## Background

Over the past several months, Gauntlet has been executing on its [Dynamic Risk Parameters](https://www.comp.xyz/t/dynamic-risk-parameters/2223/1) engagement to continuously optimize capital efficiency and mitigate depositor losses. In just a quarter, Gauntlet has launched the [Risk Dashboard](https://gov.gauntlet.network/compound), implemented 5 sets of parameter recommendations, published 2 monthly risk reviews, and safely unlocked  additional borrow for Compound while maintaining protocol risk at safe levels. 

## Replacing Existing Contributor Grant with Sablier Stream

As outlined in the original proposal, at the start of every quarter Gauntlet will create a proposal to update the service fee payment (higher or lower) in accordance with the formula outlined in the [proposal](https://www.comp.xyz/t/dynamic-risk-parameters/2223#:~:text=parameter%20recommendations%20suggested.-,Cost,-Gauntlet%20charges%20a).

As it is the beginning of a new quarter, Gauntlet is updating its streaming grant. In addition, as was requested by the [Compound community](https://www.comp.xyz/t/migrate-gfx-labs-and-gauntlet-comp-streams-over-to-sablier/2785), Gauntlet will replace its existing COMP stream with a Sablier stream. This governance proposal sets the Contributor Comp Speed to Gauntlet to zero and sets up a Sablier stream to Gauntlet instead.

References:
[Full proposal and forum discussion](https://www.comp.xyz/t/gauntlet-quarterly-contributorcompspeed-update/2829)

Dynamic Risk Parameters - Quarterly Update

## Simple Summary

A proposal to adjust one (1) parameter for one (1) Compound asset.


## Background
This proposal is a batch update of risk parameters to align with the [Moderate risk level](https://www.comp.xyz/t/community-risk-level-consensus-check/2437) chosen by the Compound community. These parameter updates are the sixth of Gauntlet's regular parameter recommendations as part of [Dynamic Risk Parameters](https://www.comp.xyz/t/dynamic-risk-parameters/2223/16).


[Full proposal and forum discussion](https://www.comp.xyz/t/risk-parameter-updates-2022-01-07/2845)


## Motivation and Specification

This set of parameter updates seeks to level set assets to a Moderate risk level of the protocol while making risk trade-offs between specific assets. Note that some are different from the original [risk level consensus check](https://www.comp.xyz/t/community-risk-level-consensus-check/2437) as market conditions have changed.


![](https://i.imgur.com/2LKqHgh.png)





## Dashboard


Gauntlet has launched the [Compound Risk Dashboard](https://gov.gauntlet.network/compound). The community should use the Dashboard to better understand the updated parameter suggestions and general market risk in Compound.


As shown on our dashboard, these changes will increase Value at Risk by $130.9M (10.9%) and increase the borrow usage by 5 basis points. We would emphasize that all the VaR is projected to be liquidations that can be safely absorbed by the market.


![](https://i.imgur.com/ijQ2dNJ.png)

Risk Parameter Updates for ETH

## Summary
This proposal is a patch developed by Equilibria which updates the cToken implementation contract for cSUSHI to a more recent
Solidity version (0.8.6) and removes error codes in favor of reverts with custom errors. No other core logic changes are
intended. The new implementation has been deployed to [0xFcB924Ae46C7DDc6ad4F873a59ad6F3b5A2e20d5](https://etherscan.io/address/0xfcb924ae46c7ddc6ad4f873a59ad6f3b5a2e20d5)

## Changelog
These changes implement the following:

* Upgrade the Solidity version of the cToken and related contracts to 0.8.6 - all contracts in the repo were changed to 0.8.6 but only the cTokens will be upgraded as part of upcoming governance proposals. This is due to the complexity of having multiple Solidity versions in the same repo.
* Remove the usage of SafeMath and CarefulMath in favor of Solidity 0.8’s checked math - Solidity will now automatically revert when math errors occur (overflows, division by zero, etc)
* Remove the custom errorCode return values in favor of reverts and custom errors - this allows for a more structured way to deal with errors rather than enum or string comparisons.

