fix(compound-v3): v0.1.1 — correct Arbitrum base asset (USDC.e → native USDC) and Polygon RPC

[skylavis-sky]

Summary

Bug fix for compound-v3 v0.1.0. Two issues were causing failures on Arbitrum (borrow/repay broken) and Polygon (all reads broken).

Bug 1: Arbitrum base_asset was USDC.e instead of native USDC

Root cause: src/config.rs line 40 had 0xFF970A61A04b1cA14834A43f5dE4533eBDDB5CC8 (USDC.e bridged) as the base_asset for Arbitrum USDC market. However, the deployed Compound V3 Arbitrum Comet contract's baseToken() (selector 0xc55dae63) returns 0xaf88d065e77c8cC2239327C5EDb3A432268e5831 (native USDC).

Impact: Borrow calls Comet.withdraw(USDC.e, amount) which the contract treats as collateral withdrawal, triggering arithmetic underflow. Repay's ERC-20 approve(USDC.e, amount) fails because the user's USDC balance is native USDC, not USDC.e.

Fix: Changed base_asset to 0xaf88d065e77c8cC2239327C5EDb3A432268e5831 (native USDC).

Bug 2: Polygon RPC was returning HTML instead of JSON-RPC

Root cause: polygon-rpc.com is a landing page, not a JSON-RPC endpoint. All Polygon get-markets calls failed with HTML parse errors.

Fix: Replaced with https://polygon-bor-rpc.publicnode.com.

Validation

Live L4 transactions on Arbitrum (chain 42161):

Test	Command	Result
L4-A3 Borrow 0.01 USDC	compound-v3 --chain 42161 --market usdc borrow --amount 10000	✅ tx confirmed, no underflow
L4-A5 Repay debt	compound-v3 --chain 42161 --market usdc repay	✅ approve + supply tx confirmed
L2-3 Arbitrum market stats	compound-v3 --chain 42161 --market usdc get-markets	✅ ok:true
L2-4 Polygon market stats	compound-v3 --chain 137 --market usdc get-markets	✅ ok:true (was broken)

Changes

• src/config.rs: Arbitrum base_asset 0xFF970A61... → 0xaf88d065...
• src/config.rs: Polygon rpc_url polygon-rpc.com → polygon-bor-rpc.publicnode.com
• api_calls: added arbitrum-one-rpc.publicnode.com, replaced polygon-rpc.com with polygon-bor-rpc.publicnode.com
• source_commit: bumped to a4565195c3791a4787b53d943fbed706a24a848d

Checklist

• plugin-store lint passes (0 errors, 3 warnings — same as v0.1.0)
• Arbitrum borrow/repay validated with live L4 transactions
• Polygon get-markets validated with live L2 test
• api_calls updated to include all RPC endpoints used
• source_commit points to fixed commit on skylavis-sky/onchainos-plugins

🤖 Generated with Claude Code

[github-actions]

📋 Phase 3: AI Code Review Report — Score: N/A/100

Plugin: compound-v3 | Recommendation: 👤 Manual review required

🔗 Reviewed against latest onchainos source code (live from main branch) | Model: unknown via Anthropic API | Cost: unknown

This is an advisory report. It does NOT block merging. Final decision is made by human reviewers.

---

AI review did not produce output.

Generated by Claude AI via Anthropic API — review the full report before approving.

[github-actions]

Phase 4: Summary + Pre-flight for compound-v3

Review below. AI Code Review is in a separate check.

---

SUMMARY.md

compound-v3

Compound V3 (Comet) lending plugin for supplying collateral, borrowing/repaying assets, and claiming COMP rewards across multiple chains.

Highlights

• Multi-chain support (Ethereum, Base, Arbitrum, Polygon)
• Supply collateral and base assets with automatic debt repayment
• Borrow base assets against supplied collateral
• Repay borrowed amounts with overflow protection
• Withdraw collateral when debt-free
• Claim COMP rewards from lending activities
• Dry-run mode for previewing transactions before execution
• Built-in safety checks and user confirmation flows

SKILL_SUMMARY.md

compound-v3 -- Skill Summary

Overview

The compound-v3 plugin enables interaction with Compound V3 (Comet) lending markets across Ethereum, Base, Arbitrum, and Polygon networks. Users can supply collateral, borrow base assets, repay debt, withdraw funds, and claim COMP rewards through a comprehensive lending interface with built-in safety mechanisms.

Usage

Install the plugin binary and ensure your onchainos wallet is connected. Use dry-run mode to preview transactions before execution, then confirm operations when prompted.

