Method
On 8 October 2026 the Compound Foundation proposed moving the Institutional Comet market from three multisigs to an optimistic council with a COMP holder veto. The mechanism is described in detail. The seven parameters that would tell a holder what that veto costs, how long they have to use it, how many others must join, and what decisions it reaches are not stated anywhere in the post. This is a dated record of what is open, published before the specification that will close it, so that the record can be graded rather than merely read.
Our determinations ask what a right lets its holder do, and at what price. A veto is a right of exactly that kind, and it is one of the few that can be priced from three numbers: the share of supply that must vote against, the time available to assemble it, and the set of decisions the veto actually reaches. Take any one of the three away and the right still exists in name. It stops being something a holder can plan around.
That is the state of the proposal filed as Compound forum thread 8153 at the time of writing. The thread is a discussion draft. Its authors say so: the specification follows before the end of October, and one is not published yet. We are recording the open parameters now, on the day we read them, because a reading written after the specification lands cannot demonstrate anything except hindsight.
The design is stated clearly, and we reproduce it as stated. The market's administration moves from its current multisigs to an optimistic governance council accountable to COMP holders. The council proposes and votes on changes to the market. Every proposal the council approves enters a veto period during which COMP holders can block it by voting against it with COMP. A proposal that survives the veto period waits in a timelock before execution. Installation happens through an on-chain proposal that issues non-transferable membership tokens and places the market under governance control, after which the remaining administrative roles are removed from the current multisigs.
Verified against the thread text read live on 2026-10-18. Three further facts we read from the contracts rather than the post: the proxy-owner Safe carries a 4-of-7 threshold, the market governor's Safe a 3-of-4 threshold drawn from a subset of those same seven signers, and the Pause Guardian is a 5-of-9. No signer address is mapped to an entity anywhere in the thread or its appendix, a gap a delegate raised directly and which remains unanswered.
The predecessor commitment is not in doubt. Proposal 608 asked for a plan to place the market under ultimate Compound governance control and was executed on 2026-09-29 at block 26081917; its text required the transition within 60 calendar days of passage, which places the outer deadline around 2026-11-28. The obligation is live regardless of how the earlier vote split.
The post lists the items to be defined in the specification. Every one of the seven is null today. No number, no band, no default appears in the thread for any of them.
| Parameter | State on 2026-10-18 |
|---|---|
| Council voting period | Not stated |
| Council quorum | Not stated |
| COMP veto threshold | Not stated. Only a qualitative constraint appears. |
| COMP veto period | Not stated |
| Timelock delay | Not stated |
| Cancellation authority before execution | Named as a safeguard to be designed, holder unnamed |
| Scope of the council's authority | Described only as changes to the market |
One constraint is stated, and it is worth quoting exactly because a shorter version circulates: a target of three days or less for an uncontested change. That is a ceiling on the sum of the council voting period, the veto period and the timelock. It fixes no individual term, and it is a target rather than a requirement.
In our earlier measurement of exercise cost the operative number for any holder-side right was the same shape: what share of supply must act, and what it costs to assemble that share. For a veto the arithmetic is unusually clean, because the threshold is expressed against a fixed denominator and the only cost of voting against is the opportunity cost of the tokens while they vote.
Set the threshold at one per cent of supply and a single holder with one per cent can stop any council proposal alone. COMP's total supply is 10,000,000 tokens, read from the token contract on 2026-10-18, so one per cent is 100,000 COMP and ten per cent is a million. Whether a million COMP can be assembled inside a veto window is not a theoretical question: on the two proposals the Pause Guardian cancelled in October, participation was 2,928,956.88 COMP, verified from the governor's own tallies. Turnout of that size happens when a vote is contested. It is not the shape of an ordinary week, and a threshold designed against the ordinary week is a different instrument from one designed against the exception.
Without the number, the veto cannot be priced. Without the window, it cannot be timed. Without the scope defined as a positive list, a holder cannot know whether an upgrade that silently changes the market's behaviour is inside or outside the veto's reach. On this market that last point carries the most weight, and the proposal's own text says why: the power to change a parameter is mechanically the power to upgrade. A scope described as changes to the market is, on this contract, close to unlimited.
The Foundation states the crux of the problem better than we can, and we quote it in full because the tail of the sentence matters:
“The veto threshold needs particular care. It must be low enough that COMP holders can stop a harmful proposal, and high enough that routine operation of the market cannot be blocked without broad support.”