It is important to note that the goal is to have no behavior changes in the happy path case, and to only move away from errorCodes and to revert in the failure case (both math errors and checks). All existing unit and scenario tests should pass with only changes to the error code cases.

More cTokens will be upgraded in a future proposal if this one passes and causes no issues.

## Development
The code changes can be viewed here: [Pull Request #152](https://github.com/compound-finance/compound-protocol/pull/152).

An audit was completed by the [ChainSecurity Team](https://chainsecurity.com/security-audit/compound-ctoken) and all issues
were either fixed or out of scope for this change. For further discussion, please view the [Community Forum thread](https://www.comp.xyz/t/rfp12-implementation-ctoken-cleanup/2694).

Update cSUSHI cToken Implementation

This proposal transfers all existing contributor streaming payments, which are currently indefinite, over to Sablier for one year terms from the start date. The payments remain the same and are calculated assuming there are 6350 blocks per day. 

On proposal execution, the full amount of Comp required to complete these payments will be transferred to the Sablier contract from Timelock and be linearly streamed to each recipient. If any of the payments are canceled, by the recipient or governance, the remaining Comp will be transferred back to Timelock.

The final interaction pays Arr00 20 Comp for carrying out this proposal.

[Discussion](https://www.comp.xyz/t/migrate-gfx-labs-and-gauntlet-comp-streams-over-to-sablier/2785)
[Sablier Contract](https://etherscan.io/address/0xCD18eAa163733Da39c232722cBC4E8940b1D8888)

Migrate Contributor Streams to Sablier

## Simple Summary

A proposal to adjust one (1) parameter for one (1) Compound asset.


## Background
This proposal is a batch update of risk parameters to align with the [Moderate risk level](https://www.comp.xyz/t/community-risk-level-consensus-check/2437) chosen by the Compound community. These parameter updates are the sixth of Gauntlet's regular parameter recommendations as part of [Dynamic Risk Parameters](https://www.comp.xyz/t/dynamic-risk-parameters/2223/16).


[Full proposal and forum discussion](https://www.comp.xyz/t/risk-parameter-updates-2021-12-23-and-risk-dashboard-bug-fix/2799)


## Motivation and Specification

This set of parameter updates seeks to level set assets to a Moderate risk level of the protocol while making risk trade-offs between specific assets. Note that some are different from the original [risk level consensus check](https://www.comp.xyz/t/community-risk-level-consensus-check/2437) as market conditions have changed.


![](https://i.imgur.com/2LKqHgh.png)


## Dashboard


Gauntlet has launched the [Compound Risk Dashboard](https://gov.gauntlet.network/compound). The community should use the Dashboard to better understand the updated parameter suggestions and general market risk in Compound.


As shown on our dashboard, these changes will increase Value at Risk by $59.3M (10.3%) and increase the borrow usage by 5 basis points. Note that all the VaR is projected to be liquidations that can be safely absorbed by the market.


![](https://i.imgur.com/OmPyMsT.png)

# Executive summary

Compound seeks to prevent insecure proposals from being merged via the decentralized governance process. Trail of Bits will provide comprehensive software assurance services to mitigate this risk across three specific activities: consulting services, security engineering, and process creation.

We believe it is essential to create an easy-to-follow process with highly robust tools that makes security transparent, with or without a code review from Trail of Bits. We consider the primary goal as building capacity in the Compound ecosystem to secure itself. To that end, we will provide engineering efforts to develop critical security infrastructure and processes.

Trail of Bits will be paid the equivalent of $1 million USD in COMP every quarter for one year to provide the baseline services. This payment is all-inclusive of all services defined in the proposal.

Trail of Bits spoke on Discord at the Compound Community Dev Call and carved out [my part of the presentation](https://drive.google.com/file/d/1GYQ_A5EewK73ZtLZ_wvKpPFLYwCvVznX/view?usp=sharing) so you can listen to it briefly since it may add color to the proposal.

