TL;DR
Compound III (Comet) lends one base asset per market against capped collateral, and a single Timelock owns every market on every chain. The governance machinery is real and it verifies: a 2-day delay, a roughly 6.6-day end-to-end path, and a 5-of-9 guardian whose powers are defensive. No exploit has ever drained funds out of a Compound contract, and that held through April 2026, when a third-party bridge failure put $63.9M of rsETH-backed borrow on the books and the guardian froze the affected markets within hours.
What does not hold is the clean-record framing. Twice in nine months Compound had to emergency-pause withdrawals on its mainnet comets. The November 2025 Elixir episode left the protocol with $15,568,062 of impaired deUSD and sdeUSD exposure, of which $12,065,248.60 was clawed back through negotiation and roughly $3.5M was not. On 25 June 2026 about $65.3k of bad debt was socialized directly to USDC suppliers. Comet is upgradeable by governance, TVL is down 53.6% year over year, and ten markets are being wound down. Each of those alone is survivable. Together they put this at caution, not solid.
Checklist
Audits and contracts. The audit trail is better than the draft credited. OpenZeppelin delivered the Compound III audit on 14 June 2022 covering 18 in-scope Compound contracts plus a vendor tree, with 1 high, 3 medium, 8 low and 18 notes. Separately, ChainSecurity produced "Code Assessment of the Comet Smart Contracts" on 30 May 2022: 0 critical, 1 high (corrected), 7 medium (3 corrected, 4 risk accepted) and 12 low (9 corrected, 3 risk accepted). Those four risk-accepted mediums are worth knowing about. Certora formal verification runs in CI, and the v1.2.1 service patch of 1 June 2026 was independently audited by Certora along with its deployment pipeline, contrary to what a first pass suggests. The code is not frozen: the Configurator and factory let the Timelock redeploy Comet logic. DeFiLlama lists "2 audits" and links compound.finance/docs/security, which 302s to a page carrying only the v2 reports, so the public trail points away from the Comet audits that actually exist.
Admin control. Verified live, not quoted. The governor is "Compound Governor" at 0x309a862b, not the Governor Bravo address most write-ups still cite; Bravo's counter froze at 393 while the live governor reads 594. Its timelock is 0x6d903f60 with delay() of exactly 172,800 seconds, a 14-day grace period, a 2-day minimum and 30-day maximum, and pendingAdmin at zero. Both mainnet Comets return that Timelock from governor(). Voting delay is 13,140 blocks and the voting period 19,710 blocks, so at 12-second blocks the full path is about 1.8 plus 2.7 plus 2.0, roughly 6.6 days. The Community Multi-Sig at 0xbbf3f142 is a 5-of-9 Safe (threshold 5, 9 owners, version 1.1.1) and holds pause guardian, proposal guardian (expiring 2030-02-28) and whitelist guardian roles at once. One thing changed this year: v1.2.1 added per-asset, per-action pause flags and an emergency collateral deactivation mechanism the guardian can fire without waiting for governance. That is more authority than "pause", and it is still not seizure.
Oracle. The USDC market's base feed is Chainlink's USDC / USD aggregator, confirmed by calling description(). The WETH market prices its base at a constant, correct for an ETH-denominated book, and prices LST and LRT collateral through CAPO wrapper feeds that cap how fast an exchange rate may move. This is the part that has now failed twice. In November 2025, sdeUSD's oracle reported $1.06 while the token traded at $0.86, letting users borrow against collateral at roughly $0.93 of assumed value; Gauntlet called it a vulnerability and paused withdrawals. In April 2026 the rsETH feed read Kelp's own exchange rate, meaning the issuer's loss-allocation decision would have mass-liquidated every borrower in one step. Gauntlet's proposed replacement handed the multisig min/max bounds and a constant-rate override, and a delegate argued at length that this converted a pause-only multisig into a drain vector. I traced where that landed: today the rsETH feed on the WETH comet reports "rsETH / ETH CAPO Price Feed" and the one on the USDC comet reports "rsETH / USD CAPO SVR Price Feed". Calls to minPrice(), maxPrice() and constantPrice() revert on both. The multisig-controlled override is not in the call path the Comets read. Both feeds had updated within the half hour before my read.
