Compound V3

Identification — Compound V3 / Compound III (“Comet”)

• Website: https://www.compound.xyz/; documentation: docs.compound.finance; category: collateralized DeFi lending/borrowing money market. Comet uses one borrowable base asset per market—typically USDC—with separate collateral assets.
• Launch: August 26, 2022, initially on Ethereum with USDC as the base asset.
• Chains requested: Ethereum, Arbitrum, Base, OP Mainnet, Polygon, Scroll. The repository currently contains deployments for all six.
• Native/governance token: COMP (ERC-20); Comet is governed by COMP holders/delegates. Primary Comet proxy addresses *(USDC markets; repository deployment records)*:
• Ethereum: 0xc3d688B66703497DAA19211EEdff47f25384cdc3
• Arbitrum: 0x9c4ec768c28520B50860ea7a15bd7213a9fF58bf
• Base: 0xb125E6687d4313864e53df431d5425969c15Eb2F
• OP Mainnet: 0x2e44e174f7D53F0212823acC11C01A11d58c5bCB
• Polygon: 0xF25212E676D1F7F89Cd72fFEe66158f541246445
• Scroll: 0xB2f97c1Bd3bf02f5e74d13f02E3e26F93D77CE44 Cross-check / verification: The addresses are confirmed by Compound’s deployment repository and documentation’s deployment-artifact reference. Dune MCP was unavailable in this run: Not verifiable as of October 3, 2026 (Dune cross-check, query ID/execution ID, and raw on-chain block snapshot). Complete explorer verification status for every proxy, implementation, Configurator, and Rewards contract: Not verifiable as of October 3, 2026. Fork lineage: Comet is not a simple Compound V2 fork; it is Compound Labs’ third-generation redesign. Changes include single-base-asset markets, isolated collateral/liquidation accounting, new Comet proxy/Configurator architecture, and revised interest-rate mechanics. Auditing/formal review is evidenced by Certora and ChainSecurity reports. Malicious-modification history in similar forks: Not verifiable as of October 3, 2026.

Compound V3 looks like a mature, production DeFi app rather than a simple marketing landing page. The public docs describe real protocol interaction paths, including supply, withdraw, borrow, repay, and claim flows, and explicitly state that the v3 proxy is the only address to use for each Compound III instance. The protocol also exposes a developer-facing API with protobuf/JSON support and separate staging/production API keys, which is a strong sign of an open API surface.

The strongest verifiable maturity signal here is documentation and integration depth: third-party SDK/docs also map Compound V3 actions such as deposit, withdraw, borrow, and repay, which is consistent with a live protocol used by external applications. A separate filing states that the Foundation operates a front end at compound.xyz as of June 2026, supporting that the site is a real portal rather than a placeholder. What is not verifiable as of 2026-10-03 from the available web evidence is live deposit/withdrawal behavior on the site itself, broken-link status, fake-metric detection, or template-sign analysis.

No contradictory evidence was found in the gathered sources, but those UI-level checks remain unconfirmed. ## Conclusion

• Real portal: yes, supported by docs and a disclosed front end.
• Product maturity: high, with documented supply/borrow/repay/withdraw flows and third-party integrations.
• Open API: yes, documented publicly with JSON/protobuf support.
• Live UI checks and template/broken-link screening: Not verifiable as of 2026-10-03.

Compound V3 has an active bug bounty program on Immunefi. It launched on 2024-12-11, is triaged by Immunefi, requires PoC, and requires KYC. The published scope is mainnet-only; testnet components are out of scope.

Reward tiers published publicly are: Low $1,000, Medium $5,000, High $10,000–$50,000, and Critical up to $1,000,000 (also described as 10% of directly affected funds, capped at $1,000,000). Rewards are denominated in USD and paid in COMP through the Compound DAO.

Assessment as of October 5, 2026: HIGH external-dependency sensitivity; no confirmed active loss event was identified in reviewed sources, but current on-chain status is Not verifiable as of October 5, 2026 because Dune was unavailable. • Stablecoins/issuers: Compound V3 is materially dependent on USDC, USDT and USDS markets, with additional USDbC and USDe deployments listed in available market documentation. This creates issuer reserve, redemption, blacklist/freeze and depeg risk. USDC.e/USDbC add provenance and bridge-wrapper risk.

Current balances and exposure percentages by chain are Not verifiable as of October 5, 2026. • Collateral/LST exposure: Ethereum deployments list WETH, WBTC and wstETH among supported collateral; losses can arise from LST depeg, staking-provider failure, liquidity fragmentation or liquidation slippage. Exact current LST/LRT exposure is Not verifiable as of October 5, 2026. • Oracles/manipulation: Comet relies on Chainlink price feeds. The ChainSecurity audit explicitly notes that oracle correctness was out of scope and records a risk-accepted issue: timestamps were not checked, allowing stale prices to affect borrowing and liquidations.

