Compound Comprehensive Protocol Audit

Off-Chain (Private)

Audited on 2022/03/21

1 active critical issue

Summary

in the following sections organized by severity. Critical Severity Anyone can steal money from other suppliers in TUSD market by creating negative interest rates Auditor’s note: The bug behind this issue was first privately reported by the ChainSecurity team during their audit of the CToken Refactors... of scope for the current audit, but oracle upgrades may be reviewed in future proposal audits. Assets: every cToken is coupled with an underlying asset (either Ether or an ERC20 token). Market listings for new assets are proposed by the community through governance proposals. It is very important...

Project

Compound

Multi-Chain

Issues (11)

	Low	Medium	High	Critical	Total
Not fixed	10	-	-	1	11
Fixed	-	-	-	-	0
Total	10	0	0	1	11

Contracts (19)

#	File Name
11	contracts/ComptrollerInterface.sol
12	contracts/EIP20Interface.sol
13	contracts/PriceOracle.sol
14	contracts/ComptrollerStorage.sol
15	contracts/CEther.sol
16	contracts/Comptroller.sol
17	contracts/Unitroller.sol
18	contracts/CToken.sol
19	contracts/CErc20.sol

#	File Name
11	contracts/ComptrollerInterface.sol
12	contracts/EIP20Interface.sol
13	contracts/PriceOracle.sol
14	contracts/ComptrollerStorage.sol
15	contracts/CEther.sol
16	contracts/Comptroller.sol
17	contracts/Unitroller.sol
18	contracts/CToken.sol
19	contracts/CErc20.sol

Compound Comprehensive Protocol Audit

Summary

Issues (11)

Anyone can steal money from other suppliers in TUSD market by creating negative interest ratesnot_fixed/critical

cEther might fail when repaying a borrownot_fixed/low

Commented out or missing verify callsnot_fixed/low

Gas inefficienciesnot_fixed/low

isPriceOracle is not usednot_fixed/low

Contracts (19)