Liquidity and exit. All three pause flags read false on the USDC and WETH mainnet Comets right now. This is where the draft understated the risk, and it matters most. Protocol-wide, borrowed against TVL is about 49%, but that number mixes non-borrowable collateral into the denominator. The figure a supplier actually faces is base-asset utilization, and getUtilization() on the USDC comet returns 90.08%. Against 340,562,977 USDC supplied there is 306,794,458 borrowed, leaving roughly $33.8M available. The WETH comet is 61.1% utilized. On top of that, withdrawals really were blocked twice: on Ethereum USDC, USDS and USDT in November 2025, and on mainnet USDC, WETH and wstETH plus five L2 WETH comets in April 2026. Linea, Mantle, Ronin and Scroll are deprecated, Polygon and Unichain were proposed for deprecation on 10 July, and a 4 August proposal zeroes the supply-rate curve on six of them. Deprecation does not restrict withdrawals, it just stops paying you.
Yield, real versus emission. Supply APY is borrower-paid interest. That is real yield and it is the overwhelming majority of what a supplier earns here. The COMP layer is the unreliable part: the rewards contract allowed anyone to trigger a claim on behalf of any address, which let it be drained faster than it could be refilled. It ran empty on 10 June 2026, claims failed, top-ups were paused, and distribution is migrating to Merkl with self-claim only. Treat COMP emissions as zero when you size a position and you will not be surprised.
Holder concentration. COMP has 9,668,189 of a 10,000,000 hard cap circulating at $16.47, a $164.7M market cap against a $1.13B protocol. Proposing costs 25,000 COMP, about $412k. Quorum is 400,000 COMP, about $6.59M, read directly off the governor. That ratio is the uncomfortable number in this report, and it has been exercised: in July 2024 the Golden Boys bloc passed Proposal 289 by 682,191 to 633,636, redirecting roughly 499,000 COMP (about $24M) of treasury over DAO objections, before agreeing to rescind it. Defences since are real. 610,000 COMP sits with 13 wallets through the audited Franchiser system, and the governance working group enforces an 80% participation bar, revoking 81,178.58 COMP from 3 of 13 delegates in May 2026.
Track record. Live since 2018. The only DeFiLlama hack entry attributable to Compound is the September 2021 COMP over-distribution bug, $147M, tagged Compound V2, which predates Comet and cost no depositor principal. Gauntlet's February 2026 review is genuinely impressive: across 28 January to 5 February, with ETH down about 39% and BTC about 30%, 2,447 liquidations were absorbed with zero bad debt and 100% uptime, and reserves grew. Note that 2,447 is protocol-wide, 1,181 on V3 and 1,266 on V2. But the record is not clean. The Elixir/deUSD collapse left $15,568,062 of mainnet exposure; $11,654,780.60 was recovered from Elixir plus $690,000 from Gauntlet's insurance fund, leaving about $3.5M unrecovered. April's L2 write-off was estimated at $202,014. And on 25 June 2026 an independent reviewer recorded a bad-debt absorption of about $65.3k on the Ethereum USDC comet, socialized to suppliers. That last one is small, roughly 0.02% of TVL, but it is a direct supplier loss and it is the reason the "nobody ever lost anything here" line cannot stand.
Worst case
Three shapes, and they are very different sizes.
The slow one is governance. About $6.59M of COMP carries a vote, and a passed proposal can upgrade Comet itself, because the Timelock is the governor of every market. You get roughly 6.6 days of warning and a 5-of-9 multisig that can cancel. The one hostile proposal that did pass, in 2024, took nothing from users and was rescinded.