False oracle prices remain a primary risk vector. • Bridges and chain dependencies: Arbitrum, Base, OP Mainnet, Polygon and Scroll introduce dependence on each chain’s bridge, sequencer/validator, canonical token contracts and liquidity. Native-versus-bridged asset distinctions are deployment-specific; bridge provenance and per-chain concentration are Not verifiable as of October 5, 2026. • Governance/custody/market makers: Compound V3 has upgradeable proxies; governance can pause functions, withdraw reserves and authorize upgrades. The audit describes governance as fully trusted and theoretically capable of stealing funds through reserve withdrawal, approvals or malicious upgrades.

No verified CEX, custodian, RWA issuer/SPV or market-maker concentration was found. Those exposures are Not verifiable as of October 5, 2026. Failure scenarios: stablecoin depeg/issuer insolvency; stale or manipulated oracle prices; bridge or canonical-token failure; LST depeg; chain outage; governance compromise; or insufficient liquidation liquidity causing bad debt. Contradiction callout: Protocol/UI market figures are not raw on-chain verification; no Dune query or execution ID was available. On-chain exposure percentages therefore cannot be confirmed. Fields: dependency_failure_active=null; max_exposure_pct=null.

Compound V3 is organized as a non-custodial, smart-contract-based lending protocol: users deposit into Comet markets and the protocol contracts hold and account for those assets rather than a centralized custodian. Its design uses a single borrowable base asset per market with collateral held in the same protocol layer, and the code/docs show withdrawals are controlled by protocol rules and can be paused by governance or the pause guardian. I could not verify on-chain chain-by-chain custody splits, universal current withdrawal status, or any segregated-assets claim, so those fields are Not verifiable as of 2026-10-05.

Assessment — key management (reviewed October 3, 2026): Compound V3 does not rely on one operator key. Control is split across: 1. COMP governance and Governor/Timelock. COMP holders and delegates approve administrative actions. The Ethereum Mainnet Timelock is documented as administrator of Compound III deployments, controlling proxies, the Configurator, Comet factory, and Comet implementations.

Parameter changes and upgrades therefore follow the governance-execution path rather than direct team-wallet control. 2. Cross-chain execution controls. Non-Ethereum deployments use a bridge receiver and a chain-local Timelock. Governance messages originate from Ethereum Mainnet, and the local Timelock adds an additional delay before Comet administration executes.

This architecture is documented for Compound III deployments generally, including the chains in scope; the live administrator addresses and current state for Arbitrum, Base, Ethereum, OP Mainnet, Polygon, and Scroll are Not verifiable as of October 3, 2026 because Dune/on-chain verification was unavailable. 3. Emergency Pause Guardian. COMP governance designates the Pause Guardian, held by a Community Multi-Sig. It can pause supply, transfers, withdrawals, absorption, and collateral purchases; both the Governor and Pause Guardian are authorized to invoke the pause function.

4. Multisig operating model. OpenZeppelin’s current Compound security-policy repository describes dedicated Gnosis Safe pause-guardian multisigs per network, with a stated 4-of-6 threshold and signers drawn from Gauntlet, protocol contributors, and community members. It also states that the V3 pause-guardian multisig can directly unpause without a governance proposal. This is an operational-policy source, not an on-chain confirmation of every current Safe or signer set.

5. User-level delegated keys. Individual Compound III accounts may authorize other addresses as account managers through allow or allowBySig. These managers can withdraw or transfer collateral on behalf of the account, subject to the protocol’s permission checks. Risk conclusion: governance and upgrades are concentrated in Timelock-controlled administration, while incident response is delegated to chain-specific multisig Pause Guardians. The principal unresolved diligence item is the current, chain-by-chain administrator, Safe address, signer roster, threshold, and bridge/local-Timelock state: Not verifiable as of October 3, 2026.

Assessment date: October 5, 2026. Scope: Compound III/Comet, not Compound v2. Dune MCP was unavailable; therefore deployed proxy-admin ownership, decoded admin events, role holders, timelock delay, and current pause state are Not verifiable as of October 5, 2026. Addresses (Comet proxy / Configurator): Ethereum 0xc3d688B66703497DAA19211EEdff47f25384cdc3 / 0x316f9708bB98af7dA9c68C1C3b5e79039cD336E3; Arbitrum USDC.e 0xA5EDBDD9646f8dFF606d7448e414884C7d905dCA / 0xb21b06D71c75973babdE35b49fFDAc3F82Ad3775; Base 0xb125E6687d4313864e53df431d5425969c15Eb2F / 0x45939657d1CA34A8FA39A924B71D28Fe8431e581; OP Mainnet 0x2e44e174f7D53F0212823acC11C01A11d58c5bCB / 0x84E93EC6170ED630f5ebD89A1AAE72d4F63f2713; Polygon 0xF25212E676D1F7F89Cd72fFEe66158f541246445 / 0x83E0F742cAcBE66349E3701B171eE2487a26e738; Scroll 0xB2f97c1Bd3bf02f5e74d13f02E3e26F93D77CE44 / 0xECAB0bEEa3e5DEa0c35d3E69468EAC20098032D7. Repository deployment manifests identify these contracts. Architecture: TransparentUpgradeableProxy → Comet implementation; proxy admin is CometProxyAdmin (OpenZeppelin-style), with owner plus marketAdmin authorization for deployAndUpgradeTo / upgradeToAndCall.

