The memo
REJECTED PROTOCOL-WIDE — THE 0.5% THRESHOLD APPEARS BREACHED, ON PRIMARY ON-CHAIN EVIDENCE, NOT JUST UNVERIFIABLE. The Compound Foundation never published a per-Comet breakdown of the November 2025 deUSD/Stream loss, so this review read each held Comet's reserves directly: `getReserves()` on the Ethereum USDC and USDT Comet contracts (addresses from Compound's own deployments/mainnet/{usdc,usdt}/roots.json on GitHub) at block 23,716,567 (2025-11-03, pre-incident) versus block 23,802,360 (2025-11-15, post-incident). Ethereum USDC reserves fell $5,295,676.94, 1.049% of pre-incident market size; Ethereum USDT reserves fell $1,430,743.34, 0.707%. Both exceed this registry's own 0.5%-of-a-single-market kill criterion — USDC by roughly 2x, USDT by roughly 1.4x — over exactly the incident window, on a metric that should normally rise from interest-reserve accrual, not fall. A reserve decline is not definitionally identical to certified bad debt, and the combined $6.73M decline exceeds the Foundation's own reported ~$3.5M protocol-wide net loss, plausibly because recovered funds (the $12.07M Elixir settlement, $690K from Gauntlet's insurance fund) landed in Foundation treasury rather than being redeposited into these specific Comets' reserves — that redirection could not be confirmed from reserves data alone. But the size, direction, and exact timing of the decline is strong, direct, primary evidence a threshold breach occurred, not a proxy. WETH, the third held symbol, was not itself a Comet where deUSD/sdeUSD were listed, but Comet governance — the Pause Guardian, COMP voting, the shared incident-response apparatus — is protocol-wide, so this rejection covers all three held symbols rather than carving WETH out on an unbundled verdict this schema cannot record. Comet is Compound's isolated-markets lending design: each deployment has exactly one borrowable base asset (USDC, USDT, or WETH in the markets we hold), and every other listed asset is collateral only, siloed in the contract, never lent out, earning nothing. A collateral failure on one Comet cannot touch another; the Ethereum USDC, Ethereum WETH, and Base USDC markets share no balance sheet. That is still the reason to hold it beside Aave: diversification of architecture, not just of venue. But isolation runs between markets, not within one, and November 2025 tested exactly that. Stream Finance disclosed a $93M loss on 2025-11-04; Elixir's deUSD, which had lent about 65% of its backing to Stream, fell about 98%, and governance had listed deUSD and sdeUSD as collateral on the Ethereum stable Comets we hold. The protocol was left with $15.57M of exposure. Per the Foundation's financial update, $12.07M (78%) was recovered through negotiation with Elixir plus $690,000 from Gauntlet's insurance fund, a net loss near $3.5M. Kill criterion one is bad debt above 0.5% of a single market. The Foundation publishes only an aggregate across the USDC, USDS and USDT Comets, not the per-Comet realized loss, so this review reconstructed it directly on-chain (see above): both held Comets' reserve declines exceed the 0.5% trigger over the incident window. Rejected on that primary evidence; reopens if a full recovery/reserve-restoration accounting shows the decline was reversed or was not, in fact, bad debt. Compound made the same class of listing mistake Aave paid roughly $196M to learn: an unproven wrapped asset welcomed into the flagship markets. The architecture cut the size of the loss, not its probability. The Pause Guardian, reported as a 4-of-6 multisig, froze withdrawals on our markets on 2025-11-04 for a duration we could not verify; for some period a client could not get out. Control is COMP voting through Governor Bravo and a 2-day timelock over upgradeable proxies. That pipeline's record includes the 2021 distribution bug, roughly $90M claimed or claimable with aggregate at-risk estimates near $149M, which the same seven-day pipeline took a week to fix, and 2024's Proposal 289, where a whale bloc voted $24M out of the treasury and was settled with, not stopped. OpenZeppelin's standing security role ended around 2025-09-08, replaced by ChainSecurity and Certora at roughly half the budget, and TVL has halved in a year, $2.56B to $1.13B at the 2026-08-14 review. No exploit of Comet itself has been found from 2022 through 2026; every realized loss traces to a listing decision. Any later approval would cover Ethereum, Base, and Arbitrum only. Base holds $19.6M total, near the $5M per-market floor, where the liquidity check does real work.
What would reopen the file
- Bad debt in any single Comet market exceeding 0.5% of that market
- On-chain accounting shows any single Ethereum Comet's November 2025 deUSD loss exceeded 0.5% of that market
- A proposal to list a new yield-bearing or wrapped stablecoin as collateral on a Comet we hold (the door deUSD used; USDe and sUSDe are already inside)
- The Pause Guardian blocks withdrawals on a market we hold and the pause is not lifted within 72 hours
- Governance merges isolated markets or permits shared collateral, including any v4 design that pools collateral
- A base-asset market we hold falls below our liquidity minimum
- The ChainSecurity and Certora security provider misses its reporting cadence or the DAO cuts the security budget again
Facts on file
- Verdict
- Rejected
- Exposure
- stable lending
- Chains examined
- Ethereum
- Instruments
- USDC, USDT, WETH
- Memo version
- v1
- Reviewed
- Next review