Reentrancy guard on external-calling functions
Compound V3 (Comet)'s assessment for RD-F-014 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Comet does not use nonReentrant guards. ChainSecurity identified Bulker invoke and doTransferIn as reentrancy-possible (informational) — no exploitable path found. Team declined guards for code clarity. No exploit in 44+ months with current ERC-20-only collateral set.
Sources #
- Audit
- https://www.openzeppelin.com/news/compound-iii-auditretrieved 2026-04-28
Methodology #
Determine whether all state-mutating functions that perform external calls carry `nonReentrant` or an equivalent reentrancy guard.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol compound-v3 factor RD-F-014 score yellow collected_at 2026-04-28 00:20:50