Configurator controls governor, pause guardian, oracle, collateral factors, caps, rates, rewards, and reserve withdrawal. Compound documentation states governance Timelock controls proxies, Configurator, factory, and implementations. COMP Governor → Timelock → CometProxyAdmin / Configurator → Comet proxy → implementation Risk: upgradeable=true. admin_can_drain=true on a conditional architectural basis: a compromised authorized market-admin/owner path could install malicious implementation logic; the deployed permission configuration is Not verifiable as of October 5, 2026. Governor can withdraw reserves; pause guardian/governor can pause withdrawals, creating freeze risk.

Users can normally withdraw without admin, subject to liquidity and pause flags; no unconditional exit guarantee. Oracle replacement and collateral/risk-parameter changes can cause liquidation or insolvency. Timelock delay: Not verifiable as of October 5, 2026.

OpenZeppelin audited Compound III, but audit coverage does not prove every current deployment is audited. Unresolved findings: Current deployment-specific critical/high status is Not verifiable as of October 5, 2026.

Compound V3 (Comet) audit and formal verification

Certora provided formal verification services for Compound III, specifying and checking protocol invariants (e.g., safety of liquidations, collateralization and rewards logic) using Certora’s verification framework.

V3 Extended Pause

V3 Governor Whitelist

CAPO for rETH

Compound III / Comet security audit

ChainSecurity is cited by Compound as having performed audits for Compound III / Comet components, particularly around risk and liquidation mechanics.

Checkpoints audit report; file DeFi/stablecoin/contracts/lib/openzeppelin-contracts/audits/2022-10-Checkpoints.pdf in fullstack-development/blockchain-wiki-en (protocol audit catalog).

New published Certora audit report: Compound BytecodeRepository.

Newly recorded OpenZeppelin Compound III audit report. The audit reviewed the Comet repository at commit 0f1221967149115f50a09681eea9580879ee7720 and covered Comet, Bulker, Configurator, CometFactory, rewards, proxy and related contracts.

New published Certora report: 1Delta Compound Integration. The audit covers 1Delta’s Compound V2 and Compound V3 integration, including CompoundV2Lending.sol and CompoundV3Lending.sol. It is an integration audit rather than a direct audit of Compound V3 core contracts.

New published Certora audit report: Compound Treasury Manager.

ERC4626 audit report; file DeFi/stablecoin/contracts/lib/openzeppelin-contracts/audits/2022-10-ERC4626.pdf in fullstack-development/blockchain-wiki-en (protocol audit catalog).

OpenZeppelin performed security audits for Compound III (a.k.a. Compound v3, “Comet”), covering core protocol contracts prior to and around mainnet launch.

OpenZeppelin performed a security audit of Compound III (Comet) core contracts prior to mainnet launch; report covers architecture, core protocol logic, risk parameters, pausing and governance integration.

OpenZeppelin performed multiple security audits for Compound III (aka Compound V3), focused on the new Comet contracts and associated configuration, including upgrades and governance integration. The main public report is the "Compound III Audit" on OpenZeppelin’s site.

Trail of Bits conducted an earlier security assessment of Compound protocol components which informed the design and security posture of Compound III, focusing on economic security and smart‑contract invariants.

Trail of Bits conducted security audits of Compound v3/Comet smart contracts focusing on correctness, safety, and robustness of the protocol.

Trail of Bits conducted a security assessment for Compound III/Comet, focusing on smart contract safety, protocol invariants, and upgrade/governance risks.

v4.9 audit report; file DeFi/stablecoin/contracts/lib/openzeppelin-contracts/audits/2023-05-v4.9.pdf in fullstack-development/blockchain-wiki-en (protocol audit catalog).

v5.0 audit report; file concepts/auctions/contracts/lib/openzeppelin-contracts/audits/2023-10-v5.0.pdf in fullstack-development/blockchain-wiki-en (protocol audit catalog).

Assessment (as of 3 October 2026): Compound V3 is attributable to Compound Labs, Inc., not an anonymous deployment. The protocol’s principal founders are Robert Leshner and Geoffrey (Geoff) Hayes. Leshner is widely identified as founder/CEO and Hayes as co-founder/CTO; both have public professional profiles and are associated with the 2017 incorporation and subsequent development of Compound.

