Compound v3 (Comet)

Rejected venues wait the longest for re-review; a rejection has to earn another look before the scheduled date.

REJECTED PROTOCOL-WIDE — THE 0.5% THRESHOLD APPEARS BREACHED, ON PRIMARY ON-CHAIN EVIDENCE, NOT JUST UNVERIFIABLE. The Compound Foundation never published a per-Comet breakdown of the November 2025 deUSD/Stream loss, so this review read each held Comet’s reserves directly: `getReserves()` on the Ethereum USDC and USDT Comet contracts (addresses from Compound’s own deployments/mainnet/{usdc,usdt}/roots.json on GitHub) at block 23,716,567 (2025-11-03, pre-incident) versus block 23,802,360 (2025-11-15, post-incident). Ethereum USDC reserves fell $5,295,676.94, 1.049% of pre-incident market size; Ethereum USDT reserves fell $1,430,743.34, 0.707%. Both exceed this registry’s own 0.5%-of-a-single-market kill criterion — USDC by roughly 2x, USDT by roughly 1.4x — over exactly the incident window, on a metric that should normally rise from interest-reserve accrual, not fall. A reserve decline is not definitionally identical to certified bad debt, and the combined $6.73M decline exceeds the Foundation’s own reported ~$3.5M protocol-wide net loss, plausibly because recovered funds (the $12.07M Elixir settlement, $690K from Gauntlet’s insurance fund) landed in Foundation treasury rather than being redeposited into these specific Comets’ reserves — that redirection could not be confirmed from reserves data alone. But the size, direction, and exact timing of the decline is strong, direct, primary evidence a threshold breach occurred, not a proxy. WETH, the third held symbol, was not itself a Comet where deUSD/sdeUSD were listed, but Comet governance — the Pause Guardian, COMP voting, the shared incident-response apparatus — is protocol-wide, so this rejection covers all three held symbols rather than carving WETH out on an unbundled verdict this schema cannot record. Comet is Compound’s isolated-markets lending design: each deployment has exactly one borrowable base asset (USDC, USDT, or WETH in the markets we hold), and every other listed asset is collateral only, siloed in the contract, never lent out, earning nothing. A collateral failure on one Comet cannot touch another; the Ethereum USDC, Ethereum WETH, and Base USDC markets share no balance sheet. That is still the reason to hold it beside Aave: diversification of architecture, not just of venue. But isolation runs between markets, not within one, and November 2025 tested exactly that. Stream Finance disclosed a $93M loss on 2025-11-04; Elixir’s deUSD, which had lent about 65% of its backing to Stream, fell about 98%, and governance had listed deUSD and sdeUSD as collateral on the Ethereum stable Comets we hold. The protocol was left with $15.57M of exposure. Per the Foundation’s financial update, $12.07M (78%) was recovered through negotiation with Elixir plus $690,000 from Gauntlet’s insurance fund, a net loss near $3.5M. Kill criterion one is bad debt above 0.5% of a single market. The Foundation publishes only an aggregate across the USDC, USDS and USDT Comets, not the per-Comet realized loss, so this review reconstructed it directly on-chain (see above): both held Comets’ reserve declines exceed the 0.5% trigger over the incident window. Rejected on that primary evidence; reopens if a full recovery/reserve-restoration accounting shows the decline was reversed or was not, in fact, bad debt. Compound made the same class of listing mistake Aave paid roughly $196M to learn: an unproven wrapped asset welcomed into the flagship markets. The architecture cut the size of the loss, not its probability. The Pause Guardian, reported as a 4-of-6 multisig, froze withdrawals on our markets on 2025-11-04 for a duration we could not verify; for some period a client could not get out. Control is COMP voting through Governor Bravo and a 2-day timelock over upgradeable proxies. That pipeline’s record includes the 2021 distribution bug, roughly $90M claimed or claimable with aggregate at-risk estimates near $149M, which the same seven-day pipeline took a week to fix, and 2024’s Proposal 289, where a whale bloc voted $24M out of the treasury and was settled with, not stopped. OpenZeppelin’s standing security role ended around 2025-09-08, replaced by ChainSecurity and Certora at roughly half the budget, and TVL has halved in a year, $2.56B to $1.13B at the 2026-08-14 review. No exploit of Comet itself has been found from 2022 through 2026; every realized loss traces to a listing decision. Any later approval would cover Ethereum, Base, and Arbitrum only. Base holds $19.6M total, near the $5M per-market floor, where the liquidity check does real work.

