Compound Comprehensive Protocol Audit

OpenZeppelinFiles named in the report

Audit · firm’s term: audit

OpenZeppelin reviewed Compound (Compound Comprehensive Protocol Audit) on 21 Mar 2022: 11 findings, 1 critical; none marked fixed.

1 open critical finding
Open the reportOpen Compound’s security record

Report hosted on blog.openzeppelin.com.

Trustblock does not review code.

Findings11

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical100
High000
Medium000
Low1000
CriticalAnyone can steal money from other suppliers in TUSD market by creating negative interest ratesOpen

The report gives no description here.

LowcEther might fail when repaying a borrowOpen

The report gives no description here.

LowCommented out or missing verify callsOpen

The report gives no description here.

LowGas inefficienciesOpen

The report gives no description here.

LowisPriceOracle is not usedOpen

The report gives no description here.

LowMissing or erroneous docstrings and commentsOpen

The report gives no description here.

LowOutdated Solidity versionsOpen

The report gives no description here.

LowPossible function selector clashingOpen

The report gives no description here.

LowUnreachable codeOpen

The report gives no description here.

LowUnused functions and parametersOpen

The report gives no description here.

Show 1 more
LowUnused return valueOpen

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (19)

  • contracts/CErc20.sol
  • contracts/CTokenInterfaces.sol
  • contracts/CToken.sol
  • contracts/PriceOracle.sol
  • contracts/CEther.sol
  • contracts/Unitroller.sol
  • contracts/Comptroller.sol
  • contracts/EIP20Interface.sol
  • contracts/ComptrollerInterface.sol
  • contracts/ComptrollerStorage.sol
  • contracts/Governance/Comp.sol
  • contracts/Governance/GovernorBravoDelegator.sol
  • contracts/EIP20NonStandardInterface.sol
  • contracts/ExponentialNoError.sol
  • contracts/Governance/GovernorBravoDelegate.sol
  • contracts/InterestRateModel.sol
  • contracts/CErc20Delegate.sol
  • contracts/Governance/GovernorBravoInterfaces.sol
  • contracts/ErrorReporter.sol

Part of Compound’s security record

Compound
Audits21 audits by 4 firmsLast audit Jul 2026, by ChainSecurity.
Critical findings1 open critical findingReported in “Compound Comprehensive Protocol Audit” by OpenZeppelin, Mar 2022. Not marked fixed in that report.
IncidentIncident 29 Sep 2021Source: De.Fi incident database.
Open Compound’s security record

Security firm

OpenZeppelin

67 projects reviewed · 184 reports · latest Aug 2026

See OpenZeppelin’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us