Verified, post 1, 2026-10-08T16:22:52Z. Two tests sit inside one sentence. The first is numeric: low enough to stop harm. The second imports a legitimacy condition that no threshold can express: high enough that blocking requires broad support. A percentage cannot encode broad support. It can only encode a share of tokens, which is a different thing, and the difference is exactly what a determination would need to state if it were to grade this design.
The case for a fast lane rests on two documented episodes. During April 2026, USDC Comet withdrawals were frozen from 18 to 25 April, and the WETH/wstETH Comet from 18 April to 5 May, with service restored on 9 May, because there was no response mechanism faster than a seven-day governance cycle. Proposal 575, which followed, passed 737.78K For and 0 Against and executed on 2026-04-29, verified on Tally.
One correction belongs in the record. The seven-day sentence, as quoted in thread 8153, drops a condition present in the original discussion of 2026-04-22, where the claim was that no faster mechanism existed if rsETH is repriced sharply. The conditional version is the accurate one. The episodes are real and the dates check out; the generalisation is narrower than the restatement implies.
Two substantive replies sit on the thread, and both are supportive of the direction. Neither received an answer from the authors before we read it.
SEEDGov raised that in a permissioned market the whitelist is the permission that matters most, more than any single risk parameter: who adds institutions, who removes them, and against what criteria. Its proposal is that removal should sit behind the same veto and timelock as a parameter change, since for the entity on the other side removal is a freeze. It also asked which key belongs to ChainSecurity and how that seat is allocated, a question that goes to the gap between six named entities and seven signers.
Avantgarde disclosed that it voted against Proposal 608 as written while supporting the end state, and asked for three things: that the first council be treated as a pilot with review metrics fixed in the specification (proposals, cycle times, vetoes and cancellations, interaction with the Pause Guardian), that speed be matched to the direction of risk, and that indicative dates for steps two to four be given.
These are not objections to the design. They are requests for the parameters. As of this reading the specification that would answer them is due before 2026-10-31.
We have filed a record of this state, dated today, against which the specification can be checked. It scores each of the seven parameters as determined with a number, determined by reference to a deployed contract, or still open, and it names the four facts we will read from chain when the installation proposal executes: the membership token's deployment and holder set, the council governor's voting period and quorum and proposal threshold, the veto governor's threshold and period and denominator, and confirmation that the administrative roles were revoked from the current multisigs.
The record is also graded on whether it settles four things: a veto threshold with a named denominator, a veto period with any extension rule for partial veto stated, a council quorum, and a scope stated as a positive list with everything else reserved to a full governance vote. We publish the test now so that the test cannot be written to fit the result. The self-imposed deadline is 2026-11-30, one month after the specification is due and two days after Proposal 608's outer deadline.
One reading is that this is a careful staged handover: the architecture is published for comment, delegates are invited to shape the terms, and the numbers arrive with the technical specification that will implement them. Staging the design that way is how a live institutional market avoids being rebuilt in a single step.
The other reading is that a veto whose threshold, window and scope are unwritten is not yet a right a holder can rely on, and that the period in which the terms are unknown is a period in which the transfer's substance is decided by whoever drafts the specification.
We decline to choose. What separates the readings is not rhetoric but publication: a specification that fixes the four dimensions above converts the second reading into a description of a moment rather than a description of the design. That is a testable difference, and it will be tested in this record.
The thread is a draft and its authors say the numbers are coming. Nothing here asserts that the council would be captured, or that the veto would be unusable; it asserts that usability cannot be established from the current text. The upstream contracts the authors cite as their basis suggest a design in which the veto governor carries no quorum and expresses its threshold as a fraction of total supply, and in which the veto period may extend on partial veto. That is inference from the cited code, not a term of this deployment, and we do not treat it as one until a deployed contract is readable.
We also cannot verify the composition of the council beyond the entity list, because no signer-to-entity mapping is published. Two of the five contract addresses named in the thread are market-dedicated and were not read for this record. Where a fact above rests on the contracts rather than the post, we say so; where it rests on the post, we quote it.
0x76A0...8629 threshold 4 of 7; market governor Safe 0x4f05...b113 threshold 3 of 4; Pause Guardian 0xbbf3f1421D886E9b2c5D716B5192aC998af2012c threshold 5 of 9.determinations/compound.json, freshness block, event of 2026-10-18, type authority_transition_prespec.This essay records a proposal and its unwritten terms. It is not advice, it takes no position on how any holder should vote, and it makes no assessment of the authors' intent. GSA determinations are unchanged: under the frozen methodology a score moves only on verifiable on-chain events. Verify all information independently before acting on it.