DeFi money market compound overpays millions in comp rewards in possible exploit; founder says $80m at risk
|Compound erroneously paid out millions in liquidity mining rewards following an update to one of its smart contracts. In one transaction, $27 million was claimed.
In a possible exploit on Wednesday night, decentralized money market Compound has been erroneously paying out millions of dollars in COMP tokens intended as liquidity mining rewards.
Twitter user “napgener” first flagged the issue, pointing to three Ethereum transactions showing users receiving a total of $15 million in COMP tokens in exchange for borrowing and supplying tiny quantities of tokens, including USDC, ETH and DAI.
Some funky business happening on $COMP
— napgener 0xbullmarket.eth (@napgener) September 29, 2021
possible rug in the @compoundfinance comptroller. ⚠️@rleshner https://t.co/IRTJIQnBEx
Compound has a liquidity mining program that rewards depositors and borrowers, but often at a rate of a single-digit APY. The botched payout sums indicate a flaw in the comptroller contract, which disburses the COMP liquidity mining rewards, possibly related to a recent upgrade.
Observers have noted that Compound’s comptroller contract is not managed by a multi-sig controlled by Compound Labs, and any fix to the exploit may require a governance vote among COMP holders.
Per DeFi Llama, Compound is the world’s fifth-largest decentralized finance protocol with a total value locked (TVL) of $10.2 billion.
Compound acknowledged the exploit on its official Twitter handle and said no user funds are at risk:
Some funky business happening on $COMP
— napgener 0xbullmarket.eth (@napgener) September 29, 2021
possible rug in the @compoundfinance comptroller. ⚠️@rleshner https://t.co/IRTJIQnBEx
Likewise, Compound founder Robert Leshner acknowledged the exploit in a tweet, saying that “at worst” only 280,000 COMP tokens are at risk of being erroneously claimed.
He also noted that “there are no admin controls or community tools to disable the COMP distribution; any changes to the protocol require a 7-day governance process to make their way into production. Labs, and members of the community, are evaluating potential steps to patch the COMP distribution.”
Some funky business happening on $COMP
— napgener 0xbullmarket.eth (@napgener) September 29, 2021
possible rug in the @compoundfinance comptroller. ⚠️@rleshner https://t.co/IRTJIQnBEx
Shortly after Leshner’s tweet, at 1:38 UTC on Thursday, some 91,000 COMP tokens worth $27 million were claimed in a single transaction. The user appears to have supplied $0 in crypto assets to the platform; they paid $154.77 in gas fees to take in their dubious haul.
The same wallet then swapped $140,000 in COMP for USDC via Uniswap.
The price of COMP has plunged on the news, falling from a 24-hour high of $334 to as low as $290. At the time of this story’s latest update, it sits at $290, according to CoinGecko.
A request for comment sent to Compound Labs was not returned by press time.
UPDATE (Sept. 30, 1:23 UTC): Adds comments from Compound founder Robert Leshner.
UPDATE (Sept. 30, 2:02 UTC): Adds detail on subsequent transactions.
UPDATE (Sept. 30, 2:08 UTC): Changes headline.
UPDATE (Sept. 30, 2:11 UTC): Updates current price of COMP.
Information on these pages contains forward-looking statements that involve risks and uncertainties. Markets and instruments profiled on this page are for informational purposes only and should not in any way come across as a recommendation to buy or sell in these assets. You should do your own thorough research before making any investment decisions. FXStreet does not in any way guarantee that this information is free from mistakes, errors, or material misstatements. It also does not guarantee that this information is of a timely nature. Investing in Open Markets involves a great deal of risk, including the loss of all or a portion of your investment, as well as emotional distress. All risks, losses and costs associated with investing, including total loss of principal, are your responsibility. The views and opinions expressed in this article are those of the authors and do not necessarily reflect the official policy or position of FXStreet nor its advertisers.