Compound Protocol
Quantstamp reviewed Compound (Compound Protocol) on 18 Nov 2020: 3 findings, 0 critical; 2 marked fixed, 1 acknowledged.
Report hosted on certificate.quantstamp.com.
Trustblock does not review code.
Findings3
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 1 |
| Low | 0 | 1 | 1 |
Medium`compSpeeds` UpdateFixed
The implemented internal method `Comptroller.setCompSpeedInternal` does not update the related `cToken` market staking indexes. Changing the value of "Comp token distribution speed" for a specific market without updating its supply and borrow indexes will lead the users to either gain more or less Comp reward.
Low`_grantComp` Insufficient BalanceFixed
The `Comptroller._grantComp` method only succeeds when the amount requested is less than or equal to the remaining `Comptroller` Comp balance, as implemented in `Comptroller.grantCompInternal`. However, when the amount is more than that, the method fails silently without emitting an event or throwing. As consequence, this issue could lead a governance proposal to pass without throwing.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (4)
- Comptroller.sol
- Exponential.sol
- ComptrollerG5.sol
- ComptrollerStorage.sol
Part of Compound’s security record
CompoundSecurity firm
Quantstamp236 projects reviewed · 332 reports · latest Oct 2026
See Quantstamp’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us