# Goals and Non-Goals

Goals of this effort include:

* Prevent insecure code from being merged into Compound through the governance process, and ensure that any remaining risks of proposals under consideration are well known before a vote. Compound desires services that eliminate and illuminate these risks.
* Provide first-class security tools and analytical capabilities to Compound developers. Compound developers must have every opportunity to analyze their code and understand its security ramifications. Compound desires a variety of tools that enable thorough inspection of code by developers and users.
* Create repeatable processes that build capacity for security and avoid dependence on external audits or third-party services for security. Security efforts should result in higher quality code being developed by the Compound community over time through the adoption of consistent processes.

Non-goals of this effort include:

* Deploy, configure, or maintain on-chain monitoring software. This goal does not address the security of governance proposals. These systems are an active field of research, may apply to fewer attacks than expected, or may have undesirable performance costs. Instead, we will commit to evaluating their opportunities and limitations during the project.
* Further development of the bug bounty program. We support the formation of a [bug bounty proposal](https://www.comp.xyz/t/bug-bounty-program-for-compound-proposals/2590) to specifically address this issue. We will provide consultative advice to this proposal based on our years of [experience](https://blog.trailofbits.com/2019/01/14/on-bounties-and-boffins/) seeing both ends of the bounty ecosystem.

# Description of the Services

## 1. Consulting services

Trail of Bits will provide at least one full-time security engineer, with additional engineers supporting the project as needed, to perform the following consulting services:

* **Maintain a presence on Discord and the Compound forums.** We will actively engage in conversation, reach out to developers as needed, and identify any new proposals.
* **Provide proposal authors with 1:1 counseling sessions.** We will host a video call with the author to understand their goals and provide immediate feedback, including on the architectural design of their proposal and suggestions to reduce complexity.
* **Review and report any identified security issues in the code for proposals.** We will describe the issue, a scenario to abuse it, and a recommendation to address it. We will work with proposal authors to validate fixes that result from these reports.
* **Define security properties for proposals.** We will work with the authors to provide reasonable security invariants alongside the proposal and tests for them in Certora, Echidna, or other tools, as appropriate for the specific invariants under test.
* **Document “Security Considerations” for every proposal.** We will contribute a standardized section to reviewed proposals to inform developers and users of limitations, risks, or other considerations to form an opinion about their vote on it.
* **Provide our analysis directly to the community.** Before a vote on any governance issue, we will host a public community call, walk attendees through the documented Security Considerations, and run test suites, fully informing their decisions to vote.
* **Host bi-weekly Office Hours with developers.** We will cover testing and verification tools, demonstrate new security processes and tools for Compound, and solicit feedback for new areas of development and guidance needed by the community.
* **Evaluate new security techniques for adoption by Compound.** We will perform detailed evaluations of the applicability of these techniques *directly on the Compound codebase*, sharing our empirical results of efficacy and utility.
* **Ad-hoc services sourced from across Trail of Bits**, as needed. This includes expertise from our separate teams for cryptography, application security, cloud-native security, threat modeling, machine learning, and other research teams. Our firm employs more than 80 researchers servicing clients in tech, defense, and finance on high-risk security challenges.

## 2. Security engineering

Trail of Bits will engineer solutions in software to critical security risks faced by Compound. We will ensure that first-class security tools are available, easy to use, and customized for use on Compound, with knowledge of Compound-specific risks built in.

