TL;DR:
The Aave protocol's Price Oracle V2 contract, initially controlled by five EOA accounts, posed potential security risks due to its ability to transact without delay or timelock. To enhance security and decentralization, ownership has been transferred to the short executor of the Aave governance, addressing concerns raised about immediate changes to the oracle and marking a significant step towards complete decentralization.
The discussion primarily revolved around the Price Oracle in the Aave protocol, with Talkol shedding light on potential security risks associated with its current ownership structure. The Price Oracle V2 contract, owned by a proxy with implementation set to Gnosis Multisig, is controlled by five EOA accounts, presumably members of the core team. This structure allows any three of these members to transact with the price oracle without delay or timelock, posing a potential risk to user funds. Talkol suggested transferring control over the Price Oracle to the governance or adding a time lock to prevent immediate changes to the oracle.
Michael_Padilla echoed Talkol's concerns, emphasizing the need for careful dissemination of this information due to its potential risks. In response, Emilio clarified that the multisig ownership over the price oracle contract was a necessary measure for technical and security reasons following the launch of V2. He also mentioned that updates to the oracle, including the OCR (Offchain Reporting), would have been challenging for community governance to implement.
In a significant development, Emilio confirmed that ownership of the price oracle contracts has been moved to the short executor of the Aave governance, aligning with the commitment to complete decentralization of the protocol. This move addresses the concerns raised by Talkol and Michael_Padilla, marking a significant step towards enhancing the security and decentralization of the Aave protocol.
Posted 3 years ago
Last reply 3 years ago
Summary updated 2 months ago
Last updated 09/12 13:53