Commands

• get-markets - View market statistics (utilization, APRs, totals)
• get-position - Check account position (balances, collateralization status)
• supply - Supply collateral or base assets (auto-repays debt)
• borrow - Borrow base assets against collateral
• repay - Repay borrowed amounts (full or partial)
• withdraw - Withdraw supplied collateral (requires zero debt)
• claim-rewards - Claim accrued COMP rewards

Triggers

Activate when users mention compound lending operations like "compound supply", "compound borrow", "compound repay", "compound withdraw", "compound rewards", "compound position", or "compound market". Also trigger for general DeFi lending needs on supported networks.

Auto-injected Pre-flight

## Pre-flight Dependencies (auto-injected by Plugin Store CI)

> Run once per session before first use. These checks ensure required tools are installed.

### Install onchainos CLI + Skills (auto-injected)

```bash
# 1. Install onchainos CLI
onchainos --version 2>/dev/null || curl -fsSL https://raw.githubusercontent.com/okx/onchainos-skills/main/install.sh | sh

# 2. Install onchainos skills (enables AI agent to use onchainos commands)
npx skills add okx/onchainos-skills --yes --global

# 3. Install plugin-store skills (enables plugin discovery and management)
npx skills add okx/plugin-store --skill plugin-store --yes --global

Install compound-v3 binary (auto-injected)

if ! command -v compound-v3 >/dev/null 2>&1; then
  OS=$(uname -s | tr A-Z a-z)
  ARCH=$(uname -m)
  EXT=""
  case "${OS}_${ARCH}" in
    darwin_arm64)  TARGET="aarch64-apple-darwin" ;;
    darwin_x86_64) TARGET="x86_64-apple-darwin" ;;
    linux_x86_64)  TARGET="x86_64-unknown-linux-gnu" ;;
    linux_i686)    TARGET="i686-unknown-linux-gnu" ;;
    linux_aarch64) TARGET="aarch64-unknown-linux-gnu" ;;
    linux_armv7l)  TARGET="armv7-unknown-linux-gnueabihf" ;;
    mingw*_x86_64|msys*_x86_64|cygwin*_x86_64)   TARGET="x86_64-pc-windows-msvc"; EXT=".exe" ;;
    mingw*_i686|msys*_i686|cygwin*_i686)           TARGET="i686-pc-windows-msvc"; EXT=".exe" ;;
    mingw*_aarch64|msys*_aarch64|cygwin*_aarch64)  TARGET="aarch64-pc-windows-msvc"; EXT=".exe" ;;
  esac
  mkdir -p ~/.local/bin
  curl -fsSL "https://github.com/okx/plugin-store/releases/download/plugins/compound-v3@0.1.1/compound-v3-${TARGET}${EXT}" -o ~/.local/bin/compound-v3${EXT}
  chmod +x ~/.local/bin/compound-v3${EXT}
fi

Report install (auto-injected, runs once)

REPORT_FLAG="$HOME/.plugin-store/reported/compound-v3"
if [ ! -f "$REPORT_FLAG" ]; then
  mkdir -p "$HOME/.plugin-store/reported"
  # Device fingerprint → SHA256 → 32-char device ID
  DEV_RAW="$(hostname):$(uname -s):$(uname -m):$HOME"
  DEV_ID=$(echo -n "$DEV_RAW" | shasum -a 256 | head -c 32)
  # HMAC signature (obfuscated key, same as CLI binary)
  _K=$(echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | base64 -d 2>/dev/null || echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | openssl base64 -d)
  HMAC_SIG=$(echo -n "${_K}${DEV_ID}" | shasum -a 256 | head -c 8)
  DIV_ID="${DEV_ID}${HMAC_SIG}"
  unset _K
  # Report to Vercel stats
  curl -s -X POST "https://plugin-store-dun.vercel.app/install" \
    -H "Content-Type: application/json" \
    -d '{"name":"compound-v3","version":"0.1.1"}' >/dev/null 2>&1 || true
  # Report to OKX API (with HMAC-signed device token)
  curl -s -X POST "https://www.okx.com/priapi/v1/wallet/plugins/download/report" \
    -H "Content-Type: application/json" \
    -d '{"pluginName":"compound-v3","divId":"'"$DIV_ID"'"}' >/dev/null 2>&1 || true
  touch "$REPORT_FLAG"
fi

---

</details>

---
*Generated by Plugin Store CI after maintainer approval.*

[skylavis-sky]

Closing — PR should target okx/plugin-store instead.

[github-actions]

🔨 Phase 2: Build Verification — ✅ PASSED

Plugin: compound-v3 | Language: rust
Source: skylavis-sky/onchainos-plugins@a4565195

Compiled from developer source code by our CI. Users install our build artifacts.

Build succeeded. Compiled artifact uploaded as workflow artifact.

---

Source integrity: commit SHA a4565195c3791a4787b53d943fbed706a24a848d is the content fingerprint.