• Founder background: Leshner previously worked in web development and financial-market analysis; Hayes is described as a programmer/engineer. Both reportedly worked at Postmates before Compound. Hayes also has an independently documented Ethereum open-source background through Exthereum, a prior technical project.
• Current leadership caveat: Robert Leshner reportedly left Compound Labs in 2023 to found Superstate. Therefore, historical founder identity should not be treated as proof that he remains operationally responsible for Compound V3.
• Prior outcomes and incidents: Compound has operated since the 2017–2018 period and became a major DeFi lending protocol, but its history includes material failures. In 2021, a governance-upgrade bug exposed roughly $162 million in COMP to erroneous distribution; public reporting said approximately $38.7 million was returned at the time. A later Compound transparency filing also identifies a 2023 Base WETH Comet rounding issue and a 2024 governance attack involving a $24 million treasury allocation. These are meaningful governance, upgrade, and smart-contract risk indicators rather than evidence of founder anonymity.
• Public vs. anonymous: The founders are public and identifiable. Public biographies, company records, legal filings, and professional profiles provide overlapping attribution.
• Corporate reality and location: Sources identify Compound Labs as incorporated in California and headquartered in San Francisco, with a real corporate presence rather than only a pseudonymous web front. The California registration and office claims are supported by secondary corporate databases and legal records, but a current independently verified office lease or operating footprint was not established in the available evidence.
• Onshore/offshore: The available evidence supports a U.S./California corporate nexus. Exact current operating entities, subsidiaries, tax residence, and any offshore structure: Not verifiable as of 3 October 2026.
• Business reality: Compound is demonstrably an operating open-source DeFi protocol with governance, deployed contracts, a documented development company, audits/security programs, and a substantial incident history—not merely a marketing website. However, current Compound Labs staffing, revenue, office occupancy, and day-to-day control after Leshner’s departure: Not verifiable as of 3 October 2026. Contradiction / limitation: Some secondary sources continue to describe Leshner as current CEO, while newer material states he departed in 2023. The departure finding is more decision-relevant and should be treated as the current-status caveat. On-chain verification was unavailable for this review; therefore no claims about current Compound V3 chain exposure, TVL, or governance holdings are made.

Compound V3 has a generally established reputation and substantial security-review history, but its risk profile is not clean. The strongest documented concerns are inherited from the broader Compound protocol: governance and upgrade risk, the 2021 COMP-distribution failure, the 2024 treasury-governance controversy, and continuing dependence on third-party audits rather than formal guarantees. Security and auditors. Compound’s security documentation states that the protocol has been reviewed by Trail of Bits and OpenZeppelin and formally verified by Certora; this is a protocol-source claim and should be treated as an unverified marketing claim unless independently confirmed. Independent coverage describes Compound as having ongoing reviews involving OpenZeppelin, Trail of Bits, Certora, and ChainSecurity, while identifying oracle and market-liquidity risk as important V3 concerns.

The search results do not establish that every deployed Compound V3 market or chain in scope received the same audit coverage. Not verifiable as of October 10, 2026. Historical incidents and criticism. In 2021, governance Proposal 62 introduced a COMP-reward accounting/distribution bug that exposed roughly $150 million of COMP according to a later transparency filing; this was a governance/deployment failure rather than evidence of founder fraud. A contemporary Compound governance discussion characterized the incident as approximately $50 million lost and emphasized process and audit shortcomings.

These figures conflict; the difference likely reflects timing and valuation/scope, but the exact reconciled loss is Not verifiable as of October 10, 2026. In July 2024, Proposal 289 transferred 499,000 COMP—reported at approximately $25 million—to an address associated with the goldCOMP ecosystem, prompting allegations of a governance attack and major community criticism. The search results report that the dispute later settled, but do not provide independently verified settlement terms.

A 2026 legal report identifies litigation by Celsius’s administrator against Compound Labs and others concerning assets posted as collateral; the result confirms the proceeding, not liability or wrongdoing. Fraud, rug, insolvency, sanctions. No reliable result supplied here establishes a Compound V3 rug pull, founder fraud conviction, insolvency, or sanctions designation. Not verifiable as of October 10, 2026. The available evidence supports governance, smart-contract, oracle, upgradeability, and legal-contingency concerns—not a substantiated fraud or rug-pull finding.

Economic model — Compound V3 (as of 10 October 2026) Strategy/assets: Isolated, single-base-asset money markets (“Comets”). Users supply the base asset to earn floating interest or supply approved collateral assets to borrow the base asset. Collateral assets do not earn protocol interest.

Yield is generated by borrower interest and utilization-driven rate curves; this is primarily organic lending yield, not an automated external strategy. Risk profile: The protocol itself is neither market-neutral nor directional: suppliers have base-asset interest-rate/liquidity exposure, while borrowers can create directional, short, or leveraged positions. Looping is possible through repeated supply/borrow transactions, but is not native auto-compounding, restaking, or external-protocol exposure. A verified aggregate leverage ratio is Not verifiable as of 10 October 2026. Withdrawals/constraints: No protocol lock-up is documented; users withdraw via withdraw, subject to available liquidity, collateralization, supply caps, and—when initiating a borrow—the market’s baseBorrowMin.

Borrow positions can be liquidated when liquidation collateral factors are breached. Fees/gates: transaction gas applies; governance-controlled supply caps, borrow minimums, collateral factors, and reserve parameters are material limits. Rewards and sustainability: Base-asset APY is organic interest income. Additional token incentives, where enabled, are subsidy-dependent and require a configured baseMinForRewards; their current magnitude by market is Not verifiable as of 10 October 2026.

Current DeFiLlama snapshots show average supply APY of 1.95% across 16 tracked pools; individual pools differ materially (e.g., 3.23% on an OP USDC pool), so APY history/volatility and long-term sustainability are Not verifiable as of 10 October 2026. Revenue: DeFiLlama reports 30-day fees of $2.39m and protocol revenue of $242,465, with cumulative revenue of $651,193 in its current dataset. Reserves accrue mainly from the spread between borrower and supplier interest and can be withdrawn by governance. TVL: DeFiLlama reports $1.507bn total TVL: Ethereum $1.39bn (92.2%), Arbitrum $71.72m (4.8%), Base $27.2m (1.8%), OP Mainnet $9.92m (0.7%), Polygon $4.76m (0.3%), Scroll $112k (<0.1%). These six chains represent ~99.8%; DeFiLlama also tracks four additional chains.