The fast one is collateral, and it has now happened twice. In April an asset Compound listed broke somewhere Compound does not control: an attacker exploited a 1-of-1 DVN configuration on the LayerZero V2 Unichain to Ethereum rsETH route and minted about 116,500 unbacked rsETH. Note the attribution, because it is not what the headline suggests. LayerZero's own incident report traces it to a socially engineered LayerZero Labs developer and poisoned internal RPC nodes, with LayerZero stating "we made a mistake by allowing our DVN to act as a 1/1 DVN for high-value transactions." Chainalysis concurred that the target was LayerZero's off-chain infrastructure, not Kelp's contracts and not Compound's. It ended well because Compound froze within hours and because third parties restored the backing.
The quiet one is exit. At 90% utilization on the USDC comet, a rush for the door does not need an exploit to hurt. Rates spike and the last suppliers out wait for borrowers to repay. Combine that with a protocol willing to pause withdrawals when collateral misbehaves, which it has done twice in nine months, and the realistic bad day is that your capital is illiquid for days, not stolen.
Bottom line
Caution, and the downgrade is about behaviour under stress rather than structure. Everything structural checks out under a live read: the Timelock, the 2-day delay, the guardian's limits, the Chainlink and CAPO feeds, the reserves, and every market unpaused right now. Compound's incident response has been fast, transparent and published with real numbers, and recovering 78% of the Elixir exposure through negotiation is a genuinely good outcome most DAOs would not have achieved.
But the pattern across nine months is two emergency withdrawal freezes, two oracle failures, about $3.5M unrecovered on one collateral listing, and a first socialized loss to suppliers. That is not a protocol whose risk lives in the abstract. Supplying USDC or WETH on Ethereum is the version the record supports, and even there you are 90% utilized and exposed to whichever collateral the DAO listed last. Read the collateral list for your specific Comet, not the protocol name on the front page. The deprecated L2 comets are having their supply rate zeroed, so there is no reason to be in one.
Data appendix
- TVL: $1,131,263,475 for the
compound-v3slug (DeFiLlama, snapshot 2026-08-11 10:01 UTC). The parent "Compound Finance" entry reads $1.2212B and is a different number: V3 $1,131.26M plus V2 $87.48M plus V1 $2.46M equals $1,221.20M. Ethereum is $1,030.81M, or 91.1% of V3. Then Arbitrum $64.87M, Base $19.82M, Optimism $8.61M, Polygon $4.59M, Mantle $1.70M, Unichain $0.67M, Scroll $0.10M, Ronin $0.099M. Borrowed protocol-wide $558.28M. - TVL trend: 90d ago (2026-05-13) $1,287,713,628, down 12.1%. 365d ago (2025-08-11) $2,437,418,651, down 53.6%. ATH $2,561,517,762 on 2025-08-14, so 55.8% below peak.
- Audits: OpenZeppelin, Compound III (Comet), delivered 14 June 2022, published 20 July 2022, 18 in-scope Compound contracts plus vendor tree, 1 high / 3 medium / 8 low / 18 notes (counts verified item by item from the report contents). ChainSecurity, "Code Assessment of the Comet Smart Contracts", 30 May 2022, 0 critical / 1 high / 7 medium / 12 low, with 4 medium and 3 low risk-accepted. Compound v2: Trail of Bits (April 2019, August 2019, February 2020) and OpenZeppelin (August 2019, Timelock and Pause Guardian, cDAI, COMP and Governance, Tether, COMP Distribution). Certora formal verification (Certora ASA) integrated into CI. v1.2.1 patch and its deployment pipeline independently audited by Certora. Immunefi bug bounty, maximum payout refresh.
