Ameen Soleimani – 8 min read

You’ve probably heard of Compound. They built compound.finance on Ethereum which allows you to lend and earn interest on your ETH, DAI, USDC, and several other ERC20s.

Today, the interest rate offered to DAI lenders is 10%, which is high enough to turn EthHeads’ heads (see cover photo).

As the CEO of SpankChain, it’s my job to manage the company reserves, which also includes nearly half a million DAI. At 10% annual interest, that’s ~$4,000 per month that we’re leaving on the table by not moving our DAI into Compound. That’s quite the opportunity cost. But the thing to remember when investing is that there is no free lunch. All investments have their risks and lending on Compound is no exception.

I spent some time over the last month evaluating several categories of risk when lending on Compound:

1. Contract Security Risks
2. Centralized Points of Failure
3. Bank Run Risk

I break my investigation down by category below, but the most important things to know are:

1. The smart contract security seems legit.
2. Compound is a CUSTODIAL system, all lending pools can be trivially drained if their admin private key is compromised.
3. When you lend on Compound, you are NOT guaranteed to be able to withdraw whenever you want. If you try to withdraw your funds and all the money is locked up in outstanding loans, your withdrawal transaction will fail.

Contract Security

Compound has been audited by several reputable smart contract security firms.

1. OpenZeppelin Audit Report
2. Trail of Bits Audit Report
3. Certora Audit Report

In addition, Compound was offering a private bug bounty of up to $250,000 for critical vulnerabilities (defined as 1% of funds stolen or 10% frozen), and to my knowledge no independent security researchers have been able to claim the bounty.

The contracts have also held $20M+ for over 6 months, $50M+ for over 2 months, and currently hold $100M+. For me personally, the most important metric of contract security is total funds held in contract * time held in contract, and Compound has been secure with quite a large public bounty thus far.

Based on the above factors, I presently believe that the Compound smart contracts are secure.

Centralized Points of Failure

I’m not a smart contract security expert myself, so I enlisted the assistance of the one and only samczsun who famously found a critical bug in the 0x contracts (despite multiple audits from top firms) and was paid $100,000 for it. He had the following to report about centralized points of failure in Compound (emphasis mine):