TVL is up 9.9% over 30 days. Dune comparison is Not verifiable as of 10 October 2026. Contradiction: The supplied chain list omits four chains included by DeFiLlama; therefore “total” TVL cannot be interpreted as only the six requested chains.

As of October 5, 2026, Dune was unavailable; therefore on-chain reserve balances, USD valuation, latest block/as-of snapshot, execution IDs, and verified contract or treasury-wallet addresses are Not verifiable as of October 5, 2026. This applies separately to Arbitrum, Base, Ethereum, OP Mainnet, Polygon, and Scroll. Structure and composition: Compound V3 reserves are maintained inside each Comet market, not necessarily in a single treasury wallet. They consist of base-asset reserves and collateral-asset reserves.

Reserves accrue primarily from the spread between borrower interest and supplier interest, and liquidation activity can reduce or add to reserves. Comet exposes getReserves(), getCollateralReserves(asset), and targetReserves(). Control and custody: Compound III markets are governed through the Compound Timelock/Governor system. Governance may set target reserves and may call withdrawReserves(to, amount); only the Governor can withdraw base-asset reserves.

The Pause Guardian can pause specified market functions but is not documented as a reserve custodian. DAO treasury versus protocol reserves: A 2026 governance proposal estimated approximately $120 million of DAO treasury assets, including $80–90 million in stablecoins, plus COMP, ETH, and BTC. It proposed a $30 million initial treasury-management envelope and a dedicated multisignature wallet under Treasury Management Committee oversight. These are governance estimates/proposals, not verified Comet reserve balances; implementation, current holdings, custody addresses, and approval status are Not verifiable as of October 5, 2026. Cross-check: DeFiLlama reports approximately $1.507 billion of Compound V3 TVL, including Ethereum, Arbitrum, Base, OP Mainnet, Polygon, and Scroll, but explicitly treats this as supplied/collateralized TVL—not reserves.

It must not be substituted for reserve size. Attestations: No reserve attestation or proof-of-reserves report specifically covering Compound V3 reserves was verified. Not verifiable as of October 5, 2026.

Tokenomics — Compound V3 (as of October 3, 2026)

• Native token: Compound V3 has no separate native token; it uses COMP (Compound), the legacy Compound governance token. Ethereum contract: 0xc00e94Cb662C3520282E6f5717214004A7f26888. Chain-specific bridged COMP addresses on Arbitrum, Base, OP Mainnet, Polygon and Scroll: Not verifiable as of October 3, 2026.
• Supply / valuation: Maximum and total supply are 10,000,000 COMP. CoinGecko reports approximately 10,000,000 circulating, with market cap and FDV both about $255.8 million. Etherscan’s indexed figure is lower—9,668,189 circulating—creating a data-source discrepancy. > Contradiction: circulating supply is reported as either 9.668M or 10M. Without raw on-chain/Dune reconciliation, use 10M as the aggregator headline figure, but treat effective float as uncertain.
• Utility/governance: COMP holders and delegates propose, vote on and execute protocol changes through Compound governance and its Timelock; Compound V3 parameters and upgrades are governed this way. COMP is not designed as an automatic claim on protocol revenue.
• Revenue share, buybacks, burns, staking: No verified revenue-share, buyback, or burn mechanism was identified. No current native COMP staking-reward program was verified. Not verifiable as of October 3, 2026 for any newly approved mechanism.
• Emissions/unlocks: Initial allocation: users 42.30%, Compound Labs shareholders 23.96%, founders/team 22.26%, future team 3.73%, community governance 7.75%. Historical user incentives were distributed from a Reservoir contract; the published vesting schedule is reported as complete by 2024. Whether every announced unlock occurred on-chain: Not verifiable as of October 3, 2026.
• Concentration/insiders: Ethereum top-100 concentration is reported at roughly 85%, but exchange, bridge, treasury and contract wallets are not reliably separable from insiders. Insider-wallet attribution: Not verifiable as of October 3, 2026.
• Mint/blacklist/fees: Fixed 10M supply is documented; current mint authority, blacklist capability, fee switch and controller privileges: Not verifiable as of October 3, 2026.
• DEX liquidity/listings: COMP trades principally on major CEXs and Ethereum DEX venues including Uniswap; current chain-by-chain liquidity depth and main-pair reserves: Not verifiable as of October 3, 2026.

Stress conclusion: A Bitcoin price below $10,000 would be a severe stress event for Compound V3 markets with WBTC exposure, potentially triggering broad liquidations. A protocol-wide or chain-by-chain loss estimate for Arbitrum, Base, Ethereum, OP Mainnet, Polygon, and Scroll is Not verifiable as of October 3, 2026 because on-chain verification is unavailable in this run. Compound V3 uses separate markets with one borrowable base asset per market.

