Incident
Incident,
finance/governance/proposals/62 However, the Comptroller contract contains a bug, causing some users to receive too much COMP.
Source: De.Fi incident database.
- Audits before it
- 11.
- Audits since
- 10, the latest dated 2 Jul 2026.
Compound security record
As of 14 Oct 2026, Compound has 21 audit reports by 4 security firms on Trustblock; the latest is by ChainSecurity, dated 2 Jul 2026. Those reports list 1 open critical finding. It also holds 1 incident (latest 29 Sep 2021).
Critical findings
1 open critical finding
Reported in “Compound Comprehensive Protocol Audit” by OpenZeppelin, Mar 2022. Not marked fixed in that report. See the findings
Incident
Incident 29 Sep 2021
Source: De.Fi incident database. 10 audits have been published since. See the incident
Open the latest report
Your label, live
Get the label for your siteRecord last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Statuses are the security firms’ own. Trustblock does not review code.
Audits21
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Compound Franchiser V2 | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Compound Quark Smart Contracts | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Compound Labs Quark audit | Security firm: ABDK Consulting | Date: | Scope: Not recorded. See the report | No open critical findings | Open · GitHub |
| Scroll Alpha Comet Deployment Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Compound SUPTB | Security firm: ChainSecurity | Date: | Scope: Files named in the report | 1 critical finding, fixed | Open · chainsecurity.com |
| Compound Polygon Bridge Receiver Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Compound III | Security firm: ChainSecurity | Date: | Scope: Not recorded. See the report | No open critical findings | Open · chainsecurity.com |
| cToken (unredacted) | Security firm: ChainSecurity | Date: | Scope: Not recorded. See the report | 1 critical finding, fixed | Open · chainsecurity.com |
| Compound III Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Compound Comprehensive Protocol Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | 1 open critical finding | Open · blog.openzeppelin.com |
| Compound Governor Bravo Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Compound Protocol | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
| Compound Open Price Feed | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Compound COMP Distribution System Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Compound: Tether Integration Audit | Security firm: OpenZeppelin | Date: | Scope: Not recorded. See the report | No open critical findings | Open · blog.openzeppelin.com |
| Compound Gas Optimizations Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Compound Alpha Governance System Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Compound Open Oracle Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Compound Finance | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Compound Finance | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Compound Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
Findings212
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 1 | 0 | 2 |
| High | 1 | 1 | 5 |
| Medium | 14 | 15 | 13 |
| Low | 33 | 74 | 53 |
HighFlaw in QuarkWallet.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportMediumFlaw in QuarkStateManager.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportMediumFlaw in QuarkWallet.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportMediumFlaw in UniswapFactoryAddress.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportMediumSuboptimal in CodeJarStub.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportMediumSuboptimal in CodeJarStub.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportMediumSuboptimal in QuarkScript.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportMediumSuboptimal in QuarkStateManager.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportMediumSuboptimal in QuarkStateManager.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportMediumSuboptimal in QuarkWallet.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportShow 10 more
MediumProposals cannot be canceledCompound Polygon Bridge Receiver Audit · OpenZeppelin · 17 Feb 2023Acknowledged
The report gives no description here.
Open the reportMediumAllowances Enable Management of Both Base Tokens and Collateral AssetsCompound III · ChainSecurity · 16 Jan 2023Acknowledged
The report gives no description here.
Open the reportMediumapprove Only Allows the Values 0 and MAXCompound III · ChainSecurity · 16 Jan 2023Acknowledged
The report gives no description here.
Open the reportMediumbaseBorrowMin Is Not Enforced for Destination of TransferCompound III · ChainSecurity · 16 Jan 2023Acknowledged
The report gives no description here.
Open the reportMediumOracle Timestamps Not CheckedCompound III · ChainSecurity · 16 Jan 2023Acknowledged
The report gives no description here.
Open the reportMediumReentrancy to Circumvent Liquidation ProtectioncToken (unredacted) · ChainSecurity · 26 Nov 2022Acknowledged
The report gives no description here.
Open the reportLowA Nonce Can Be Used With Different Target AddressesCompound Quark Smart Contracts · ChainSecurity · 12 Jun 2024Acknowledged
The report gives no description here.
Open the reportLowContracts Do Not Extend Their InterfacesCompound Quark Smart Contracts · ChainSecurity · 12 Jun 2024Acknowledged
The report gives no description here.
Open the reportLowGas Griefing Through Memory Return BombCompound Quark Smart Contracts · ChainSecurity · 12 Jun 2024Acknowledged
The report gives no description here.
