Incident
Incident,
finance/governance/proposals/62 However, the Comptroller contract contains a bug, causing some users to receive too much COMP.
Source: De.Fi incident database.
- Audits before it
- 11.
- Audits since
- 10, the latest dated 2 Jul 2026.
Compound security record
As of 14 Oct 2026, Compound has 21 audit reports by 4 security firms on Trustblock; the latest is by ChainSecurity, dated 2 Jul 2026. Those reports list 1 open critical finding. It also holds 1 incident (latest 29 Sep 2021).
Critical findings
1 open critical finding
Reported in “Compound Comprehensive Protocol Audit” by OpenZeppelin, Mar 2022. Not marked fixed in that report. See the findings
Incident
Incident 29 Sep 2021
Source: De.Fi incident database. 10 audits have been published since. See the incident
Open the latest report
Your label, live
Get the label for your siteRecord last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Statuses are the security firms’ own. Trustblock does not review code.
Audits21
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Compound Franchiser V2 | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Compound Quark Smart Contracts | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Compound Labs Quark audit | Security firm: ABDK Consulting | Date: | Scope: Not recorded. See the report | No open critical findings | Open · GitHub |
| Scroll Alpha Comet Deployment Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Compound SUPTB | Security firm: ChainSecurity | Date: | Scope: Files named in the report | 1 critical finding, fixed | Open · chainsecurity.com |
| Compound Polygon Bridge Receiver Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Compound III | Security firm: ChainSecurity | Date: | Scope: Not recorded. See the report | No open critical findings | Open · chainsecurity.com |
| cToken (unredacted) | Security firm: ChainSecurity | Date: | Scope: Not recorded. See the report | 1 critical finding, fixed | Open · chainsecurity.com |
| Compound III Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Compound Comprehensive Protocol Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | 1 open critical finding | Open · blog.openzeppelin.com |
| Compound Governor Bravo Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Compound Protocol | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
| Compound Open Price Feed | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Compound COMP Distribution System Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Compound: Tether Integration Audit | Security firm: OpenZeppelin | Date: | Scope: Not recorded. See the report | No open critical findings | Open · blog.openzeppelin.com |
| Compound Gas Optimizations Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Compound Alpha Governance System Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Compound Open Oracle Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Compound Finance | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Compound Finance | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Compound Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
Findings212
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 1 | 0 | 2 |
| High | 1 | 1 | 5 |
| Medium | 14 | 15 | 13 |
| Low | 33 | 74 | 53 |
CriticalEncumbered Balances Can Be TransferredCompound SUPTB · ChainSecurity · 6 Nov 2023Fixed
The report gives no description here.
Open the reportCriticalAnyone Can Disable TUSD MarketcToken (unredacted) · ChainSecurity · 26 Nov 2022Fixed
The report gives no description here.
Open the reportHighGas Griefing AttacksCompound Quark Smart Contracts · ChainSecurity · 12 Jun 2024Fixed
The report gives no description here.
Open the reportHighSuboptimal in BatchExecutor.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Fixed
The report gives no description here.
Open the reportHighUnclear behavior in QuarkStateManager.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Fixed
The report gives no description here.
Open the reportHighPermission Can Be Bypassed in transferFrom()Compound SUPTB · ChainSecurity · 6 Nov 2023Fixed
The report gives no description here.
Open the reportHighWrong Computation of Borrow BalanceCompound III · ChainSecurity · 16 Jan 2023Fixed
The report gives no description here.
Open the reportMediumInconsistent GAS_OVERHEAD ValueCompound Quark Smart Contracts · ChainSecurity · 12 Jun 2024Fixed
The report gives no description here.
Open the reportMediumPossible Reentrancy in ERC20 TransferCompound Quark Smart Contracts · ChainSecurity · 12 Jun 2024Fixed
The report gives no description here.
Open the reportMediumScript Addresses Without Code Are UndetectedCompound Quark Smart Contracts · ChainSecurity · 12 Jun 2024Fixed
The report gives no description here.
Open the reportShow 10 more
MediumScripts Deployment Can Be BlockedCompound Quark Smart Contracts · ChainSecurity · 12 Jun 2024Fixed
The report gives no description here.
Open the reportMediumUnclear behavior in Multicall.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Fixed
The report gives no description here.
Open the reportMediumBaseBridgeReceiver can be rendered inoperable by incorrectly setting the localTimelockCompound Polygon Bridge Receiver Audit · OpenZeppelin · 17 Feb 2023Fixed
The report gives no description here.
Open the reportMediumCometInterface Not Implemented by the ContractsCompound III · ChainSecurity · 16 Jan 2023Fixed
The report gives no description here.
