Compound USD Coin (cUSDC) Smart Contract Risk
No Revert on Transfer Failure
⚠ HIGH severityVulnerability
cUSDC returns false on failure instead of reverting. Protocols must explicitly check the return value to detect failed transfers.
Related: Unchecked Return Values
Safe integration
Check the return value from transfer calls, or wrap with SafeERC20.
Contract addresses
| Chain | Address |
|---|---|
| Ethereum | 0x39aa39c021dfbae8fac545936693ac917d5e7563 |
Audit any contract that interacts with cUSDC: SmartContract.us automatically detects cUSDC integration risks →
Chain & standard security guides
What this contract permits today
Read live from Ethereum on 2026-10-14. This is a different question from the integration risk above: not how to call the token safely, but what the holders of its keys are able to do to the people holding it.
| Question | Answer |
|---|---|
| Can new tokens be created? | Yes |
| Can transfers be blocked? | No |
| Is there a trading tax? | No |
| Can the logic be replaced? | No |
| Can liquidity be withdrawn? | Yes |
The permissions above rest with 0x6d903f6003cca6255D85CcA4D3B5E5146dC33925, itself a contract, which may be a multisig or a timelock. Whether that is acceptable depends on who holds it.