Credit · Lending · COMP
Compound is one of the original DeFi lending protocols. Compound III simplifies each market to a single borrowable base asset with other assets posted purely as collateral.
Simple, battle-tested money markets (Compound III).
COMP price
$20.05
+2.4% 24h
Latest data · 15 min delay
Typed risks scored by severity, likelihood and impact, with the incident record behind them.
41
severity-weighted points across 15 typed risks · 3 critical
assessed Jan 2026Market
9· 4 risks
Technological
10· 3 risks · 1 critical
Counterparty
7· 2 risks · 1 critical
Governance
14· 5 risks · 1 critical
Regulatory
1· 1 risk
Every score is recomputed at render time from the typed risks below; nothing is hand-assigned. Each risk contributes its severity weight (critical 4 · high 3 · medium 2 · low 1) to its category; the headline number is the sum across all categories. Bars scale to this entity's highest category score. Scores are not comparable across tags because a permissionless-market protocol concentrates technological risk while an institutional-credit protocol concentrates counterparty and regulatory risk, and a single league table would misrepresent both.
Market 4 × → 9
Technological 3 × → 10
Counterparty 2 × → 7
Governance 5 × → 14
Regulatory 1 × → 1
Compound's history is dominated by oracle and governance failures rather than direct contract exploits, and the pattern is remarkably consistent across six years. The November 2020 DAI liquidations, the 2022 cETH feed freeze and the November 2025 Elixir sdeUSD gap are all the same failure class: the protocol's internal price diverged from the tradeable price and the system acted on the wrong number (Compound forum, OpenZeppelin post-mortem, Gauntlet). On the governance side, both the 2021 reward distribution bug and the 2024 Humpy treasury proposal show that executable code can reach production with insufficient review or insufficient community control (CryptoSlate, The Block). The offsetting strength is that core solvency has been robust: the October 2025 crash produced 438 liquidations and under 1,600 USD of bad debt (Gauntlet). The team itself has named the structural weakness, that v3 forces all-or-nothing pauses, and the v4 roadmap is an explicit response with isolated margin assets, asset-level pauses and a new oracle design (Compound v4 roadmap). Net posture: medium severity, oracle and governance driven, with credible remediation in flight but not yet shipped.
Market4
Technological3
Counterparty2
Governance5
Regulatory1
7 documented incidents · 26 Nov 2020 to 30 Aug 2022 to 7 Sep 2022 · how the protocol behaved under stress, with sources.
26 Nov 2020
The DAI price rose to 1.30 USD on Coinbase Pro and the oracle passed the price through, triggering mass liquidations in the DAI market.
DetailsThe DAI price rose to 1.30 USD on Coinbase Pro and the oracle passed the price through, triggering mass liquidations in the DAI market.
Outcome: A compensation proposal based on the 8 percent liquidation penalty was drafted, but the initial executive vote failed with 680,000 COMP against and 212,000 COMP for.
Source29 Sep 2021
Proposal 62, "Dynamic COMP reward distribution", contained a greater-than instead of greater-than-or-equal comparison in two locations, placing roughly 280,000 COMP at risk of erroneous claim.
DetailsProposal 62, "Dynamic COMP reward distribution", contained a greater-than instead of greater-than-or-equal comparison in two locations, placing roughly 280,000 COMP at risk of erroneous claim.
Outcome: No supplied or borrowed user funds were at risk; the exposure was limited to the COMP reward pool.
Source25 Oct 2022
Following the 117 million USD Mango Markets exploit, Compound governance paused YFI, ZRX, BAT and MKR as collateral over price manipulation risk.
DetailsFollowing the 117 million USD Mango Markets exploit, Compound governance paused YFI, ZRX, BAT and MKR as collateral over price manipulation risk.
Outcome: The proposal passed with 99 percent support and the four assets were removed from active collateral use.
SourceJul 2024
Proposal 289, led by the whale Humpy and The Golden Boys, passed and would have automatically deployed 24 million USD of treasury funds into a goldCOMP product on execution.
DetailsProposal 289, led by the whale Humpy and The Golden Boys, passed and would have automatically deployed 24 million USD of treasury funds into a goldCOMP product on execution.
Outcome: A truce was reached, the proposal was withdrawn and the deployment was cancelled; a replacement staking product endorsed by OpenZeppelin and Gauntlet was pursued instead.
Source10 Oct 2025
A market-wide crash with BTC down over 12 percent and ETH down over 20 percent, from 4,354 to 3,435 USD, produced 438 liquidations across Compound comets.
DetailsA market-wide crash with BTC down over 12 percent and ETH down over 20 percent, from 4,354 to 3,435 USD, produced 438 liquidations across Compound comets.
Outcome: V3 Ethereum USDC absorbed the largest share at 15.4 million USD or 38 percent; bad debt stayed under 1,600 USD, mostly on Unichain, and about 1.49 million USD was added to reserves.
Source4 Nov 2025
An Elixir liquidity crunch hit deUSD and sdeUSD, which were listed as collateral on the Ethereum USDC, USDS and USDT comets; the sdeUSD oracle showed 1.06 while the market price was 0.86.
DetailsAn Elixir liquidity crunch hit deUSD and sdeUSD, which were listed as collateral on the Ethereum USDC, USDS and USDT comets; the sdeUSD oracle showed 1.06 while the market price was 0.86.
Outcome: Gauntlet triggered an emergency withdraw-pause, keeping supply and repay open while blocking borrow and withdraw, and characterised the oracle gap as a vulnerability.
Source30 Aug 2022 to 7 Sep 2022
Proposal 117 upgraded the oracle to a version assuming every cToken implements underlying(); cETH does not, so getUnderlyingPrice reverted and the cETH market froze for supply, borrow, withdraw and liquidation.
DetailsProposal 117 upgraded the oracle to a version assuming every cToken implements underlying(); cETH does not, so getUnderlyingPrice reverted and the cETH market froze for supply, borrow, withdraw and liquidation.
Outcome: Proposal 119 executed at 01:18 UTC on 7 September 2022 and restored the feed; OpenZeppelin published a post-mortem and no direct loss occurred.
SourceEvent-type chips are categorised by event type against the risk taxonomy (a documented presentation mapping, not a dataset assessment). Amounts are the dataset's published figures; missing values were never published.