Open the reportMediumNo Handling of Ecrecover Return on Wrong InputCompound III · ChainSecurity · 16 Jan 2023Fixed
The report gives no description here.
Open the reportMediumNo Sanity Checks for liquidationFactorCompound III · ChainSecurity · 16 Jan 2023Fixed
The report gives no description here.
Open the reportMediumIncorrect Exchange Rates Due to Incorrect AccountingcToken (unredacted) · ChainSecurity · 26 Nov 2022Fixed
The report gives no description here.
Open the reportMediumIncorrect Return Value for mintFreshcToken (unredacted) · ChainSecurity · 26 Nov 2022Fixed
The report gives no description here.
Open the reportMedium`compSpeeds` UpdateCompound Protocol · Quantstamp · 3 Dec 2020Fixed
The implemented internal method `Comptroller.setCompSpeedInternal` does not update the related `cToken` market staking indexes. Changing the value of "Comp token distribution speed" for a specific market without updating its supply and borrow indexes will lead the users to either gain more or less Comp reward.
Open the reportMediumMalicious pauseGuardian can prevent their replacementCompound Finance · OpenZeppelin · 23 Oct 2019Fixed
The report gives no description here.
Open the reportShow 10 more
LowWrong Length Sanity Check in emergencyRecallDelegatesCompound Franchiser V2 · ChainSecurity · 2 Jul 2026Fixed
The report gives no description here.
Open the reportLowConsistency of Empty Code ExistenceCompound Quark Smart Contracts · ChainSecurity · 12 Jun 2024Fixed
The report gives no description here.
Open the reportLowGas Griefing Through BatchExecutor FailureCompound Quark Smart Contracts · ChainSecurity · 12 Jun 2024Fixed
The report gives no description here.
Open the reportLowGas Griefing Through Script Implementation DestructionCompound Quark Smart Contracts · ChainSecurity · 12 Jun 2024Fixed
The report gives no description here.
Open the reportLowLimited Events Emitted by ContractsCompound Quark Smart Contracts · ChainSecurity · 12 Jun 2024Fixed
The report gives no description here.
Open the reportLowPossible Allowance Leftover in UniswapSwapActionsCompound Quark Smart Contracts · ChainSecurity · 12 Jun 2024Fixed
The report gives no description here.
Open the reportLowQuarkScript Can Be Marked as AbstractCompound Quark Smart Contracts · ChainSecurity · 12 Jun 2024Fixed
The report gives no description here.
Open the reportLowSuperfluous Allowance Given in supplyFromCompound Quark Smart Contracts · ChainSecurity · 12 Jun 2024Fixed
The report gives no description here.
Open the reportLowUnchecked Loop IncrementCompound Quark Smart Contracts · ChainSecurity · 12 Jun 2024Fixed
The report gives no description here.
Open the reportLowUnused CodeCompound Quark Smart Contracts · ChainSecurity · 12 Jun 2024Fixed
The report gives no description here.
Open the reportShow 10 more
LowDocumentation in QuarkStateManager.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Fixed
The report gives no description here.
Open the reportLowDocumentation in QuarkStateManager.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Fixed
The report gives no description here.
Open the reportLowProcedural in QuarkMinimalProxy.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Fixed
The report gives no description here.
Open the reportLowProcedural in QuarkStateManager.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Fixed
The report gives no description here.
Open the reportLowProcedural in QuarkStateManager.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Fixed
The report gives no description here.
Open the reportLowProcedural in QuarkWallet.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Fixed
The report gives no description here.
Open the reportLowProcedural in QuarkWallet.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Fixed
The report gives no description here.
Open the reportLowProcedural in QuarkWallet.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Fixed
The report gives no description here.
Open the reportLowProcedural in TerminalScript.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Fixed
The report gives no description here.
Open the reportLowSuboptimal in UniswapFlashLoan.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Fixed
The report gives no description here.
Open the reportShow 10 more
LowSuboptimal in UniswapFlashLoan.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Fixed
The report gives no description here.
Open the reportLowSuboptimal in UniswapFlashLoan.solCompound Labs Quark audit · ABDK Consulting · 9 Apr 2024Fixed
The report gives no description here.
Open the reportLowFunction Is Updating the State Without an Event EmissionScroll Alpha Comet Deployment Audit · OpenZeppelin · 26 Jan 2024Fixed
The report gives no description here.
Open the reportLowMissing DocstringsScroll Alpha Comet Deployment Audit · OpenZeppelin · 26 Jan 2024Fixed
The report gives no description here.
Open the reportLowGas OptimizationsCompound SUPTB · ChainSecurity · 6 Nov 2023Fixed
The report gives no description here.
