Compound Polygon Bridge Receiver Audit
Audit · firm’s term: audit
OpenZeppelin reviewed Compound (Compound Polygon Bridge Receiver Audit) on 17 Feb 2023: 9 findings, 0 critical; 4 marked fixed, 5 acknowledged.
Report hosted on blog.openzeppelin.com.
Trustblock does not review code.
Findings9
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 1 | 1 |
| Low | 0 | 4 | 3 |
MediumProposals cannot be canceledAcknowledged
The report gives no description here.
LowIdentical transactions can be executed inside the same proposalAcknowledged
The report gives no description here.
LowMissing distinction between queued and ready-to-execute stateAcknowledged
The report gives no description here.
LowReversions in Polygon will not be seen in EthereumAcknowledged
The report gives no description here.
LowUnused return value from executeTransactionAcknowledged
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (5)
- contracts/vendor/Timelock.sol
- contracts/ITimelock.sol
- contracts/bridges/BaseBridgeReceiver.sol
- contracts/bridges/polygon/PolygonBridgeReceiver.sol
- contracts/bridges/vendor/fx-portal/contracts/FxChild.sol
Part of Compound’s security record
CompoundSecurity firm
OpenZeppelin67 projects reviewed · 184 reports · latest Aug 2026
See OpenZeppelin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us