- Admin and governance: Governor "Compound Governor" at
0x309a862bbC1A00e45506Cb8A802D1ff10004c8C0, proposal count 594. Governor Bravo0xc0Da0293...still returns "Compound Governor Bravo" with proposal count 393 and the same Timelock as admin. Timelock0x6d903f6003cca6255D85CcA4D3B5E5146dC33925:delay()172,800s,GRACE_PERIOD()1,209,600s (14 days),MINIMUM_DELAY()172,800s,MAXIMUM_DELAY()2,592,000s,admin()is the governor,pendingAdmin()zero.votingDelay()13,140 blocks,votingPeriod()19,710 blocks.proposalThreshold()25,000 COMP,quorum(uint256)400,000 COMP.cUSDCv3andcWETHv3both return the Timelock fromgovernor()and0xbbf3f1421D886E9b2c5D716B5192aC998af2012cfrompauseGuardian(). That Safe returnsgetThreshold()5 over 9 owners, VERSION 1.1.1, and is alsoproposalGuardian()(expiry 1898467200 = 2030-02-28 UTC) andwhitelistGuardian(). Signer identities and jurisdictions come from a delegate post, not an official roster: refresh. - Oracle:
cUSDCv3base feed0x8fFfFfd4AfB6115b954Bd326cbe7B4BA576818f6returns "USDC / USD".cWETHv3base feed0xD72ac1bCE9177CFe7aEb5d0516a38c88a64cE0ABreturns "Constant price feed". rsETH oncWETHv3uses0x5aBcfC8a...= "rsETH / ETH CAPO Price Feed" (answer 1.07775 rsETH/ETH, updated 11:36 UTC); wstETH uses0x91359ce8...= "wstETH / ETH CAPO Price Feed". rsETH oncUSDCv3uses a different feed,0xd6a48f6f...= "rsETH / USD CAPO SVR Price Feed" (answer $2,040.03, 8 decimals, updated 11:04 UTC).minPrice(),maxPrice(),constantPrice(),owner()andgovernor()all revert on that feed, so the April MinMaxConstantPriceFeed is not the contract in the Comet call path. Oracle providers on the deprecated chains (RedStone on Unichain, Api3 on Mantle): refresh. - Live market state:
cUSDCv3supply/withdraw/absorb pauses all false, reserves 8,172,887 USDC, total supply 340,562,977 USDC, total borrow 306,794,458 USDC,getUtilization()90.08%, available to withdraw about $33.77M, 13 collateral assets.cWETHv3all pauses false, reserves 906.89 WETH (about $1.7M at the roughly $1,893 ETH implied by its own feeds), total supply 50,497 WETH, total borrow 30,874 WETH, utilization 61.14%, 17 collateral assets.cUSDTv3andcwstETHv3reserves, and the July 2026 treasury teardown figure of $11.6M total v3 reserves: refresh, not re-read this run. - rsETH residual: on
cWETHv3today, borrow CF 0.80, liquidate CF 0.93, liquidation factor 0.96, supply cap 0,totalsCollateral71.846 rsETH (about $147k). rsETH is also still listed oncUSDCv3with borrow CF 0, liquidate CF 0.90, liquidation factor 0.95, supply cap 0, and about 17 rsETH (roughly $35k) on book per Philidor. On 2026-07-08 Gauntlet counted four rsETH-backed positions holding $12.3M and $6.65M of collateral against $12.1M and $6.0M of debt, so the unwind has largely completed. The on-chain state shows the 12 July proposal (borrow CF 0% to 80%, for orderly unwind) executed, while the 8 July proposal (liquidate CF 93% to 88%, liquidation factor 96% to 94%) has not. - April 2026 incident, sourced: 18 April, an attacker exploited a 1-of-1 DVN configuration on the LayerZero V2 Unichain to Ethereum rsETH route and minted about 116,500 rsETH on mainnet without corresponding source-chain burns. LayerZero's incident report (20 May 2026) attributes it to a socially engineered LayerZero Labs developer and poisoned internal RPC nodes; Chainalysis (23 April 2026) states the target was LayerZero's off-chain infrastructure, not Kelp's or LayerZero's contracts. Compound paused mainnet WETH, USDC and wstETH plus WETH on Optimism, Base, Arbitrum, Unichain and Linea, and froze rsETH across all comets within hours. Foundation and Gauntlet snapshot of 23 April: 36 positions across 5 networks, $63,924,466 borrow against $71,545,495 collateral, Ethereum over 99% of it, attacker position about $39.4M (11,978 WETH plus 3,908.6 wstETH). Mainnet rsETH stayed 1:1 backed throughout; it was L2 rsETH, 112,204 unbacked against a 629,689 pre-exploit supply, that lost backing. Modelled outcomes: $202,014 if the loss stays isolated to L2 (the actual on-chain state), $151,511 with Arbitrum recovery, $3.4M under uniform socialisation, $1.1M with recovery. Kelp refilled the roughly 116,000 rsETH lockbox on 25 May and has announced a migration to Chainlink CCIP/CCT. Final consolidated realized Compound loss: refresh.