Open the reportLowIncorrect SpecsCompound SUPTB · ChainSecurity · 6 Nov 2023Fixed
The report gives no description here.
Open the reportLowIrregular NamingCompound SUPTB · ChainSecurity · 6 Nov 2023Fixed
The report gives no description here.
Open the reportLowNo Caller in Burn EventCompound SUPTB · ChainSecurity · 6 Nov 2023Fixed
The report gives no description here.
Open the reportLowPausableUpgradeable Is Not InitializedCompound SUPTB · ChainSecurity · 6 Nov 2023Fixed
The report gives no description here.
Open the reportLowUnpaused ApproveCompound SUPTB · ChainSecurity · 6 Nov 2023Fixed
The report gives no description here.
Open the reportShow 10 more
LowUnreachable BranchCompound SUPTB · ChainSecurity · 6 Nov 2023Fixed
The report gives no description here.
Open the reportLowInconsistent transaction expiryCompound Polygon Bridge Receiver Audit · OpenZeppelin · 17 Feb 2023Fixed
The report gives no description here.
Open the reportLowInconsistent usage of uint across loopsCompound Polygon Bridge Receiver Audit · OpenZeppelin · 17 Feb 2023Fixed
The report gives no description here.
Open the reportLowLack of indexed parameterCompound Polygon Bridge Receiver Audit · OpenZeppelin · 17 Feb 2023Fixed
The report gives no description here.
Open the reportLowAccrued Interest Not Accounted for in Balance FunctionsCompound III · ChainSecurity · 16 Jan 2023Fixed
The report gives no description here.
Open the reportLowFloating PragmaCompound III · ChainSecurity · 16 Jan 2023Fixed
The report gives no description here.
Open the reportLowMissing Constructor Sanity ChecksCompound III · ChainSecurity · 16 Jan 2023Fixed
The report gives no description here.
Open the reportLowMissing EventsCompound III · ChainSecurity · 16 Jan 2023Fixed
The report gives no description here.
Open the reportLowNo Recovery of Accidental Token Transfers PossibleCompound III · ChainSecurity · 16 Jan 2023Fixed
The report gives no description here.
Open the reportLowPossible Contract Size ReductionsCompound III · ChainSecurity · 16 Jan 2023Fixed
The report gives no description here.
Open the reportShow 10 more
LowPossible Gas SavingsCompound III · ChainSecurity · 16 Jan 2023Fixed
The report gives no description here.
Open the reportLowRounding Errors Between User Balances and Total BalancesCompound III · ChainSecurity · 16 Jan 2023Fixed
The report gives no description here.
Open the reportLowUnused Custom ErrorCompound III · ChainSecurity · 16 Jan 2023Fixed
The report gives no description here.
Open the reportLowIgnored Return ValuescToken (unredacted) · ChainSecurity · 26 Nov 2022Fixed
The report gives no description here.
Open the reportLowLiquidation Incentive Has Imprecise DocumentationcToken (unredacted) · ChainSecurity · 26 Nov 2022Fixed
The report gives no description here.
Open the reportLowSpecial Case Not Clearly SpecifiedcToken (unredacted) · ChainSecurity · 26 Nov 2022Fixed
The report gives no description here.
Open the reportLowUnclear SpecificationcToken (unredacted) · ChainSecurity · 26 Nov 2022Fixed
The report gives no description here.
Open the reportLowUnnecessary Overflow CheckscToken (unredacted) · ChainSecurity · 26 Nov 2022Fixed
The report gives no description here.
Open the reportLow[L02] initialize can be called multiple timesCompound Governor Bravo Audit · OpenZeppelin · 12 Feb 2021Fixed
The report gives no description here.
Open the reportLow[L03] Missing docstringsCompound Governor Bravo Audit · OpenZeppelin · 12 Feb 2021Fixed
The report gives no description here.
Open the reportShow 3 more
Low[L05] Unused return valueCompound Governor Bravo Audit · OpenZeppelin · 12 Feb 2021Fixed
The report gives no description here.
Open the reportLow`_grantComp` Insufficient BalanceCompound Protocol · Quantstamp · 3 Dec 2020Fixed
The `Comptroller._grantComp` method only succeeds when the amount requested is less than or equal to the remaining `Comptroller` Comp balance, as implemented in `Comptroller.grantCompInternal`. However, when the amount is more than that, the method fails silently without emitting an event or throwing. As consequence, this issue could lead a governance proposal to pass without throwing.
Open the reportLowSuperfluous code in conditionalCompound Finance · OpenZeppelin · 23 Oct 2019Fixed
The report gives no description here.
Open the reportIncidents1
Attached through a shared contract address. Our incident data ends in Oct 2026.
Contracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="compound"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us