Compound V3

Compound V3 (aka Comet) is the third version of the Compound lending protocol, a permissionless collateralized lending/borrowing protocol focused on a single borrowable asset per market (mostly USDC). It runs on Ethereum, Arbitrum, Base, Optimism (OP Mainnet), Polygon, Scroll. Basic identification

• Name: Compound Finance V3 / Compound Comet
• Website: compound.finance (V3 app at app.compound.finance)
• Docs: docs.compound.finance (V3 section “Comet”)
• Category: DeFi lending/borrowing protocol (money market).
• Launch date (V3 mainnet): Compound announced V3 (“Comet”) and Ethereum mainnet deployment in August–September 2022.
• Chains: Ethereum, Arbitrum, Base, Optimism, Polygon, Scroll (multiple sources list V3 markets across these L2s).
• Native token: COMP (same governance token as V2). Main contract / market addresses (Ethereum, USDC market) Because Dune MCP is unavailable, on‑chain verification cannot be done; all addresses below are Not verifiable as of 2026‑09‑03.
• Ethereum USDC Comet (cUSDCv3) core market contract is reported around address 0xc3d688B66703497DAA19211EEdff47f25384cdc3 on multiple analytics and explorer references, but this cannot be on‑chain verified here.
• Each chain has its own Comet market contracts (e.g. Arbitrum USDC, Base USDC) referenced in explorers and analytics, but again: Not verifiable as of 2026‑09‑03.
• Explorer widgets typically show these contracts as verified (source-code verified on Etherscan and equivalents), but this too is Not verifiable as of 2026‑09‑03 without direct explorer access. Fork lineage and design changes
• V3 is not a fork of an external project; it is an in‑house evolution of Compound V2.
• Key changes vs V2 (as documented by Compound and independent analyses):
• Single borrowable asset per market (e.g. USDC) instead of a multi‑asset pool.
• Isolated collateral sets: each market supports a set of collateral assets whose risk is contained per market.
• Improved liquidation and risk parameters, including per‑collateral risk configs.
• No COMP liquidity mining by default; governance can configure rewards.
• Cross‑chain deployments with similar architecture per chain. Audits / malicious‑modification history
• Compound V3 contracts have been audited by major firms including OpenZeppelin and Trail of Bits, with public reports describing the new Comet architecture vs V2.
• Independent reviews (e.g., DefiSafety) track V3 as an audited iteration, not a copy of a malicious fork.
• No credible records were found of malicious modifications in Compound V3 itself or of widely‑used Compound V3 forks with known malicious changes as of 2026‑09‑03. On‑chain verification note
• Because Dune on‑chain querying is disabled in this run, all contract‑level facts are: Not verifiable as of 2026‑09‑03. Any address or verification status above must be treated as aggregator‑level, not on‑chain verified.

Compound V3 appears mature and production-grade: the official docs describe real interaction points for the protocol and note that the v3 proxy is the only address to use for each Compound III instance, which is consistent with a live, non-template deployment model. Public developer-facing tooling also exists, including Compound’s API docs and a JavaScript SDK, indicating an open API surface for developers rather than a purely closed-end app. What is verifiable from the web here is stronger on documentation than on UI behavior: the docs and API pages confirm real protocol integration paths, but live deposit/withdrawal functionality, broken-link checks, fake metrics, and template-sign detection are not verifiable as of 2026-09-03 without direct portal inspection.

Similarly, the presence of third-party SDK references shows the ecosystem is active, but does not by itself prove the current web app’s UX quality or uptime. Bottom line: Compound V3 has an established official docs portal and documented developer API, so it is not just a landing page. However, live portal functionality and UX integrity checks are not verifiable as of 2026-09-03 from the available evidence.

Compound Finance’s bug bounty program is active on Immunefi. It went live on 11 December 2024, is triaged by Immunefi, requires a PoC, and requires KYC. The scope is mainnet-only; testnet components are out of scope.

The published reward structure is: Low $1,000, Medium $5,000, High $10,000–$50,000, Critical up to $1,000,000, with the critical payout also described as 10% of directly affected funds up to the cap. Payouts are handled by the Compound DAO and denominated in USD, with rewards paid in COMP. Publicly visible program materials do not show completed payout results; that is not verifiable as of 2026-09-03.

Assessment (as of September 5, 2026): HIGH external-dependency sensitivity; current loss event not confirmed. Dune/on-chain verification was unavailable: Not verifiable as of September 5, 2026 for current per-chain collateral composition, utilization, bridge provenance, liquidation liquidity, and exposure percentages.