* **Ensure that [Slither](https://github.com/crytic/slither), our static analysis framework, and [Echidna](https://github.com/crytic/echidna), our rapid security property tester, always work on Compound code.** These security tools are delicate machines that must ingest all code possible to write in Solidity and EVM. We will ensure that no breaking changes affect Compound for an extended period of time and these tools always "just work."
* **Customize Slither and Echidna to the Compound codebase.** We will extend each tool to understand Compound’s architecture, expected security properties, and third-party protocols, vastly enhancing their depth of results. For example, we can build static analyses that understand and aggregate data from Certora properties or that understand specific Compound interfaces.
* **Customize Slither to evaluate the security of upgrades.** Upgradeability exposes low-level complexity with possibly disastrous results. Slither already [evaluates for 17 such flaws](https://github.com/crytic/slither/wiki/Upgradeability-Checks), and we will enhance this analysis with Compound-specific conditions.
* **Develop scaffolding for new proposals with pre-integrated security analyses** from Slither, Echidna, Certora, or others, as appropriate. These templates will provide secure beginnings for parameter changes, new tokens, protocol features, and governance changes.
* **Continuously define and evaluate security properties across the Compound codebase** with analyses from Slither, Echidna, Certora, or other techniques, as appropriate. New proposals may expose under-specified areas of Compound that require greater formalization. We will work to fill in these gaps with new properties.

## 3. Repeatable processes

Trail of Bits will build the capacity of the Compound community to secure itself, minimizing dependency on external security audits for security and most efficiently using their time when engaged. We will define and socialize repeatable processes that encapsulate common tasks with security integrated within them. Adoption of these processes will set a floor on proposal quality, continuously secure proposals regardless of security auditor review, and improve the quality of proposals over time.

* **Design a repeatable process for starting a new proposal.** We will develop onboarding guidance for developers that describes the end-to-end process for securely creating new proposals. Touchpoints will include security training, using pre-created templates, example security properties, guidance on tools, self-assessment, engaging with Trail of Bits for code review.
* **Design a repeatable process for proposal [self-assessment](https://github.com/cncf/tag-security/blob/main/assessments/guide/self-assessment.md)**. We will provide guidance to assess the security of proposals before sharing them publicly. This will facilitate more effective conversations about security with the community and Trail of Bits, knowing that an initial baseline has been met.
* **Design a repeatable process for risk assessment by the community.** We will share the risk factors that security experts focus on when reviewing proposals and document steps to run testing and verification tools, thus providing a map for those voting on proposals to become better informed and obtain empirical evidence.
* **Design a repeatable process for evaluating [third-party protocol integration risks](https://github.com/crytic/building-secure-contracts/blob/master/development-guidelines/token_integration.md).** We will design a repeatable process to investigate the security considerations of new token implementations and other linkages to DeFi building blocks from Compound. We will document existing pitfalls and concerns in third-party code already used by Compound, and facilitate the discovery and documentation of others.
* **Design a repeatable process for other protocols to securely integrate with Compound.** In the reverse of the above, we will describe security considerations for DeFi users of Compound. In our mind, any compromise involving Compound, even if it does not originate from our own code, will compromise its reputation.
* **Regularly update a “treasure map” for bug hunting in Compound.** We will guide other security researchers to less specified, more risky areas of the code. We will regularly report statistics on these identified hotspots, such as % coverage for specifications.

# Risks

Compound may have unknown, latent security vulnerabilities already present in the code. Our proposal focuses on new code added to Compound and, therefore, these issues may continue undiscovered. To mitigate this risk, we have included a) a task focused on specifying new security properties, as needed, and b) a task to build a treasure map to aid other bug hunters.

COMP holders may vote for proposals that contain documented security risk or that are otherwise highly risky, considering the reward to be greater in that circumstance. To mitigate this risk, we will a) add documented Security Considerations to every proposal and b) host a community call to walk through those considerations, demonstrate how to run included test suites, and evaluate the coverage of them.

Compound is highly complex and new proposals may use new features of Solidity or combine features of Solidity in ways that break the security tools upon which it depends. To mitigate this risk, Trail of Bits has specifically prioritized the development and testing of new features for Slither and Echidna against the Compound codebase.