When an account breaches its liquidation collateral factor, anyone can call absorb; the protocol takes the collateral, covers the debt from reserves, and later sells the collateral. The borrower receives the collateral value less the liquidation penalty. The key risk is therefore not only the BTC price decline, but also liquidation execution and market depth.

Gauntlet’s analysis identifies the liquidation penalty and StoreFront Price Factor as more important insolvency buffers than the liquidation factor, because the protocol must sell absorbed collateral at a discount. An extreme BTC fall could create simultaneous WBTC liquidations, reserve drawdowns, collateral-sale slippage, and bad debt if liquidation proceeds are insufficient. The scenario is especially material where WBTC is accepted as collateral and where WBTC liquidity is thin relative to absorbed positions.

Current WBTC collateral balances, borrow exposure, liquidation thresholds, reserve coverage, absorbed accounts, and exposure percentages by chain are Not verifiable as of October 3, 2026. Risk assessment: High/severe tail risk, but not quantifiable from the available evidence. The correct institutional stress test should model at least: (1) WBTC falling below $10,000; (2) liquidation-factor-triggered account absorption; (3) liquidation penalties and storefront discounts; (4) execution slippage and liquidation delays; (5) protocol reserve depletion; and (6) contagion across independently deployed markets. Historical or generic Compound V3 parameters cannot be assumed to represent the current deployment configuration. Contradiction check: No current on-chain figure was available to compare against previously reported TVL, collateral, debt, or treasury claims; therefore no numerical contradiction can be established.

The previously recorded finding remains valid: the available evidence explains the liquidation mechanism but does not establish a protocol-wide loss estimate.

Stress conclusion: a 20% depeg of the largest collateral is a material reserve and liquidity stress, not automatically protocol insolvency. Compound v3 makes accounts liquidatable when debt exceeds the liquidation-collateral-factor limit; absorb() transfers the entire position to the protocol, settles debt from base-asset reserves, and leaves the collateral for subsequent sale. For a direct 20% price shock, the previously identified Compound governance review reports a modeled cumulative impact of -$957,332.23 under its “20 Percent Decrease” scenario.

This is protocol-specific evidence, but it is dated 2024 and does not establish that the same dollar loss applies to today’s markets, collateral composition, or chain distribution. The result should therefore be treated as a historical scenario, not a current exposure estimate. The key transmission mechanism is:

• The depeg pushes leveraged accounts beyond liquidation thresholds.
• absorb() socializes their base-asset debt onto the protocol balance sheet and consumes reserves.
• The protocol must sell the absorbed collateral; liquidation penalties and the Store Front Price Factor reduce recoverable value.
• If reserves are depleted or collateral sales are slow, utilization and withdrawal/liquidity stress can rise; the 2024 review explicitly identifies this as a potential liquidity-crisis or bank-run risk. Assessment: High severity for the affected market and potentially medium-to-high systemic severity for Compound v3, depending on reserve coverage, borrower leverage, collateral concentration, and sale liquidity. A 20% depeg is especially adverse where positions are close to liquidation thresholds, because Compound v3 absorbs positions wholesale rather than performing a partial liquidation. Current verification limits: Current largest-collateral identity, balances, reserves, borrower concentration, liquidation queue, and exposure percentages by Arbitrum, Base, Ethereum, OP Mainnet, Polygon, and Scroll: Not verifiable as of October 3, 2026. On-chain verification was unavailable for this run, so no current TVL or chain-weighted loss estimate is asserted. The 2024 modeled loss is stale for current-state risk measurement. Contradiction / data-quality note: A search result describes Compound v3 as using gradual partial unwinds, but Compound’s liquidation documentation and protocol-specific review state that absorb() takes over the entire collateral position. The latter sources are more directly relevant to Compound v3’s documented mechanism; the partial-unwind description is not relied upon.

Assessment (verified mechanics; current exposure not verified): The prior finding remains directionally correct: a top borrower’s insolvency is absorbed first by the affected Compound V3 market’s reserves and ultimately by base-asset suppliers if recovery is insufficient. The specific top borrower, debt size, reserve buffer, and exposure percentage on Arbitrum, Base, Ethereum, OP Mainnet, Polygon, and Scroll are Not verifiable as of October 3, 2026 because Dune is unavailable. Expected loss path 1. Trigger: collateral falls below the market’s liquidation collateral factor; isLiquidatable() becomes true. The position is isolated to that Comet deployment and its single borrowable base asset.

2. Absorption: a liquidator calls absorb(). Comet takes the borrower’s collateral, repays/reduces the borrower’s debt using protocol reserves, and records the resulting supply/borrow changes. If collateral value is below debt, the deficit is charged to reserves.

3. Recovery: the protocol holds the seized collateral. A buyer calls buyCollateral(), paying base tokens into Comet; this replenishes reserves. The sale is discounted, so liquidation slippage/penalty is an additional loss relative to oracle value.