• Stablecoins/issuers: Compound V3 markets use USDC, USDT, USDS, USDbC and USDe in different deployments. This creates issuer, reserve, freeze/blacklist, and depeg risk. USDC/USDC.e also introduces chain-specific token-provenance and bridge risk; the documentation lists both native and bridged variants on several networks.
• LST/LRT and wrapped assets: wstETH, cbETH, WBTC, weETH and similar collateral inherit Lido/Coinbase/Bitcoin-wrapper/restaking-system risks, including smart-contract failure, slashing, redemption delays, exchange-rate divergence and liquidity gaps. Gauntlet specifically notes that wstETH unstaking may take 1–3 days normally and longer under stress.
• Oracles/manipulation: Comet permits governance/configurator updates to asset and base-token price-feed contracts. Chainlink is a major dependency, while some markets have considered or adopted alternative feeds such as API3. Historical audit evidence identified failure modes around stale Chainlink data; oracle outage, stale pricing, feed misconfiguration or correlated market manipulation could cause wrongful liquidations or bad debt.
• DEX/liquidation liquidity: Liquidations depend on external market liquidity and liquidator capacity. Thin or fragmented liquidity for LSTs, wrapped assets, governance tokens or bridged stablecoins can convert price volatility into slippage and insolvency.
• Bridges/custody/CEX/MM/RWA: Compound has no identified direct custodian, CEX, market-maker, RWA issuer/SPV or treasury-counterparty dependency in the reviewed evidence. However, bridged collateral and external liquidation venues create indirect bridge, exchange-liquidity and market-maker dependence. Not verifiable as of September 5, 2026 whether any such exposures are material. Failure scenarios: stablecoin depeg or freeze; bridge exploit/mint mismatch; LST slashing or redemption halt; oracle outage/manipulation; chain halt or sequencer downtime; and simultaneous collateral liquidation during thin liquidity. Supply caps and collateral factors limit—but do not eliminate—loss severity.

Compound V3 is organized as a non-custodial, smart-contract-based lending system: users supply assets to Comet markets and the protocol’s contracts hold and account for those assets rather than a centralized custodian. Each market uses a single borrowable base asset and multiple collateral-only assets, and users can withdraw supplied collateral or borrow the base asset through the contract interface. Governance and the pause guardian can restrict protocol actions, including withdrawals, but that is an administrative control over the contracts rather than custody of user assets.

Withdrawals have been paused in some markets during risk events, but not verifiable as a universal or current protocol-wide state as of 2026-09-05.

Compound V3 has one clearly documented protocol-wide security incident since launch that is directly evidenced in the retrieved sources: a 2023 vulnerability disclosure tied to a developer known as KP, who found and patched a critical issue in Compound’s v3 protocol (Comet). The available sources do not verify a dollar loss, and I cannot confirm an actual exploit or fund theft from the retrieved material. The response was to patch the vulnerability and submit a DAO proposal to compensate the reporter; the initial $125,000 reward proposal failed quorum, and KP later resubmitted a reduced $100,000 request.

Reimbursement, in the sense of user loss reimbursement, is Not verifiable as of 2026-08-27.

Bug bounty: Compound launched an Immunefi bug bounty with a maximum bounty of $1,000,000, 10% of directly affected funds, a $50,000 minimum for critical smart-contract bugs, KYC required, and payouts handled by the Compound DAO in COMP. The bounty program is live since 11 December 2024 per Immunefi. Scope in the protocol docs is the on-chain Compound Protocol; bugs requiring an admin key are out of scope.

November 4, 2025 — Compound V3 Ethereum USDC, USDS and USDT Comets were exposed to the deUSD/sdeUSD depeg and liquidity failure. sdeUSD traded near $0.86 while the oracle showed about $1.06, creating bad-debt risk. Reported exposure was $15,568,062. The previously expected $11,654,780.60 Elixir recovery was not paid: Elixir missed the March 16, 2026 deadline, purported to rescind the agreement, and entered voluntary liquidation on April 16, 2026.

The only confirmed recovery was Gauntlet’s $690,000 insurance contribution, implying revised realised loss of $14,878,062. Compound paused withdrawals/borrowing, de-risked the collateral, liquidated positions, and unpaused markets after risk parameters were changed. Compound is pursuing legal remedies against Elixir.

Users were not reimbursed; recovery protected DAO assets. Current status: remediation_in_progress.

March 8, 2026 — Compound’s compound.finance landing page was compromised through a stale cloud service-account key with excessive storage privileges. Visitors were redirected to a phishing site requesting ERC-20 permits and Compound Comet authorizations. The app.compound.finance interface and smart contracts were not compromised, and no user-fund loss was identified.

Compound restored the site, revoked access, rotated credentials, blocklisted the attacker address and initiated an infrastructure review. No reimbursement was required. Current status: resolved.

April 18, 2026 — KelpDAO/LayerZero rsETH bridge exploit created unbacked bridged rsETH after a forged cross-chain message released 116,500 rsETH. The tokens were used as collateral across lending protocols, including Compound V3 markets primarily on Ethereum and Arbitrum. Compound paused several rsETH-exposed markets and submitted risk-parameter changes to permit controlled unpausing and limit further exposure.

Compound-specific exposure, realised loss, attacker proceeds attributable to Compound, recovery and reimbursement are Not verifiable as of 2026-09-05. Current status: remediation_in_progress.

Compound V3’s notable incident history in the available sources is the April 2026 rsETH-related market disruption: several markets were paused, then later partially unpaused after the response process; the sources do not show a direct user fund loss on Compound V3 itself, and the event appears to have been a preventive/containment response rather than a confirmed protocol drain. A separate March 2026 website/phishing incident affected Compound’s web presence, with no user loss of funds identified.

Compound V3’s key management is organized through on-chain governance and limited administrative roles rather than a single operator wallet. Compound III is governed by COMP holders and delegates via the governance process, and the Timelock contract is the administrator for all Compound III instances; governance can control proxies, the Configurator implementation, the Comet factory, and the Comet implementation. The docs also say COMP token-holders designate the Pause Guardian address, which is held by the Community Multi-Sig.