Proposals may require swift approval without waiting for input from Trail of Bits, or input from Trail of Bits may be otherwise unavailable within the timeframe required due to unknown circumstances. To mitigate this risk, Trail of Bits has proposed a robust sequence of processes and tools for the community to enhance trust in themselves and better understand the risks of their actions.

# Financial Terms

Trail of Bits will be streamed the equivalent of $4 million USD in COMP (at today's price) for one year to provide the services. This payment is all-inclusive of all services defined in the proposal.

Continuous Security Engineering for Compound

### Summary

The Compound DAO’s long-term security requires a comprehensive and continuous set of audit and security solutions to prevent loss of funds and protect its reputation resulting from risks to the Compound protocol, specifically those introduced by community-proposed upgrades

OpenZeppelin will provide dedicated continuous audit services for all Compound governance proposals and will work with the Compound community to develop comprehensive security requirements and to implement best practice security monitoring. 

OpenZeppelin's services will be coordinated by a dedicated Security Advisor who along with the OpenZeppelin team, the Compound DAO and the community will work to:

1. Improve the overall process to ensure the security of community proposed upgrades to the Compound Protocol  
2. Provide continuous audits and dedicated resources to respond rapidly to all community proposed upgrades and changes 
3. Coordinate the creation of documented security checklists and requirements that can be shared with all proposal authors
4. Implement an open security monitoring and security dashboard solution that will allow the community to validate security 
5. Integrate, support, and analyze other possible future important security program components such as formal verification, bug bounties, and white hat monitoring approved by the DAO.  

The combined effort of the OpenZeppelin team, the Security Advisor, and the Compound community will thereby reduce potential security risks and further assure the DAOs trusted reputation.

**OpenZeppelin has revised its original proposal to focus on community feedback and excludes performance fees. OpenZeppelin’s fee will be the equivalent of $1 million USD in COMP every quarter for one year. This fee covers all services defined in the proposal. Payment will be made using a streaming grant based on recommendations given by community member feedback on the forum. Please see our full revised proposal here:**

**[OZ Final Proposal](https://docs.google.com/document/d/1HVeQ5rbdzN2m7AR06eF-lbQHwFKZdvDj7WEiyMGdBdA/edit?usp=sharing)**

We believe that no other firm in the market can bring the same breadth and depth of offerings to the DAO.  We provide best-in-class continuous auditing and security advisory services; established leadership in secure development and secure operations; and external relationships and partnerships at a cost to value no other firm can match. 

We would be honored to partner with the Compound DAO to not only deliver continuous auditing but to also work together to be leaders and innovators in how to securely and efficiently run an effective DAO security program!

### Voting Instructions: [Audit Selection Process](https://www.comp.xyz/t/auditing-compound-protocol/2543/35)

All three audit proposals will be submitted to governance and voted on by the community. The proposal with the most "For" votes will win and the community multisig will then cancel the losing proposals after the vote is completed. Please only vote YES once for your preferred proposal.

See the [complete Forum discussion](https://www.comp.xyz/t/auditing-compound-protocol/2543) for more details

OpenZeppelin Continuous Audit & Security Services Proposal

# Overview

We live in a new world where more and more DAOs are in control of a project. Ensuring that safe choices are made is a major challenge and DAOs have been exploring different approaches. According to current proposals, Compound would effectively outsource their security to a vendor who would take care of various security-related needs.

We believe that this approach is not the route to take. The chosen audit company would become a critical dependency for the protocol. The suggested solutions with their intransparent, quarterly, lump-sum payment for a mix of services do not focus on the most effective tools. Hence, we would like to suggest a process that can leverage the strength of the security community.
The main security challenge for a protocol like Compound is the growing complexity that needs to be taken into account with every change.

* Compound needs to ensure compatibility, failure to do so can have significant consequences.
* Integrations must not be affected by the proposed changes.
* Compound protocol grows and contracts must still interact correctly. 

Overall, we conclude that such systems exhibit quadratic complexity growth. To tackle this, we aim for scalability. Furthermore, we believe that the security can best be ensured by a broad base of security providers. This prevents any form of vendor lock-in and conflicts of interest, while allowing to combine the strengths of different providers.

