Compound

Compound V3 allows a single borrowable asset per market. That sounds like a limitation and it is the most effective risk control in the lending category: if a listed collateral asset turns out to be worthless, the damage is confined to the one market that accepted it. It cannot propagate into a shared pool and reach depositors who never touched it.

The alternative approach is a shared pool with carefully tuned parameters per asset, which is more capital-efficient and depends on every parameter being right. Compound chose the blunter instrument, and we score its risk architecture 8 out of 10, the highest of the lending protocols we rate.

The cost is on the other side of the ledger. Isolated markets fragment liquidity, which is part of why scale scores 5 out of 10 and deposits sit at $1.55bn while Aave holds $18.39bn. Compound defined this category and no longer leads it, and the design conservatism is a real part of why.

A governance upgrade distributed roughly $80m of COMP in error. The vote passed, the code did something other than what its authors intended, and the money left before anyone caught it. Recovery depended on recipients choosing to return funds, because there was no mechanism to claw them back.

No depositor lost anything — the loss fell on the protocol treasury — which is why this sits in the incident table with a different character from a hack. What it demonstrates is more uncomfortable than a hack would be: the failure was not an attacker beating the system, it was the system doing exactly what it had been correctly authorised to do.

The lesson generalises across everything we rate on this site. "Governance-controlled" is usually presented as a safeguard, and a passed vote can be wrong in ways nobody notices until the money has moved. Upgradeability scores 7 out of 10 here; the number would mean less without this example attached to it.