For account-level permissions, users can enable other addresses to act as account managers with write permissions by using the allow function, which is separate from protocol governance. In practice, this means protocol control keys are split between community governance, the timelock, the pause-guardian multisig, and per-account delegated permissions.

Assessment date: September 5, 2026. Scope is Compound III/Comet (not Compound v2); repository deployment files match the requested chains and market addresses. Addresses (Comet proxy / Configurator): Ethereum 0xc3d688B66703497DAA19211EEdff47f25384cdc3 / 0x316f9708bB98af7dA9c68C1C3b5e79039cD336E3; Arbitrum USDC.e 0xA5EDBDD9646f8dFF606d7448e414884C7d905dCA / 0xb21b06D71c75973babdE35b49fFDAc3F82Ad3775; Base 0xb125E6687d4313864e53df431d5425969c15Eb2F / 0x45939657d1CA34A8FA39A924B71D28Fe8431e581; OP Mainnet 0x2e44e174f7D53F0212823acC11C01A11d58c5bCB / 0x84E93EC6170ED630f5ebD89A1AAE72d4F63f2713; Polygon 0xF25212E676D1F7F89Cd72fFEe66158f541246445 / 0x83E0F742cAcBE66349E3701B171eE2487a26e738; Scroll 0xB2f97c1Bd3bf02f5e74d13f02E3e26F93D77CE44 / 0xECAB0bEEa3e5DEa0c35d3E69468EAC20098032D7. Architecture: COMP governance → Ethereum Timelock → CometProxyAdmin / Configurator; non-Ethereum deployments add bridge receiver + local timelock. Comet uses a transparent upgradeable proxy; CometProxyAdmin inherits ProxyAdmin and can upgrade through deployAndUpgradeTo / deployUpgradeToAndCall. Admin powers: governance can change implementations, interest/risk parameters, asset listings/caps, price feeds, extension delegate, reserve withdrawals, and pause supply, transfers, withdrawals, absorption, or collateral buying. A compromised governance/timelock path could therefore install malicious logic, manipulate risk/oracles, freeze exits, or authorize asset transfers.

Direct arbitrary draining by the current admin is Not verifiable as of September 5, 2026. Exit risk: users are not guaranteed an immediate exit: withdrawals are an explicitly pausable function, and liquidity/market solvency remains relevant. Current pause state, proxy-admin owner, role renunciation, decoded admin events, and measured timelock delays are Not verifiable as of September 5, 2026 because Dune was unavailable. Proxy-admin addresses outside the previously recorded Ethereum (0x1EC63B5883C3481134FD50D5DAebc83Ecd2E8779) and Arbitrum (0xD10b40fF1D92e2267D099Da3509253D9Da4D715e) records are likewise Not verifiable as of September 5, 2026. Audit: OpenZeppelin reported no critical and one high-severity issue in the 2022 Compound III audit; the report says issues were addressed or explained, but current deployment-to-audit commit equivalence is not independently verified. Diagram: Governor/COMP → Timelock → {ProxyAdmin → Comet proxy → Comet implementation + CometExt; Configurator → Factory} Fields: admin_can_drain=null; audited_deployment=true; upgradeable=true; unresolved_critical=null; unresolved_high=null

Compound V3 (Comet) audit and formal verification

Certora provided formal verification services for Compound III, specifying and checking protocol invariants (e.g., safety of liquidations, collateralization and rewards logic) using Certora’s verification framework.

V3 Extended Pause

V3 Governor Whitelist

CAPO for rETH

Compound III / Comet security audit

ChainSecurity is cited by Compound as having performed audits for Compound III / Comet components, particularly around risk and liquidation mechanics.

Checkpoints audit report; file DeFi/stablecoin/contracts/lib/openzeppelin-contracts/audits/2022-10-Checkpoints.pdf in fullstack-development/blockchain-wiki-en (protocol audit catalog).

New published Certora audit report: Compound BytecodeRepository.

New published Certora audit report: Compound Treasury Manager.

ERC4626 audit report; file DeFi/stablecoin/contracts/lib/openzeppelin-contracts/audits/2022-10-ERC4626.pdf in fullstack-development/blockchain-wiki-en (protocol audit catalog).

OpenZeppelin performed security audits for Compound III (a.k.a. Compound v3, “Comet”), covering core protocol contracts prior to and around mainnet launch.

Compound III Audit

OpenZeppelin performed a security audit of Compound III (Comet) core contracts prior to mainnet launch; report covers architecture, core protocol logic, risk parameters, pausing and governance integration.

OpenZeppelin performed multiple security audits for Compound III (aka Compound V3), focused on the new Comet contracts and associated configuration, including upgrades and governance integration. The main public report is the "Compound III Audit" on OpenZeppelin’s site.

Trail of Bits conducted an earlier security assessment of Compound protocol components which informed the design and security posture of Compound III, focusing on economic security and smart‑contract invariants.

Trail of Bits conducted security audits of Compound v3/Comet smart contracts focusing on correctness, safety, and robustness of the protocol.

Trail of Bits conducted a security assessment for Compound III/Comet, focusing on smart contract safety, protocol invariants, and upgrade/governance risks.

v4.9 audit report; file DeFi/stablecoin/contracts/lib/openzeppelin-contracts/audits/2023-05-v4.9.pdf in fullstack-development/blockchain-wiki-en (protocol audit catalog).

v5.0 audit report; file concepts/auctions/contracts/lib/openzeppelin-contracts/audits/2023-10-v5.0.pdf in fullstack-development/blockchain-wiki-en (protocol audit catalog).