4. Residual loss: if reserves plus recovered collateral are insufficient, suppliers bear the economic loss through impaired redeemability / reduced market solvency. There is no documented external insurance or Compound treasury backstop in the cited mechanics. Who absorbs it / compensation

• First loss: Comet reserves, funded primarily by the borrower–supplier interest spread and prior liquidation economics.
• Operational compensation: the absorber receives a gas-based incentive; collateral buyers receive the storefront discount.
• Ultimate loss: base-asset suppliers in that market—not suppliers on other chains, assuming deployments remain separate. Smart-contract impact: borrower debt is removed/reduced; collateral moves to the protocol; totalBorrowBase, totalSupplyBase, and reserves change; buyCollateral() transfers base asset in and collateral out. Governance can pause absorption/buying and set target reserves, creating liquidation-delay risk. Stress caveat: an open 2026 code issue reports a configuration combination that can make collateral quoting/sales revert; whether any listed production market has that configuration is Not verifiable as of October 3, 2026.

Assessment: elevated governance-abuse exposure; no confirmed owner/DAO fraud established by the available evidence. Compound V3 should be stress-tested for a scenario in which a concentrated voting bloc uses DAO governance to redirect treasury assets or obtain control over governance. The key precedent is Proposal 289, which passed narrowly in July 2024 with 682,191 votes for and 633,636 against and sought to allocate 499,000 COMP—about $24–25 million at the time, or approximately 5% of the treasury—to a yield-bearing goldCOMP structure controlled by or associated with the Golden Boys. Independent reporting characterized the episode as a suspected or alleged governance attack rather than a proven contract exploit or adjudicated fraud.

The proposal was subsequently agreed to be rescinded in exchange for a revised staking arrangement, reducing the immediate loss scenario; therefore, the event is best recorded as attempted governance capture / treasury-diversion risk, not confirmed permanent theft. The narrow vote also demonstrates that a relatively small voting bloc can potentially approve material treasury actions when participation is concentrated. Stress implications

• Model a hostile delegate or coordinated token holders obtaining sufficient voting power to pass a treasury-transfer proposal.
• Include loss of treasury COMP, governance influence, and follow-on proposal risk if transferred tokens are used for voting.
• Treat owner misconduct separately: no reliable evidence in the reviewed results establishes fraud by Compound owners or core maintainers.
• A DAO-approved transfer can be economically harmful even if technically authorized; legal fraud remains unproven on the available evidence. Verification limits: On-chain confirmation of the transfer, current treasury balances, cross-chain exposure, and whether any newer comparable incident occurred was not available in this run. Not verifiable as of October 3, 2026. The protocol’s own governance documentation and forum material should be treated as lower-priority corroboration, not independent proof.

Assessment: A negative 30-day primary yield for Compound V3 is not verifiable as of October 3, 2026. The available evidence shows positive current or recent supply yields, but does not provide a reliable chain-by-chain 30-day realized-yield series for Arbitrum, Base, Ethereum, OP Mainnet, Polygon, and Scroll. Compound V3’s primary yield source is base-asset lending interest.

Supply rates are determined by utilization through a supply-rate model; borrowers follow a separate borrow-rate model, with governance-defined kinked curves. Therefore, a negative 30-day lending yield would require realized supplier returns to be below zero over the period, not merely a lower or near-zero APY. The available mechanics do not establish that outcome.

Recent third-party rate data instead reports positive supply APYs, including approximately 2.76%–6.19% across selected Compound V3 markets and chains, but this is a point-in-time/aggregated observation rather than a verified 30-day return calculation. DeFiLlama results also show Compound V3 TVL and an average APY, but they do not establish a negative 30-day primary yield for every specified chain. Stress interpretation if the scenario occurs:

• Supplier economics deteriorate, potentially causing withdrawals and liquidity contraction.
• Low utilization would normally reduce supply income under the utilization-based model; however, a negative realized yield would require additional factors such as asset-price loss, incentives turning negative, fees, or accounting effects—not demonstrated by the available sources.
• The impact must be assessed separately by chain and market; a protocol-wide negative figure cannot be inferred from one deployment. Contradiction check: No directly comparable protocol claim of negative 30-day yield was found. Current/recent aggregator observations are positive, but they do not answer the required historical stress test. On-chain verification is unavailable for this run. Required conclusion: Not verifiable as of October 3, 2026.

As of October 13, 2026, Compound V3 has executable COMP-holder governance, not merely symbolic DAO control. The Ethereum Governor/Timelock controls Comet proxies and implementations, the Configurator, factory, market parameters, and reserve withdrawals. Governance flow is proposal delay/review, voting, queueing, then Timelock execution; the documented baseline is 2 days proposal delay, 3 days voting, and 2 days Timelock delay (48 hours).

Non-Ethereum deployments use Ethereum governance messages plus bridge receivers and local Timelocks; exact local delays are Not verifiable as of October 13, 2026. Centralization finding: a separate marketAdmin path can propose and execute material market-parameter and Comet-upgrade changes without a community vote after its Timelock delay. Governance and guardian roles can pause/cancel this path, but the audit states governance may be unable to react before execution.

The v3 pause-guardian multisig can also directly unpause without a DAO vote. This makes DAO control real for core administration, but not exclusive for expedited market updates. The documented pause-guardian Safe is 4-of-6, with six listed signers: Paul L.

