure, while also increasing the protocol’s revenue.

Disclaimer

Chainlink Labs’ contributions under this proposal are provided “as is” without representations, guarantees, or warranties of any kind, on a commercially feasible basis. These contributions are made expressly subject to Compound DAO having accepted, and agreeing to be bound by, the Chainlink Labs terms of service (“Labs Terms”) and the Chainlink Foundation terms of service (“Foundation Terms”). The benefits described in the proposal are provided exclusively to the Compound Protocol as a whole, and not to any other party. By approving this proposal, Compound DAO shall be deemed to have accepted the Labs Terms and Foundation Terms, each as may be amended from time to time.

6 Likes

The proposal submission period has now concluded. This RFP is formally in the review phase, where the OpenZeppelin team will conduct an analysis of the details articulated by each of the vendors. The CGWG will begin planning the operations for the coming Snapshot & on-chain votes as well. More details will be posted on the forum as the review period concludes, allowing delegates a chance to examine the presented OEV solutions prior to voting.

Thank you to @mikemassari, @ugurmersin, and @AshNathan for submitting proposals on behalf of their respective organizations.

5 Likes

OpenZeppelin Assessments

OpenZeppelin reviewed each submission as described above. An assessment per submission and a comparative summary are available for community review and consideration:

3 Likes

Assessment Response Period

Thank you to @jbass-oz and the OpenZeppelin team for conducting a review of the three OEV solutions.

Vendors now have five days, until end of day Monday (June 23), to optionally respond to OZ’s feedback with a final statement for the community’s consideration. Again, participating in this phase is entirely optional. After this period, all vendor submissions to the DAO are considered final to avoid a perpetual back-and-forth between entities. OZ isn’t obligated to reply to this feedback unless they feel the need to do so—vendor replies here are simply additional details for delegates to review, enabling them to make a more informed decision.

We ask all vendors to reply under their respective threads when responding to the OZ assessment:

If a vendor, based on the OZ feedback, wishes to submit supplemental material to bolster their original RFP, please respond separately to this present forum thread. Keep these additions concise, and include them only if they are necessary. However, please refrain from making changes to key voting variables. For example, vendors are not allowed to add chains that they wish to apply their solution on.