Kill criteria: the events that revoke this verdict
• Bad debt in any single Comet market exceeding 0.5% of that market
• On-chain accounting shows any single Ethereum Comet’s November 2025 deUSD loss exceeded 0.5% of that market
• A proposal to list a new yield-bearing or wrapped stablecoin as collateral on a Comet we hold (the door deUSD used; USDe and sUSDe are already inside)
• The Pause Guardian blocks withdrawals on a market we hold and the pause is not lifted within 72 hours
• Governance merges isolated markets or permits shared collateral, including any v4 design that pools collateral
• A base-asset market we hold falls below our liquidity minimum
• The ChainSecurity and Certora security provider misses its reporting cadence or the DAO cuts the security budget again

The research file

The mechanism

Each Comet deployment is a separate market with exactly one borrowable base asset (USDC, USDT, USDS, or WETH depending on the market). Every other listed asset is collateral only: held in the contract, never lent out, earning no interest. Only the base asset earns supply yield. This is the reversal of Compound v2 and of Aave’s pooled design, where every listed asset is both lendable and borrowable and every depositor is exposed to every listed asset’s failure mode.

What the design buys: a collateral asset that fails on one Comet cannot touch any other Comet. The Ethereum USDC market, the Ethereum WETH market, and the Base USDC market share no balance sheet. What it costs: collateral earns nothing, so capital efficiency and liquidity are lower than Aave’s. And the isolation runs between markets, not within one. Base-asset suppliers in a single Comet are still exposed to every collateral asset listed on that Comet, which the November 2025 record shows is not hypothetical.

Governance can add collateral to an existing Comet by proposal. Each collateral has its own supply cap, collateral factor, liquidation factor, and price feed, all set by governance. Liquidation is an absorb model: the protocol takes over underwater positions, sells the collateral at a discount, and reserves back the base asset.

Who controls it

Control is COMP token voting through Governor Bravo, itself an upgradeable proxy, plus a Timelock. Docs say voting runs about 3 days; a passed proposal queues in the Timelock and executes 2 days later; quorum is 400,000 COMP. Every Comet is upgradeable through this path via the Configurator proxy, so immutability is not a claim anyone can make for Comet. All non-Ethereum deployments are administered by the mainnet Timelock through a per-chain Bridge Receiver plus a Local Timelock that adds its own delay; the Base and Arbitrum markets in this entry are governed from Ethereum.

A Pause Guardian, a community multisig designated by COMP holders, can pause supply, transfer, withdraw, absorb, and collateral buying on a Comet without a vote. Third parties, via OpenZeppelin’s compound-security-policies repository, report it as a 4-of-6 multisig of Gauntlet, protocol contributors, and community members. Withdrawals can be paused on v3, and were, in November 2025. The v1.2.1 service patch of June 2026 extended the guardian’s powers to per-asset pauses and emergency collateral deactivation, which makes small pauses more likely and full-market freezes less likely; a full-market pause is now a louder signal.

OpenZeppelin held the standing security role from December 2021 to September 2025. After an RFP, ChainSecurity and Certora became the DAO’s Security Service Provider with zeroShadow on incident response; the transition completed around 2025-09-08, and the Foundation projected roughly $2M per year, about 50%, in security-budget savings. The regime is one year old, with one incident (deUSD) handled during it, competently.

Compound Labs stepped back from operations years ago. In mid-2025 the DAO funded the Compound Foundation, a US 501(c)(4) with an 18-month mandate, roughly $9M in COMP, and Aaron Schnarch as Executive Director; the Foundation now coordinates governance, finances, and the v4 roadmap. Gauntlet remains the risk manager, renewed through September 2026, covering up to 50 Comet deployments.

The record

On September 30, 2021, Proposal 062 shipped an upgraded v2 Comptroller with a one-character comparison bug that let users claim COMP they had not earned. Reports at the time put roughly $70 to 90M claimed or claimable, with another 202,472 COMP, about $65M then, exposed when the drip() function refilled the contract; aggregate at-risk figures across reports run from $80M to $148.8M and could not be reconciled to one number. The lesson that matters: the fix had to go through the same 7-day propose-vote-timelock pipeline that shipped the bug, so the protocol bled for a week with everyone watching. Proposals are code, and the timelock delays rescue exactly as it delays attack. That was v2, but the identical pipeline ships v3 upgrades today.

No exploit of Comet itself was found by any source checked, 2022 through 2026. A sometimes-cited 2023 cUSDCv3 exploit could not be verified at all; the confusable events are the Hundred Finance hack of April 2023, a Compound v2 fork, $7.4M, and OpenZeppelin’s Compound-TUSD integration issue retrospective, v2, no loss of user funds.

On July 28, 2024, Proposal 289 passed: a voting bloc led by the whale Humpy moved 499,000 COMP, about $24M, from the treasury into goldCOMP, a vault the bloc controlled, after wallets funded via Bybit delegated them roughly 228,000 COMP. Widely described as a governance attack, it passed on-chain and was neutralized by negotiation, not by any technical control: Humpy agreed to rescind in exchange for a staking product directing 30% of annual reserve growth to staked COMP. COMP voting power is buyable at scale, and the community’s defense was a settlement. The 2-day timelock did not stop it; forum objection did not stop it. The same governance upgrades every Comet in this entry.