# Process in a Nutshell

With this proposal, Compound Governance will allocate the necessary funds to onboard two independent top-tier auditors at current market prices assuming that each one of them provides the capacity to review 150% of the RFPs voted on in 2021, providing in total a capacity of 300% over the needs of 2021.

To ensure that Compound has competent code auditors at their proposal, the following process would be enacted:

* Compound Governance votes in several code reviewers each year to onboard into auditing through a paid training phase.
* Auditors apply to become wardens of Compound by providing:
  * An example of how a code review for the Comptroller and the cToken would be performed, detailing methods and time required.
  * The cost and amount of hours reserved for Compound per quarter, which are if accepted guaranteed to be paid by Compound.
  * The expected compensation for the training phase.
* Onboarding code reviewers can also greatly benefit from the existing audit suite which contains many relevant attack scenarios.
* Any time reserved for Compound not spent on reviewing code or RFPs is used to improve this audit suite.
* Auditors who are selected by Governance and complete the training take shared ownership of the audit suite and collectively improve the coverage.
* Delivering good work in improving the Compound Audit Suite will likely be used to evaluate the quality of the auditor which aligns interests long-term by increasing the likelihood of being voted in again next year.

The following process focuses on prevention and consists of 5 steps to be executed for each RFP:

1. Early feedback during RFP stage with code reviewers adding security consideration paragraphs
2. Perform thorough code review of newly developed code
3. Develop an audit suite
4. Leverage tool-based analysis where efficiently possible
5. Perform the Proposal Verification

# Benefits of the Audit Suite

Considering all the benefits explained in detail in the forum post, we believe that the audit suite can provide the necessary scalability by capturing a lot of the growing complexity. It requires an initial investment to build it up, but we consider it worthwhile.

# Cost & Next Steps

For the first year, the total cost per auditor is expected to not exceed $1’370’000, which would cover 8 auditor-weeks of initial training ($170’000 one-time) and 24 auditor-days per month (quarterly fee of $300’000). This amount of auditor-days will cover the needs of Compound if 150% the capacity of 2021 will be required. For administration and maintenance of the program, an independent service provider with expertise in project management and IT safety will be chosen by Compound Governance with a compensation of $80’000 / year.
To ensure that all of these services can be provided with high quality, ChainSecurity commits to provide an offer as one of the auditors not exceeding the caps mentioned above. We will also source at least one independent provider to maintain the program for consideration by Compound Governance and hand over control over the Gnosis Safe MultiSig to this provider once they are confirmed by Compound Governance.
The initial request will cover the initial training for two auditors ($340’000 in COMP) and a streaming grant to cover audit cost at the cap for two auditors and the project maintainer ($620’000 per quarter) at $200 / COMP and 6500 blocks/day. A proposal for adjustment of the streaming grant to align COMP value with the value in USD will be done quarterly. Funds remaining at the end of the year in the MultiSig will be returned to Compound Governance.

# Closing words

Our suggestion incentivizes broad participation from small to large security companies. Thereby, it broadens the base of experts in Compound and leverages proven techniques. Using the audit suite, we can aggregate the knowledge and insights from multiple audits (instead of only relying on the last audit) and thereby tackle the growing complexity. We believe that this provides a viable long-term solution.
While even a single audit company chosen to shepherd the protocol could write such an audit suite, only by having multiple companies who rely on each other to have covered critical parts of the system enforces that a public, high-quality audit suite gets created. It also allows every security provider to play to their strengths when contributing. Lastly, it allows a decentralized verification of proposals by any community member.

# Reference
[Forum post with details](https://www.comp.xyz/t/auditing-compound-protocol/2543/27?u=chainsecurity)

Decentralized long-term security for Compound

## Simple Summary

A proposal to adjust three (3) total parameters across three (3) Compound assets.