Compound V3 is developed by Compound Labs, Inc., a long‑running, US‑based DeFi company with an identifiable founding team, real corporate registrations, and physical office presence. Founders & early team

• Robert Leshner – widely cited as Founder/CEO of Compound Labs and creator of the Compound protocol, launched in 2017 on Ethereum.
• Geoffrey (Geoff) Hayes – co‑founder and CTO of Compound Labs; previously created *Exthereum*, an open‑source Ethereum client, indicating prior technical depth in blockchain infrastructure.
• Both are public, non‑anonymous individuals with extensive online presence and past entrepreneurial activity; Robert is also described as an investor at Robot Ventures. Corporate entity, location, onshore/offshore
• Multiple sources describe Compound Labs, Inc. as a US corporation founded in 2017.
• A legal entity identifier (LEI) record lists addresses in Wilmington, Delaware (via a corporate services provider) and San Francisco, California for Compound Labs, Inc., confirming a US, onshore registration.
• Additional corporate profiles and employee directories place the corporate office in San Francisco, CA, e.g., 3001 19th St, Suite 201, with dozens of employees.
• A separate business‑registry entry shows a California stock corporation named Compound Labs, Inc. with principal and mailing addresses in San Francisco and identified officers (CEO, secretary, CFO), further confirming a conventional corporate structure. Team breadth & institutional product angle
• Beyond founders, public profiles list roles such as VP & GM, Compound Treasury (Reid Cuming), with prior experience at Square, Stripe, and Chime. This supports an institutional‑facing orientation (e.g., Compound Treasury for yield to institutions), not just a hobby project.
• Company size is reported as 11–50 employees on LinkedIn, suggesting a small but established team rather than a loose DAO‑only structure. Prior outcomes, incidents, and reality check
• Compound (legacy protocol and V2) has experienced at least one high‑profile smart contract incident historically (e.g., incorrect reward distribution), but this is widely documented as a code/parameter bug rather than an external hack; precise on‑chain quantification is Not verifiable as of 2026‑09‑03 under current constraints.
• There is no credible evidence that the founders are anonymous or offshore shell operators; all key data points (corporate filings, LEI, media, and employment histories) align with a US‑domiciled, venture‑backed fintech/crypto company with real offices, employees, and regulatory visibility. Name‑collision note
• Some search results refer to *CompoundLabs* as a New Zealand compounding pharmacy and to “Compounding Labs” in Boston; these are unrelated healthcare businesses and not the DeFi protocol’s developer.

Compound V3 (Compound III / Comet) generally has a strong technical reputation but carries non‑trivial governance, legal and economic‑design risks relevant to an institutional user. Founders / investors / track record

• Built by Compound Labs, one of the earliest blue‑chip DeFi lending teams (live since 2018), widely regarded as technically competent and professional.
• The protocol has not been accused of fraud or rug‑pull behavior; the main concerns are around governance power, economic bugs and regulation, not dishonesty. Audits and formal reviews
• OpenZeppelin performed a dedicated security assessment of Compound III/Comet in 2022 under a security partnership with the DAO.
• Certora produced a formal verification and manual audit of the Comet contracts, concluding the implementation satisfied the specified properties. Certora has also audited governance upgrades, including proposer whitelist and extended pause features, finding only lower‑severity issues.
• An economic audit of Compound V3 has been published (academic‑style) and separate economic simulations have been run by Chainrisk to tune risk parameters. Incidents, criticisms, and risk perceptions
• Risk analytics site Hindenrank rates Compound V3 B‑ (moderate risk), noting:
• A 2024 governance attack (Proposal 247) where coordinated whales used governance to extract about $24M in COMP from the treasury.
• A historical $147M accounting bug in reward distribution (V2 era), framed as the largest DeFi accounting error, though not a protocol insolvency.
• Design criticism: V3’s single base‑asset architecture concentrates market risk in one borrowable asset per market.
• External reviews emphasize scale exposure as the riskiest dimension: large TVL, high composability and concentration of risk in a few assets. Legal / regulatory / sanctions
• Compound founders, investors and related entities face an ongoing US securities lawsuit alleging that COMP is an unregistered security and that key figures acted as “sellers” of securities under the Securities Act of 1933. A federal judge allowed the case to proceed past a motion to dismiss.
• Plaintiffs seek rescission of COMP token sales or equivalent damages, arguing users bought COMP as an ownership share with profit expectations from the team’s efforts.
• There are no public fraud, rug‑pull, insolvency or sanctions designations against Compound Labs or the protocol as of the latest reports; main exposure is securities‑law risk in the US. Unresolved concerns (institutional‑relevant)
• Governance capture risk: documented treasury extraction via governance; dependence on large token holders.
• Regulatory overhang: if COMP is judicially deemed a security, US‑domiciled participants and service providers could face additional compliance burdens.
• Economic risk tuning: active, but external research highlights the importance of continuously updated parameters; on‑chain verification of those parameters per chain is “Not verifiable as of 2026‑09‑03.”