The November 2025 deUSD collapse hit the exact markets this entry approves. Stream Finance disclosed a $93M loss on 2025-11-04; Elixir’s deUSD, which had lent about 65% of its backing to Stream, fell about 98%. deUSD and sdeUSD were listed collateral on the Ethereum USDC, USDS, and USDT Comets. Gauntlet recommended and executed an emergency pause of all three Comets, withdrawals included, on 2025-11-04; Proposal 491 zeroed the supply caps on 2025-11-05; Gauntlet’s 2025-11-07 recommendations cut the deUSD and sdeUSD collateral factors to 0%. The Foundation reports $15,568,062 of exposure, of which $12,065,248.60, about 78%, was recovered via negotiation with Elixir plus $690,000 from Gauntlet’s insurance fund, leaving a net loss on the order of $3.5M. Recovered funds were due around 2026-03-16 to a new multisig with CGWG, ChainSecurity, Gauntlet, and Foundation signers. Isolation held between markets and did nothing within them, which is where client base-asset deposits sit; the listing decision, deUSD approved as collateral between December 2024 and mid-2025, was the same category of error as Aave’s bridged-LRT listing, at roughly one thirteenth the loss.

From August 2025 to June 2026, the USDM wind-down: Mountain Protocol retired USDM and its Chainlink oracle. wUSDM was collateral on the Ethereum USDT, Arbitrum USDC, and Optimism USDC and USDT Comets and had to be deprecated by proposal with the price feed pinned to a constant. The forum reports the episode exposed a design flaw: one dead collateral price feed could halt liquidations and withdrawals for an entire Comet. No loss was reported, and the v1.2.1 service patch of June 2026, audited by Certora, fixed it and added per-collateral pause and deactivation.

The numbers

Comet went live on Ethereum mainnet in August 2022: the initialization proposal passed 2022-08-18 with 100% support, the first DefiLlama TVL data point is 2022-08-26, and the first market was USDC on Ethereum. OpenZeppelin and ChainSecurity audited at launch, with Certora providing formal verification; the 2026 v1.2.1 service patch and its deployment pipeline were audited by Certora, and ongoing coverage sits with ChainSecurity and Certora as SSP.

The Immunefi program pays up to $1,000,000 for critical smart contract findings, in COMP. Against roughly $1.1B of TVL that is a thinner ratio than it sounds, but it is five times StakeWise’s $200k against $700M.

Realized v3 losses to date are credit losses from listed collateral, not code: the deUSD net loss of about $3.5M after recovery, and about $65k of bad debt on the Ethereum USDC Comet reported June 2026, traced to the Kelp/rsETH stress of April 2026, a third-party figure from Philidor Labs’ August 2026 review. At today’s sizes, 0.5% of the Ethereum USDC Comet, the first kill criterion’s threshold, is roughly $4 to 5M; the June 2026 figure is two orders of magnitude below trigger.

TVL from the DefiLlama API, pulled 2026-08-14: $1.125B supplied, $562M borrowed. The peak was $2.56B on 2025-08-13; TVL has roughly halved in the year since, with the deUSD week’s roughly $1B DeFi-wide yield exodus in the middle. By chain: Ethereum $1,026M (91%), Arbitrum $64.1M, Base $19.6M, Optimism $8.3M, Polygon $4.5M, Mantle $1.7M, Unichain $0.7M, Scroll $0.1M, Ronin $0.1M.

The Foundation reports net losses every fiscal year from FY2021 through FY2025, FY2021 about negative $280M with deficits narrowing since, per Gauntlet analysis, with the first profitable month since 2020 achieved during the Foundation’s tenure. Token incentives, not operations, drove the early losses.

The deployment map

DefiLlama lists nine live chains: Ethereum, Arbitrum, Base, Optimism, Polygon, Mantle, Unichain, Scroll, Ronin. Linea also appears in 2026 governance votes; proposal 587 patched the Linea and Scroll Comets. Gauntlet’s mandate covers up to 50 Comet deployments.

The approval is chain-scoped and the code enforces it: the entry’s chains field is Ethereum, Base, Arbitrum, and isWatched() in registry.ts rejects any pool on a chain or symbol outside the entry. The six other chains are outside the approval, which is the right shape: everything past Arbitrum is under $10M TVL, and four chains hold under $2M each. Sprawl is a governance-bandwidth cost even where nothing is held; every deployment is one more set of caps, oracles, and collateral lists the same DAO must not get wrong.