- Elixir / deUSD episode (omitted from the prior draft): on 4 November 2025 Gauntlet recommended an emergency withdraw pause on the Ethereum USDC, USDS and USDT comets after a liquidity crunch in deUSD and sdeUSD, noting sdeUSD trading at $0.86 while the oracle reported $1.06. The Foundation's 21 February 2026 financial update reports $15,568,062 of protocol exposure across deUSD and sdeUSD, of which $12,065,248.60 was recovered (about 78%): $11,654,780.60 from Elixir plus $690,000 from Gauntlet's insurance fund. The roughly $3.50M residual is my arithmetic on those two published figures. Whether it was absorbed by reserves or socialized to suppliers: refresh.
- Holder concentration: COMP $16.47, market cap $164,671,050, circulating 9,668,189 of a 10,000,000 max (CoinGecko); the token contract confirms a 10,000,000 total supply. Quorum 400,000 COMP is about $6.59M; proposal threshold 25,000 COMP is about $412k. 610,000 COMP sits with 13 treasury delegates via Franchiser (Prop 315, executed Aug 2024, 300,000 to 9 wallets; Prop 504, executed Nov 2025, 310,000 to 8). In the review window (proposals 505 to 586, 82 total, 77 counted, 5 cancelled before voting) 10 of 13 delegates cleared the 80% bar and 3 failed, releasing 81,178.58 COMP. Per the CGWG table, Wintermute holds 59,317.10 delegated COMP with a 77/77 record. Non-delegated whale concentration: refresh, Etherscan top-holders is a paid endpoint.
- Recent-news scan (since 2026-07-01): no new chains or markets. The comet repo has not committed since 23 June 2026 and the mainnet market set is unchanged (usdc, usds, usdt, wbtc, weth, wsteth). Movement is the other way: Mantle USDe deprecated 1 July (per Gauntlet), Polygon (USDC, USDT) and Unichain (USDC, WETH) proposed for deprecation 10 July with supply rates set to zero, and a 4 August proposal zeroing the supply-rate curve on Linea USDC, Linea WETH, Mantle USDe, Ronin WETH, Ronin RON and Scroll USDC, explicitly without forcing liquidations or restricting withdrawals. Also in window: rsETH offboarding proposals 8 and 12 July; a 15 July clarification that the $776,575.54 drained from BarnBridge SMART Yield's contract named "CompoundProvider" was a third-party adapter, not a Compound contract; COMP rewards moving to Merkl 17 July; and an independent collateral-policy review on 10 August recommending rsETH, deUSD and sdeUSD be delisted from the USDC Comet.
- Hacks list: DeFiLlama returns two rows matching "compound", but only one is attributable to this protocol: "Compound V2", 2021-09-29, $147,000,000, "Math Mistake Exploit", parentProtocolId
parent#compound-finance. That is the COMP rewards over-distribution and cost no depositor principal. The second row, "Compounder Finance" (2020-12-01, $12M, rugpull), is an unrelated protocol with no parent link to Compound and should not be counted against it.
Maintained monthly. Methodology: DeFi Research Instruction v2.