Economic model — as of September 5, 2026. Compound V3 (Comet) is a non-custodial lending market, not a managed yield strategy. Users supply the market’s base asset to earn variable borrower interest, or supply approved collateral to borrow that base asset. Borrowers pay interest; the protocol retains a reserve-factor spread, with liquidation proceeds also contributing to reserves. Assets and risk: Inflows are base assets and market-specific collateral; outflows are withdrawals, borrowed base assets, and collateral transferred during liquidation.

Each market is isolated by chain/configuration. Collateral factors, supply caps, liquidation factors, oracle pricing, and a minimum borrow size constrain exposure. Withdrawals are permissionless subject to solvency/liquidity; there are no protocol-level lock-ups, but withdrawal may be limited by available liquidity or an open borrow. Yield classification: Yield is primarily organic variable borrowing demand, not staking, restaking, LP fees, or external strategy income.

COMP or other incentives can subsidize APY in individual markets. For example, a tracked Ethereum WETH market showed 1.54% supply APY: 1.48% base and 0.06% rewards; 30-day stability was 93.4%. Protocol-wide organic yield percentage and APY history/volatility are Not verifiable as of September 5, 2026. Position profile: The protocol itself is market-neutral in the sense that it does not deploy treasury capital into directional strategies.

Users can be directional or leveraged through collateralized borrowing; looping, restaking, and external portfolio exposure are user/composability risks, not an inherent V3 strategy. Aggregate leverage/looping is Not verifiable as of September 5, 2026. Revenue and TVL: DeFiLlama reports $1.411B TVL, $625.87M active loans, $2.15M fees and $181,308 protocol revenue over 30 days. TVL: Ethereum $1.296B (91.85%), Arbitrum $70.33M (4.98%), Base $26.15M (1.85%), OP Mainnet $10.16M (0.72%), Polygon $4.91M (0.35%), Scroll $105.8K (<0.01%).

These requested chains represent 99.76% of displayed TVL; DeFiLlama also lists other chains. Contradiction / data gap: Dune-vs-DeFiLlama TVL, product-level breakdown, chain trend, and on-chain APY history are Not verifiable as of September 5, 2026 because Dune MCP is unavailable. DeFiLlama is an analytics estimate, not raw on-chain verification. Fees are embedded in interest-rate mechanics rather than a separate withdrawal fee; governance can change rates, caps, supported assets, and risk parameters.

Scope: Compound V3 reserves are held inside individual Comet markets, not principally in a standalone treasury wallet. Reserves comprise base-asset and collateral-asset balances; they accrue from the borrower–supplier interest spread and liquidation activity. Each Comet exposes getReserves() and getCollateralReserves(). Size and composition: Chain-by-chain reserve balances for Arbitrum, Base, Ethereum, OP Mainnet, Polygon, and Scroll: Not verifiable as of September 5, 2026.

Dune was unavailable for this run, so no on-chain balances, latest block heights, execution IDs, or USD valuation are reported. DeFiLlama’s approximately $1.41B figure is Compound V3 TVL, not reserves, and must not be used as a reserve estimate. Addresses and custody: Specific Comet market addresses and reserve balances for the requested chains: Not verifiable as of September 5, 2026. Operationally, reserves remain contract-held within each Comet.

Governance may withdraw base-token reserves to an address it specifies; the withdrawal function is restricted to the Governor. Compound III instances are administered through the governance Timelock. Reserve policy: Governance sets an immutable targetReserves level for each market. If reserves are below target, liquidation buyers may purchase absorbed collateral at a discount, replenishing base-asset reserves; reserves can also backstop absorbed accounts. Treasury distinction / contradiction: A 2026 governance proposal estimated the broader Compound DAO treasury at approximately $120M, including $80–90M in stablecoins, but this is a governance estimate for DAO treasury assets—not verified Compound V3 reserve balances.

It should not be conflated with Comet reserves. Attestations: Independent reserve attestation covering the requested Compound V3 markets: Not verifiable as of September 5, 2026.

Compound V3 uses the existing COMP token as its governance token; there is no separate “Compound V3 token”. ### Basic token data

• Name / ticker: Compound / COMP
• Main contract (Ethereum): 0xc00e94Cb662C3520282E6f5717214004A7f26888 (ERC‑20)
• Chains: Native on Ethereum; bridged COMP exists on Arbitrum, Base, OP, Polygon, Scroll via canonical/bridge tokens (not new supplies). ### Supply, market cap, FDV
• Max supply: 10,000,000 COMP.
• Total supply: 10,000,000 COMP (fixed).
• Circulating supply: ~8.3–8.4M COMP as of 2026‑09‑03 (exchange/analytics estimates; varies slightly by source).
• Market cap: ≈ US$300–350m as of 2026‑09‑03 (stale if price moves).
• FDV: ≈ US$360–420m, based on max supply * spot price. All numerical values above are aggregator estimates, not on-chain verified. On‑chain totals per chain: Not verifiable as of 2026‑09‑03. ### Utility and governance
• Governance: COMP holders propose and vote on protocol changes for Compound v2 and v3, including risk parameters, supported assets, collateral factors, and reserve factors.
• Token utility: Primarily governance and delegation; COMP does not entitle holders to fixed revenue share by default. ### Revenue, buybacks, burns, staking
• Protocol revenue accrues to reserves controlled by governance, not directly to COMP holders.
• No protocol‑level auto buyback or burn mechanism for COMP is described in official docs; any buybacks must be explicit governance actions.
• No native staking of COMP in the core protocol; COMP can be delegated for voting. ### Emissions, unlocks, allocation
• Initial distribution: 42% users, 24% shareholders, 22% founders/team, 7.75% community/treasury, 4.25% future team (original schedule).
• Liquidity mining emissions for v2 have largely tapered; v3 used more targeted incentives and grants.
• Detailed unlock schedule vs. on-chain execution: Not verifiable as of 2026‑09‑03. ### Holder concentration & controls
• Upgraded COMP token contract removed admin with special transfer powers; standard ERC‑20 with no mint function and fixed supply.
• Detailed top‑holder concentration, insider/VC wallets, blacklist or fee‑switch functions per chain: Not verifiable as of 2026‑09‑03. ### DEX liquidity & listings
• Major listings: Coinbase, Binance, centralized exchanges, and DEX pools on Uniswap, Sushiswap, Balancer on Ethereum, plus bridged liquidity on Arbitrum, OP, Base, Polygon.
• Precise DEX liquidity depth by pool/chain: Not verifiable as of 2026‑09‑03.