Inside scope, Base holds $19.6M total across its Comets, so individual Base markets can sit near or below the $5M per-market liquidity minimum. The monitor’s minLiquidityUsd check is doing real work there.

What the sleeve watches

Bad debt above 0.5% of any single Comet is watched through Gauntlet’s monthly market reports and the forum’s risk category. The deUSD episode shows the shape: exposure appears in a Gauntlet post within hours, the accounting lands in Foundation updates months later.

Collateral listings on the held Comets are the door every realized loss has used. Each new collateral proposal for the Ethereum, Base, and Arbitrum USDC, USDT, and WETH Comets is the event to read, especially yield-bearing or curated stablecoins. USDe and sUSDe are already listed collateral, so Ethena stress would arrive by the same door deUSD used.

Any Pause Guardian action on a held market is a client-facing liquidity event; withdrawals were paused in November 2025 and the entry’s liquidity language has to account for guardian pauses.

Governance capture signals: large sudden COMP delegations from exchange-sourced wallets preceded Proposal 289. Proposals touching treasury transfers, the staking product, or market architecture get read. A v4 that merges collateral pools would void the architecture-diversification thesis outright; the Foundation has announced a v4 roadmap, so the v4 design gets read when it lands.

The liquidity floor is automated via minLiquidityUsd at $5M, with Base the market closest to it today. On the security regime, the SSP is one year old: the monthly ChainSecurity, Certora, and zeroShadow updates are watched for missed cadence, and for whether the halved security budget shows up as slower proposal review.

Open questions

The 2023 cUSDCv3 exploit: no evidence it happened. Every 2023 incident in range attaches to v2, to a fork (Hundred Finance), or to a wrapper contract mitigation. It should not be cited; if a source claims it, ask for the transaction.

The exact 2021 distribution-bug exposure could not be reconciled: reports range from $80M at risk through the commonly cited $90M to the Quadriga Initiative’s $148.8M aggregate. The defensible statement is roughly $90M, with aggregate at-risk estimates to about $149M.

The per-market split of the $15.6M deUSD exposure is reported by the Foundation only as one total across the USDC, USDS, and USDT Ethereum Comets. Whether any single Comet’s share exceeded 0.5% of that market, the kill-criterion threshold, needs on-chain verification, most plausibly for the smaller USDS Comet, which is not a held market. Until checked, it cannot be said whether the criterion was or was not tripped in a market outside the entry’s symbols.

The duration of the November 2025 pause is unverified: sources confirm the pause and the temporary framing, but not the exact unpause date or the total hours withdrawals were blocked.

The current Pause Guardian signer roster is unverified; the 4-of-6 community multisig including Gauntlet is third-party reporting from OpenZeppelin-era documents, and the post-SSP-transition roster has not been confirmed. The bug bounty’s current terms after the SSP transition were likewise not verified. And whether the USDM episode froze any market in practice or only exposed the risk is open; the service patch language about operational limitations identified in production suggests real impact, but no loss figure or freeze duration was found.

Sources

The claims above trace to these. Where a number could not be independently verified, the thesis says so.

• Compound v3 documentation · primary · accessed 2026-08-15
  Supports: Comet isolation, governance controls, liquidation and pause mechanics
• Gauntlet pause of Ethereum stable Comets, November 2025 · primary · accessed 2026-08-15
  Supports: affected Comets, pause action, deUSD and sdeUSD response
• Compound Foundation financial update, February 2026 · primary · accessed 2026-08-15
  Supports: $15.57M aggregate exposure, $12.07M recovery, $690k insurance contribution, aggregate rather than per-Comet accounting
• The Block: Proposal 289 passes over DAO objections · secondary · accessed 2026-08-15
  Supports: Proposal 289, treasury transfer, voting-bloc control
• Compound DAO security service-provider transition · primary · accessed 2026-08-15
  Supports: ChainSecurity and Certora appointment, zeroShadow incident response, security budget
• Comet service patch v1.2.1 · primary · accessed 2026-08-15
  Supports: per-collateral pause, dead-oracle fix, guardian powers
• DefiLlama Compound v3 TVL · secondary · accessed 2026-08-14
  Supports: protocol and chain TVL, market scale
• Compound deployments — Ethereum USDC and USDT Comet addresses · primary · accessed 2026-08-16
  Supports: Comet contract addresses, deployment roots
• Ethereum mainnet, direct on-chain query: Comet getReserves() at blocks 23716567 and 23802360 · primary · accessed 2026-08-16
  Supports: Ethereum USDC Comet reserve decline 1.049%, Ethereum USDT Comet reserve decline 0.707%, primary reserve reconstruction, not secondary reporting

Inherited controls

The verdict above grades the protocol layer. Every position also inherits the asset it holds and the chain it settles on. The least safe layer sets the position’s grade, and the position table names which one that is.