Compound III

As per their security page you have to go to their GitHub and read the deployment addresses from the configuration.json for each asset and chain. The Compound protocol's smart contract addresses are easily accessible and clearly labeled in their documentation.

Yes, the repository is indicated in the footer of the website.

As per the GitHub, there are many public devs.

Team responded very fast via Discord.

Location:https://compound.finance/documents/Compound.Whitepaper.v04.pdf

In the GitHub readme there is a list and description of the contracts for Compound III or comet. We could not find other software architecture for the latest version of Compound. Given this, we cannot give a score higher than 40%.

In the GitHub readme there is a list and description of the contracts for Compound III or comet. Within the code there is good but not extensive commenting. This gives a score of 50%.

In-line commenting in the code does not count towards traceability. Given that the only documentation outside of the code is the list of functions, with links to the software a score of 40% is given, asked for guidance.

Code documentation is quite minimal. It is clearly organized. This brings a score of 50%.

Test to Code is 37007 / 6402 = 578% which drives a 100% score    ───────────────────────────────────────────────────────────────────────────────  Language Files Lines Blanks Comments Code Complexity  ───────────────────────────────────────────────────────────────────────────────  JavaScript 54 6402 896 2363 3143 517  ───────────────────────────────────────────────────────────────────────────────  Total 54 6402 896 2363 3143 517  ───────────────────────────────────────────────────────────────────────────────  Estimated Cost to Develop $89,909  Estimated Schedule Effort 5.506310 months  Estimated People Required 1.450648  ───────────────────────────────────────────────────────────────────────────────  Processed 262911 bytes, 0.263 megabytes (SI)  ───────────────────────────────────────────────────────────────────────────────    Language Files Lines Blanks Comments Code Complexity  ───────────────────────────────────────────────────────────────────────────────  TypeScript 69 16692 1974 538 14180 454  JavaScript 19 1367 212 164 991 65  YAML 2 81 11 0 70 0  JSON 1 18867 0 0 18867 0  ───────────────────────────────────────────────────────────────────────────────  Total 91 37007 2197 702 34108 519  ───────────────────────────────────────────────────────────────────────────────

We could not find any code coverage documentation,, though clearly the code is designed to measure code coverage. As for guidance, a score of 50% is given.

No detailed test report was found.

While Compound V2 has undergone formal verification, there is no evidencethat Compound III has the same coverage, therefore No.

The Compound protocol has undergone multiple audits conducted pre-deployment by reputable firms such as OpenZeppelin, ChainSecurity, and Trail of Bits, as indicated by the provided documentation. This includes audits of specific aspects such as the cDAI, COMP & Governance, and Tether. In addition, the protocol was also formally verified by Certora. Furthermore, Compound has a bug bounty program in place, emphasizing its commitment to security and the identification of potential vulnerabilities. These actions demonstrate a high level of diligence in ensuring the quality and security of the protocol.  

With just two audits, both applicable to the deployed software, this list fulfills the requirements and get 100%.

Compound offers a bug bounty program with rewards ranging from $500 to $150,000 for eligible discoveries. The value of these rewards, as well as the active nature of the program, suggests a commitment to security and code testing. However, given the scoring guidelines, the bounty score is 60% because the bounty is $100k or more.    Compound offers an inactive bug bounty of up to $150k.

Under Economic Security section of the Security page Compound mentions their affiliation with Gauntlet. This effectively gives a sophisticated level of protocol monitoring. It includes incident response. Based on this, a score of 80% is given. 60% for a general protocol monitoring and 20% for incident response. What is not indicated is protocol monitoring for security events (hack detection).

The provided documentations from Compound Finance mention the use of Cloudflare for email protection which is a form of DDOS Protection. There are no explicit references to DNS steps to protect the domain, intrusion detection protection on the front end, or unwanted front-end modification detection in the provided documents.    

In the introduction to the Governance section, it is clearly dedicated that software is updatable via a time lock. This gives a score of 80%.

The codes upgrade path is clearly explained in the introduction to the governance section. Score of 100%.

Based on the information provided, there are no admin addresses. All government decisions take place through DOA voting. The processes and capabilities are very well explained in the governance page. There is a community MultiSig that at the moment controls the Pause Guardian.

The protocol's documentation does not list the signers of the admin addresses, nor does it provide any evidence or arguments to support the claim that these signers are separate, distinct individuals.  

Given that virtually all governance decisions take place through DAO voting, there is little need for a transaction signing policy. It would be required for the signers of the community MultiSig. However they can only pause the protocol. Given this, a score of 70% is given.

The protocol in question uses price feed oracles. The Compound Protocol uses a View contract (“Price Feed”) which verifies that reported prices fall within an acceptable bound of the time-weighted average price of the token/ETH pair on Uniswap v2. This is a sanity check referred to as the Anchor price. Prices are updated by Chainlink Price Feeds. The protocol's Comptroller contract uses it as a source of truth for prices. The ValidatorProxy contract calls validate on the UniswapAnchoredView. This queries Uniswap v2 to check if a new price is within the Uniswap v2 TWAP anchor. If valid, the UniswapAnchoredView is updated with the asset’s price. If invalid, the price data is not stored.  

The protocol's Oracle, the Open Price Feed, is comprehensively documented. The documentation explains how it accounts for price data for the Compound protocol and that the protocol's Comptroller contract uses it as a source of truth for prices. The documentation also details that prices are updated by Chainlink Price Feeds. Furthermore, it provides insight into how the Open Price Feed works, explaining that it uses a View contract ("Price Feed") which verifies that reported prices fall within an acceptable bound of the time-weighted average price of the token/ETH pair on Uniswap v2. The documentation also provides the Github link for the Open Price Feed's codebase.  

The Compound protocol has implemented several measures to protect against potential flashloan attacks. The protocol has a supplyCap on markets, which limits the protocol's risk exposure to collateral assets. It also uses separate and higher liquidation collateral factors than borrow collateral factors to ensure a price buffer for all new positions. Additionally, the protocol has gone through professional audits and formal verification by Certora using Certora ASA (Accurate Static Analysis), which is integrated into Compound’s continuous integration system. Gauntlet has constructed a simulation-based market stress-testing platform to evaluate the economic security of the Compound protocol, as it scales supported assets and volume.