For Compound V3, a Bitcoin drop below $10,000 is a *severe collateral stress scenario*, but the provided sources do not give a protocol-wide, chain-by-chain loss estimate for Arbitrum, Base, Ethereum, OP Mainnet, Polygon, or Scroll. The closest verified evidence is that Compound V3’s risk framework uses absorption/liquidation with a Liquidation Factor, Liquidation Penalty, and StoreFront Price Factor, and that insolvency risk depends on how fast collateral can be sold after absorption. What can be said from the sources:

• Compound V3 liquidates by absorbing undercollateralized accounts, then selling collateral at a discount determined by governance parameters.
• Economic audit and risk-assessment materials show the protocol is designed to withstand adverse price shocks, but they only provide illustrative scenarios such as a 20% wstETH depeg or a WBTC move that can cause insolvency if post-absorption prices fall further.
• None of the supplied sources verify how much BTC exposure each listed deployment currently has, so the effect of BTC < $10k on protocol reserves, bad debt, or liquidations across Arbitrum, Base, Ethereum, OP Mainnet, Polygon, and Scroll is Not verifiable as of 2026-09-03. Important caveat: Compound V3 markets are generally single-base-asset markets with collateralized borrowing, so BTC price stress is only directly relevant where BTC or BTC-wrapped assets are accepted as collateral in a given deployment; the provided sources do not confirm which of the six chains currently have such exposure.

Compound v3 uses an absorption-based liquidation model: when an account becomes underwater, its collateral is taken onto the protocol balance sheet and the debt is settled from reserves; if reserves are insufficient, liquidators/searchers can extract value from the absorbed collateral sale path. Under a 20% collateral depeg, the risk question is therefore not just account liquidation, but whether post-absorption sale proceeds still cover the repaid base debt after liquidation penalty and storefront pricing are applied. For a direct 20% depeg stress, the best available protocol-specific evidence is a Compound v3 liquidation review that explicitly reports a modeled 20% collateral decrease scenario producing negative reserve impact in the studied market: the report shows "$-39,502.04" for the 20 percent decrease case, versus "$11,674.71" in the actual scenario.

That is the clearest available indicator that a 20% depeg can push reserves materially lower in at least one Compound v3 market configuration. Compound’s own and community materials also indicate that safety depends heavily on the collateral factor, liquidation penalty, and storefront price factor, with risk assessments stressing that outcomes vary by market and parameter set. However, the provided sources do not contain a current, chain-by-chain exposure breakdown for Arbitrum, Base, Ethereum, OP Mainnet, Polygon, or Scroll, so the amount at risk from a 20% depeg across each deployment is Not verifiable as of 2026-09-03.

Practical reading: a 20% depeg is a credible stress event for Compound v3 collateral markets, and the protocol’s loss severity depends on each market’s collateral mix, parameter settings, and available reserves.

If a top borrower becomes insolvent in Compound V3, the system routes the loss via liquidation and bad-debt mechanics; the impact ultimately falls on suppliers (liquidity providers) of the affected market, not on other chains or external parties. ### 1. Setup: Counterparty & Collateral Structure

• Compound V3 is single-asset borrow per market (e.g., USDC market), with collateral posted in other assets but only the base asset borrowable.
• Each chain (Arbitrum, Base, Ethereum, OP, Polygon, Scroll) runs isolated deployments; insolvency in one does not directly spill over on-chain to others. ### 2. Stress: Top Borrower Defaults Trigger: Borrower’s collateral value falls or they stop repaying; health factor < 1 → position becomes liquidatable. Path: 1. Liquidation auctions / transactions:
• Keepers repay the borrower’s debt in the base asset (e.g., USDC) and receive collateral at a discount (liquidation incentive).
• If market liquidity and oracle prices are functioning, borrower is fully liquidated and no systemic loss remains; the borrower absorbs loss via collateral. 2. Bad debt creation (insufficient collateral):
• If price gaps, oracle failure, or thin liquidity prevent full liquidation, some debt remains unbacked: bad debt at the market level. ### 3. Who Absorbs the Loss?
• Suppliers of the base asset (e.g., USDC lenders) bear the economic loss:
• Total assets < total supplier claims → effective haircut via lower cash, reduced liquidity, and potentially reduced recoverable funds in extreme cases.
• Protocol treasury / reserves: V3 takes a reserve share of interest; this can partially offset bad debt but is not a formal guarantee.
• There is no explicit insurance fund or backstop (like Maker’s surplus buffer with MKR dilution), unless a separate arrangement exists per chain; not reported in core docs. ### 4. Smart-Contract Impact Path
• Interest rate model continues accruing; utilization may spike, worsening borrower terms but not retroactively fixing bad debt.
• ExchangeRate / accounting: suppliers’ accounting reflects fewer underlying assets than expected; losses are socialized across all suppliers in that market.
• Cross-chain: each chain’s deployment tracks its own reserves and bad debt; insolvency does not mechanically bridge via contracts. ### 5. Compensation
• No automatic compensation; suppliers effectively self-insure via overcollateralization and liquidation mechanics.
• Any ex-post compensation (e.g., governance-directed treasury use) would be a governance decision, not a protocol guarantee. Not verifiable as of [2026-09-03]: precise bad-debt history per chain and size in past events (requires on-chain/Dune).

