Membrane Whitelisted Address for Deployment of CDP Stablecoin Protocol
This proposal grants the address osmo1988s5h45qwkaqch8km4ceagw2e08vdw28mwk4n the ability to upload CosmWasm contracts to Osmosis without needing further governance approval for each upload. This address is managed by @brane_trix.
Contracts
This proposal would allow upload of Membrane’s CDP, Governance & Launch contracts. The main CDP contracts that influence capital have been audited by Oak Security with a grant by OGP.
The launch contract initiates a Lockdrop that distributes 10% of MBRN supply, creates MBRN & CDT (the stable) OSMO LPs, incentivizes the CDT pool with 2M MBRN over a year & acquires the MBRN LP as POL. This ensures MBRN has liquidity to absorb any bad debt auctions that the protocol experiences, acting as a foundation for CDT user solvency from the jump.
Permissions
This proposal only signals approval for the initial Membrane contracts and their potential upgrades.
About Membrane
Membrane was founded in response to the survival of Terra’s collapse and is focused on creating a robust, user-first debt token as the foundation of the protocol’s economy. Cosmos still needs a resilient decentralized stablecoin & Osmosis is the best place to launch it.
With a founding team of 1 it is imperative to reduce central control of the protocol as well as decentralizing the value created by it, which is the leading incentive to enable delegatible governance power/commission & distributing a larger % of supply early on.
It’s not different, just incentivizing 14 day locks for the LP. It likely still works on chain using manual methods but this is deployed using a smart contract which requires using osmosis-std.
The entire smart contract is to automate the entire setup of Membrane’s system.
The point of allowing Osmosis smart contract’s to use Osmosis functionality is fairly simple, without it you wouldn’t be able to programmtically swap, LP, etc meaning no vaults (Quasar/Apollo), no routers, and whatever else people would build.
In our case, not having it in a smart contract would mean Membrane governance mints MBRN to a multi-sig that would then need to do it manually, which adds unnecessary risk & friction to everyone involved.
I’m Vini (@unl1k3ly), the managing director of SCV-Security.
I just want to further clarify this vulnerability as SCV were the ones that identified the problematic code during an audit on a client of ours. We knew Kujira were running the same underlying component and We initiated the responsible disclosure to them at the time. @Codehans identified and kindly reported the same problematic component to the Membrane team as it was missed during the audit engaged by OGP.
I feel this note is important to raise since SCV is also trying to participate in the OGP securing Osmosis projects launching on-chain along with Osmosis stack.