Open the reportLowBad datatype in CodeJar.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowBad datatype in IComet.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowBad datatype in IComet.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowBad datatype in IComet.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowBad datatype in IComet.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowBad datatype in IComet.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowBad datatype in ICometRewards.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowBad datatype in QuarkMinimalProxy.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowBad datatype in QuarkMinimalProxy.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowBad datatype in QuarkWalletProxyFactory.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowBad datatype in QuarkWalletProxyFactory.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowBad datatype in QuarkWalletProxyFactory.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowBad datatype in QuarkWalletProxyFactory.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowBad datatype in TerminalScript.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowBad datatype in TerminalScript.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowBad datatype in TerminalScript.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowBad datatype in TerminalScript.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowBad datatype in TerminalScript.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowBad datatype in TerminalScript.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowBad datatype in UniswapFactoryAddress.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowBad datatype in UniswapFactoryAddress.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowBad datatype in UniswapFlashLoan.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowBad datatype in UniswapFlashSwapExactOut.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowBad naming in QuarkStateManager.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowBad naming in QuarkWallet.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowDocumentation in IComet.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowDocumentation in IComet.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowProcedural in IComet.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowProcedural in QuarkWallet.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowProcedural in TerminalScript.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowProcedural in TerminalScript.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowProcedural in TerminalScript.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowProcedural in TerminalScript.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowProcedural in TerminalScript.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowProcedural in TerminalScript.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowProcedural in UniswapFlashSwapExactOut.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowReadability in UniswapFactoryAddress.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowReadability in UniswapFactoryAddress.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in CodeJar.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in IComet.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in ICometRewards.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowSuboptimal in Multicall.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in Multicall.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in QuarkScript.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in QuarkStateManager.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in QuarkStateManager.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in QuarkWallet.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in TerminalScript.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in TerminalScript.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in TerminalScript.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in TerminalScript.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowSuboptimal in TerminalScript.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in UniswapFlashLoan.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in UniswapFlashSwapExactOut.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in UniswapFlashSwapExactOut.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowUnclear behavior in Ethcall.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowUnused VariableScroll Alpha Comet Deployment Audit · OpenZeppelin · 26 Jan 2024Acknowledged
The report gives no description here.
Open the reportLowIdentical transactions can be executed inside the same proposalCompound Polygon Bridge Receiver Audit · OpenZeppelin · 17 Feb 2023Acknowledged
The report gives no description here.
Open the reportLowMissing distinction between queued and ready-to-execute stateCompound Polygon Bridge Receiver Audit · OpenZeppelin · 17 Feb 2023Acknowledged
The report gives no description here.
Open the reportLowReversions in Polygon will not be seen in EthereumCompound Polygon Bridge Receiver Audit · OpenZeppelin · 17 Feb 2023Acknowledged
The report gives no description here.
Open the reportLowUnused return value from executeTransactionCompound Polygon Bridge Receiver Audit · OpenZeppelin · 17 Feb 2023Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowBalances Can Be OverflowedCompound III · ChainSecurity · 16 Jan 2023Acknowledged
The report gives no description here.
Open the reportLowtargetReserves Limit in buyCollateral Can Be CircumventedCompound III · ChainSecurity · 16 Jan 2023Acknowledged
The report gives no description here.
Open the reportLowTracking Indices May Overflow on Large Tracking Speed ValuesCompound III · ChainSecurity · 16 Jan 2023Acknowledged
The report gives no description here.
Open the reportLowDeprecation Insufficiently DocumentedcToken (unredacted) · ChainSecurity · 26 Nov 2022Acknowledged
The report gives no description here.
Open the reportLowExtra Encoding and Decoding in CErc20DelegatorcToken (unredacted) · ChainSecurity · 26 Nov 2022Acknowledged
The report gives no description here.
Open the reportLowExtra Storage OperationscToken (unredacted) · ChainSecurity · 26 Nov 2022Acknowledged
The report gives no description here.
Open the reportLowNo Dynamic Bounds on Liquidation IncentivecToken (unredacted) · ChainSecurity · 26 Nov 2022Acknowledged
The report gives no description here.
Open the reportLowReentrancy by AdmincToken (unredacted) · ChainSecurity · 26 Nov 2022Acknowledged
The report gives no description here.
Open the reportLowUnnecessary Memory CopiescToken (unredacted) · ChainSecurity · 26 Nov 2022Acknowledged
The report gives no description here.
Open the reportLowUnlocked PragmaCompound Protocol · Quantstamp · 3 Dec 2020Acknowledged
Every Solidity file specifies in the header a version number of the format `pragma solidity (^)0.*.*`. The caret (`^`) before the version number implies an unlocked pragma, meaning that the compiler will use the specified version _and above_, hence the term "unlocked".
Open the reportIncidents1
Attached through a shared contract address. Our incident data ends in Oct 2026.
Contracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="compound"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us