For a fraud-by-DAO/owners stress scenario, Compound V3 should be treated as exposed to governance abuse / treasury diversion, not as a confirmed contract-level hack. The strongest relevant precedent in the search results is Compound’s 2024 governance attack, where Proposal 289 passed and redirected about 499,000 COMP (roughly $25M) to a treasury-controlled structure associated with the “Golden Boys” / goldCOMP arrangement; multiple independent writeups describe this as a governance attack and community concern, while the protocol’s own forum also references governance vulnerability and a prior process failure that led to large COMP losses.

Compound V3’s *primary yield source* is lending/borrowing spread income: suppliers earn the base-asset supply rate, which in Compound V3 is driven by utilization, while borrowers pay a separate borrow rate. For a stress scenario where the primary yield source is negative over 30 days, the protocol-level implication is that supplier APY would be below zero in that window, which is economically adverse for lenders and consistent with a weak-demand / stressed-market regime. For Compound V3 specifically, that negative-30d primary-yield outcome is not verifiable as of 2026-09-03 from the provided web sources alone, because the results do not include live market rates or chain-specific 30-day realized yield for Arbitrum, Base, Ethereum, OP Mainnet, Polygon, or Scroll.

The available sources only establish the protocol mechanics, not the current realized yield across the requested chains. If you want the most defensible risk read without on-chain verification, the best supported statement is that a negative 30-day primary yield would indicate stress in utilization / demand conditions for Compound V3, but the magnitude, affected chains, and whether the condition is isolated or system-wide are not verifiable as of 2026-09-03.

As of September 13, 2026: Compound V3 has real, executable COMP-holder governance, not merely symbolic DAO control. The Governor/Timelock controls Comet proxies and implementations, Configurator, factory, market parameters, reserve withdrawals, and cross-chain governance messaging. Listed deployments use Ethereum governance plus bridge receivers/local timelocks; exact local delays are Not verifiable as of September 13, 2026.

Standard process is proposal delay/review, voting, queueing, then Timelock execution; documented baseline is 2 days review, 3 days voting, and 2 days Timelock delay. The 2025 Governor upgrade preserved this schedule in the published moratorium notice. Centralization / contradiction: Compound’s governance docs describe Timelock control, but the Market Admin Audit documents an EOA marketAdmin path that can propose and execute market-parameter and Comet-upgrade changes without a community vote after a roughly 2-day delay. Pause and proposal guardians are intended as independent safeguards.

This makes DAO control real for core administration, but operationally non-exclusive. Governance documentation also states that governance can approve token allowances for managers and withdraw reserves; a malicious governance outcome could therefore move protocol assets. The market-admin bypass supports retaining admin_can_drain: true as a broad privileged-admin risk flag, although direct reserve withdrawal is governance-gated. Multisig: Published OpenZeppelin security-policy materials identify a 4-of-6 community multisig for pause-guardian functions, with six named signers: Paul L.

(Gauntlet), 0age (OpenSea), arr00, blck, Jared F., and TennisBowling. Signer independence is claimed by role categories, but not independently verified here. Other chain-specific Safe addresses and current signer state are Not verifiable as of September 13, 2026. Voting concentration / top COMP holders: Not verifiable as of September 13, 2026.

Dune MCP was unavailable, so no on-chain query or execution IDs can be supplied. Company/frontend: Contracts are DAO-controlled; Compound Labs appears to maintain the official frontend release pipeline, while the frontend repository is open-source and community-contributable. Compound Labs, Inc. is historically documented as a Delaware corporation; a 2019 SEC filing lists Robert Leshner and Geoffrey Hayes as directors. Current directors, registration status, and current Terms of Service counterparty are Not verifiable as of September 13, 2026.