(Gauntlet), 0age (OpenSea), arr00, blck, Jared F., and TennisBowling. The groups are mixed, but complete independence is Not verifiable as of October 13, 2026. Frontend deployment remains operationally controlled by Compound contributors/team: merged releases are deployed to IPFS and the app redirect is updated by a Compound team member.

Voting concentration and COMP top holders via Dune are Not verifiable as of October 13, 2026. Compound Labs/Foundation legal entity, jurisdiction, registration number, directors, and applicable consumer ToS for this protocol are Not verifiable as of October 13, 2026. CONTRADICTION: the previous record marked admin_can_drain=true.

Current evidence says reserve withdrawal is restricted to the Governor, while the marketAdmin evidence covers parameter changes/upgrades—not direct user-fund withdrawal. Therefore admin_can_drain=false under the supplied definition; the marketAdmin/emergency-bypass risk remains material.

As of 2026-10-03 — Legal & Regulatory

• Entity / jurisdiction: Compound Labs, Inc. is described in federal litigation as a Delaware corporation and the developer of Compound/Comet. Compound v3 itself is software governed through COMP-holder governance, timelocks and cross-chain administration; no separate incorporated “Compound v3” entity was identified. The DAO’s independent legal status remains contested.
• ToS / restrictions: The web app requires acceptance of Compound’s Terms of Service. The published security-program rules exclude sanctioned persons and persons in U.S.-embargoed countries, but this is not equivalent to a protocol-wide KYC/AML regime.
• KYC/AML and data protection: No verified, v3-specific customer-identification, AML, or comprehensive privacy-policy framework was located. Not verifiable as of 2026-10-03. The protocol operates through wallet addresses and smart contracts; front-end, RPC, analytics, and third-party service providers may impose separate controls.
• Regulatory classification: No binding regulator determination classifying Compound v3, Comet, COMP, or the DAO as a security, commodity, bank, money transmitter, or lending institution was identified. Not verifiable as of 2026-10-03.
• Warnings / enforcement: No regulator enforcement action specifically against Compound Labs, Compound DAO, or Compound v3 was identified in the reviewed SEC/OFAC materials. Accordingly, active_enforcement: false. This does not exclude future or non-public investigations.
• Court cases: (1) *True Return Systems v. Compound Protocol*—a patent-infringement case; the court allowed Compound Labs to intervene, reflecting uncertainty over whether the software/DAO was a suable legal person. (2) *Meghji v. Compound Labs*—Celsius-related litigation. On March 4, 2026, the court dismissed claims against Compound DAO and several individual defendants, dismissed securities and malpractice counts, but allowed parts of negligence and negligent-misrepresentation claims against Compound Labs to proceed.
• Sanctions: No evidence was found that Compound Labs, Compound DAO, or Compound v3 is itself designated under OFAC sanctions. sanctioned: false. Address blocking or sanctions screening by interfaces is not entity designation. Risk conclusion: The principal legal risk is not a clearly regulated operating entity; it is attribution risk—courts or regulators may look through the software/DAO structure to Compound Labs, governance participants, developers, or front-end operators. Protocol decentralization therefore does not eliminate U.S. litigation, securities, AML, sanctions, consumer-protection, or data-protection exposure. On-chain verification: Not verifiable as of 2026-10-03.

Legal entity per GLEIF: Compound Labs, Inc. (LEI 254900EJ70SFKKJDUH92; jurisdiction US-DE; registration ACTIVE). OFAC SDN screening of 'Compound Labs Inc', 'Compound DAO', 'Compound V3': no match. SEC litigation and administrative release feeds: no mention.

Compound V3 does not issue its own stablecoin; it uses external base assets, with USDC documented as the initial base asset for the v3 launch and later deployments also using other third-party stablecoins on some chains. A stablecoin depeg history for the Compound V3 base asset set is not verifiable as of 2026-10-05 from the available sources here, so depeg_count, max_depeg_pct, last_depeg_date, and stable are all not verifiable as of 2026-10-05. The stablecoin_ids field should therefore remain as USDC.

The previously recorded five-risk profile remains materially supported by the available audit and protocol documentation: implementation, oracle/liquidation, governance, cross-chain, and liquidity/reserve risks. Audits and documented emergency controls reduce exposure but do not eliminate it; current chain-level TVL, concentration, utilization, reserve coverage, and deployment configuration are Not verifiable as of October 5, 2026 because on-chain verification was unavailable.

Compound V3’s top strengths are: 1) a single-borrowable-asset design per market, which simplifies borrowing and reduces complexity; 2) strong risk isolation, because each market is independent and losses do not easily contagion-spread across assets; 3) a more controlled liquidation model, with positions unwound more gradually rather than through abrupt, all-at-once liquidations; 4) lower gas and operational complexity due to the streamlined Comet architecture; and 5) improved user/account management through delegation and permissioning features that support more integrated DeFi workflows. These strengths are consistently described across independent protocol analyses and Compound’s own documentation, with the core architectural idea remaining the same across deployments on Ethereum, Base, Arbitrum, OP Mainnet, Polygon, and Scroll. Not verifiable as of 2026-10-03: on-chain deployment-specific quantitative validation was not checked in this run.