## Background
This proposal is a batch update of risk parameters to align with the [Moderate risk level](https://www.comp.xyz/t/community-risk-level-consensus-check/2437) chosen by the Compound community. These parameter updates are the fifth of Gauntlet's regular parameter recommendations as part of [Dynamic Risk Parameters](https://www.comp.xyz/t/dynamic-risk-parameters/2223/16).


[Full proposal and forum discussion](https://www.comp.xyz/t/risk-parameter-updates-2021-12-11/2745)


## Motivation and Specification

This set of parameter updates seeks to level set assets to a Moderate risk level of the protocol while making risk trade-offs between specific assets. Note that some are different from the original [risk level consensus check](https://www.comp.xyz/t/community-risk-level-consensus-check/2437) as market conditions have changed.


![](https://i.imgur.com/zfOShU8.png)





## Dashboard


Gauntlet has launched the [Compound Risk Dashboard](https://gov.gauntlet.network/compound). The community should use the Dashboard to better understand the updated parameter suggestions and general market risk in Compound.


As shown below, VaR has increased considerably since our last recommendations, up to over $1B. This is mostly due to increased market volatility and lower collateralization ratios amongst the top borrowers. We note however that all the VaR is projected to be liquidations that can be safely absorbed by the market. This new set of parameter updates will slightly increase VaR, but meaningfully increase borrow usage and long-term reserves.


![](https://i.imgur.com/cjv97dA.png)

Risk Parameter Updates for WBTC, BAT, and LINK

Pax Dollar (USDP) is one of the most regulated stablecoin around being regulated by the New York State Department of Financial Services (“NYDFS”). This has the following benefits ([taken from here](https://www.paxos.com/a-regulated-stablecoin-means-having-a-regulator/)):
- The value of each stablecoin token is tied directly to the value of the US dollar, and the amount of “reserve” dollars equal or exceed the number of stablecoins outstanding.
- Regulators are overseeing the establishment and maintenance of reserves backing the stablecoins.
- Reserves may only be held in the safest forms, such as FDIC-insured bank accounts and in short-term maturity US Treasury instruments.
- Reserves are fully segregated from corporate assets, specifically for the benefit of token holders, and are held bankruptcy remote pursuant to the New York Banking Law.

This proposal serves to add a market for Pax Dollar (USDP) with the following parameters:
- Interest rate model: same as cDAI, cUSDT, and cTUSD (stablecoin standard)
- Collateral factor: 0% (standard to start)
- Reserve factor: 25% (standard)
- Borrow limit: none
- COMP rewards: none (for now, pending a broader discussion)

This proposal also updates the Uniswap-anchored ChainLink oracle with support for USDP (pegged to 1 USD).

References:
- [Etherscan - UAV price oracle](https://etherscan.io/address/0x046728da7cb8272284238bd3e47909823d63a58d)
- [Etherscan - cUSDP](https://etherscan.io/token/0x8e870d67f660d95d5be530380d0ec0bd388289e1)
- [Forums discussion](https://www.comp.xyz/t/new-listing-proposal-paxos-stablecoin-pax/1894/)
- [Proposal simulation](https://github.com/TylerEther/compound-protocol/blob/add-market-usdp/spec/sim/1000-add-market-usdp/hypothetical_proposal.sim)

Proposer disclaimers, affiliations, and transparency:
- USDP held over the past 90 days: none
- Compensation for this proposal: none
- Affiliation to USDP/Paxos: none

Vote By Signature

82

Total Proposals

Recent Proposals

Dynamic Risk Parameters - Quarterly Update

Risk Parameter Updates for ETH

Update cSUSHI cToken Implementation

Migrate Contributor Streams to Sablier

Risk Parameter Updates for ETH

Continuous Security Engineering for Compound

OpenZeppelin Continuous Audit & Security Services Proposal

Decentralized long-term security for Compound

Risk Parameter Updates for WBTC, BAT, and LINK

Add Market: USDP

Public API