Legal information on Compound v3 (aka Comet) is fragmented and mostly inferred from the broader Compound ecosystem rather than v3-specific filings. On‑chain confirmation is unavailable: Not verifiable as of 2026‑09‑03. ### Legal entity & jurisdiction

• Ecosystem entities:
• Compound Labs, Inc. – a Delaware corporation that originally developed Compound; terms and docs identify it as the developer/maintainer of the protocol.
• Compound DAO / Compound Governance – on‑chain governance controlling protocol parameters and upgrades; no separate legal wrapper is clearly established in public sources.
• No separate corporate entity dedicated specifically to Compound v3 or to the multichain deployments (Arbitrum, Base, OP Mainnet, Polygon, Scroll) is disclosed. Not verifiable as of 2026‑09‑03. ### Terms of service / user restrictions
• Frontend UIs (e.g., app.compound.finance) are operated by or on behalf of Compound Labs and typically include:
• Disclaimers that the protocol is experimental software with no guarantees of performance or safety.
• Geographic/user restrictions (e.g., use prohibited for residents of sanctioned jurisdictions and OFAC‑listed persons).
• These restrictions bind only users of the official UI; direct contract interaction is not practically restricted. "Unverified marketing claim" where based solely on protocol-operated sites. ### KYC / AML
• The protocol contracts are permissionless; there is no embedded KYC/AML at protocol level on any of the listed chains.
• Compliance controls are implemented, if at all, only at the level of specific frontends or intermediating custodians (e.g., CEXs, custodial wallets). This is consistent with market‑standard DeFi design. ### Regulatory classification
• No official regulatory classification specific to Compound v3 (e.g., as a security, commodity, or payment system) has been published by a regulator. Not verifiable as of 2026‑09‑03.
• General U.S. enforcement commentary around DeFi lending (e.g., SEC and CFTC public statements) could be relevant by analogy but do not name Compound v3 specifically. ### Warnings, enforcement, court cases, sanctions
• No public enforcement action or court case was found that specifically targets Compound v3, Compound Labs, or the DAO as of 2026‑09‑03.
• No listing of Compound Labs or the protocol itself on OFAC, EU sanctions, or similar lists was found. Not verifiable as of 2026‑09‑03.
• Some aggregators note that frontends implement OFAC-style address blocking, but this is standard compliance filtering and does not mean the protocol is sanctioned. ### Legal structure vs. actual risk
• Decentralization gap: Most governance is token‑holder controlled, but continued reliance on a U.S. corporate developer (Compound Labs) and upgradable contracts exposes the protocol to:
• Potential future U.S. regulatory pressure on the core team.
• Jurisdictional reach over governance participants and major token holders.
• User‑facing reality: For institutional users, risk is closer to interacting with open‑source, permissionless contracts with U.S. nexus, rather than with a clearly ring‑fenced regulated financial institution. Structured fields (as of 2026‑09‑03)
• entity: Compound Labs, Inc. (developer); Compound DAO (governance, on‑chain only)
• jurisdiction: United States (Delaware corporation; U.S. nexus for governance/dev)
• active_enforcement: null (no specific action identified)
• sanctioned: null (no direct sanctions identified)

Legal entity per GLEIF: Compound Labs, Inc. (LEI 254900EJ70SFKKJDUH92; jurisdiction US-DE; registration ACTIVE). OFAC SDN screening of 'Compound Labs Inc', 'Compound DAO', 'Compound V3': no match. SEC litigation and administrative release feeds: no mention.

Compound V3 does not issue its own stablecoin; it uses external base assets, and the documented initial deployment base asset is USDC. Stablecoin depeg history relevant to Compound V3 is not verifiable as of 2026-09-05 from the available sources here, so depeg_count, max_depeg_pct, and last_depeg_date are not verifiable as of 2026-09-05. The stable flag is therefore also not verifiable as of 2026-09-05 because no on-chain verification was available in this run.

Compound V3’s principal risks are smart-contract failure, oracle/liquidation stress, governance compromise, cross-chain dependencies, and liquidity or reserve shortfalls. Audits and emergency controls reduce—but do not eliminate—these risks; chain-level TVL, exposure, concentration, and reserve coverage are Not verifiable as of September 5, 2026 because Dune on-chain verification was unavailable.

Compound V3’s top strengths are its single-borrowable-asset design, which simplifies markets and improves capital efficiency; stronger risk isolation, because each market is independent and contagion is contained; more flexible liquidation mechanics, which unwind positions more gradually instead of forcing abrupt liquidations; lower gas and operational complexity, due to a streamlined protocol model; and better user/account management, including advanced permissions and delegation features for integrated DeFi workflows. Across the listed deployments on Ethereum, Base, Arbitrum, OP Mainnet, Polygon, and Scroll, the core design advantage is the same: Compound V3 centers each market on one base asset while collateral remains multi-asset, which makes the system easier to reason about than older multi-asset lending designs. This architecture is repeatedly described as improving capital efficiency, reducing risk, and allowing governance to tune parameters more precisely per market.

A second major strength is risk containment. Independent sources note that each Comet market operates separately, so problems in one market are less likely to spread to others. That isolation is especially relevant for a multi-chain deployment footprint, because exposure is split across distinct markets rather than pooled into one shared balance sheet.

Third, Compound V3’s liquidation framework is designed to be less abrupt than older models. Sources describe a buffer between max collateral and liquidation thresholds, and a more gradual unwinding process for underwater positions. That is generally favorable for borrower experience and can reduce the “all-or-nothing” liquidation behavior seen in more brittle lending systems.

Fourth, the protocol emphasizes efficiency and lower complexity. Commentaries consistently point to fewer moving parts, lower gas costs, and a simpler supply/borrow structure relative to Compound V2 and broader cross-asset lending markets. In practice, that can make the system more predictable for users and easier for governance to manage.

Fifth, Compound V3 has more advanced account controls than many lending protocols, including delegated permissions and bundled actions through the Bulker flow. That improves composability for vaults, routers, and other DeFi integrators that need to manage positions programmatically.