Resolved-without-proof findings

Compound V3 (Comet)'s assessment for RD-F-003 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

OZ audit: 1 high finding (locked assets, partially addressed), 3 medium (2 resolved via PR, 1 acknowledged with docs only). ChainSecurity: ERC-777 reentrancy in buyCollateral acknowledged without code fix. No post-audit finding has been exploited in 44+ months.

Sources #

Audit
https://reports.chainsecurity.com/Compound/ChainSecurity_Compound_Comet_Audit.pdfretrieved 2026-04-28
Audit
https://www.openzeppelin.com/news/compound-iii-auditretrieved 2026-04-28

Methodology #

Count the number of findings the audit report marks "Resolved" or "Fixed" where no matching on-chain bytecode change or verifiable commit can be found.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol compound-v3 factor RD-F-003 score yellow collected_at 2026-04-28 00:20:50