In a possible exploit on Wednesday night, decentralized money market Compound has been erroneously paying out millions of dollars in COMP tokens intended as liquidity mining rewards.
Twitter user “napgener” first flagged the issue, pointing to three Ethereum transactions showing users receiving a total of $15 million in COMP tokens in exchange for borrowing and supplying tiny quantities of tokens, including USDC, ETH and DAI.
Some funky business happening on $COMP
possible rug in the @compoundfinance comptroller. ⚠️@rleshner https://t.co/IRTJIQnBEx— napgener 0xbullmarket.eth (@napgener) September 29, 2021
Compound has a liquidity mining program that rewards depositors and borrowers, but often at a rate of a single-digit APY. The botched payout sums indicate a flaw in the comptroller contract, which disburses the COMP liquidity mining rewards, possibly related to a recent upgrade.
Observers have noted that Compound’s comptroller contract is not managed by a multi-sig controlled by Compound Labs, and any fix to the exploit may require a governance vote among COMP holders.
Per DeFi Llama, Compound is the world’s fifth-largest decentralized finance protocol with a total value locked (TVL) of $10.2 billion.
Compound acknowledged the exploit on its official Twitter handle and said no user funds are at risk:
🚨 Unusual activity has been reported regarding the distribution of COMP following the execution of Proposal 062.
No supplied/borrowed funds are at risk — Compound Labs and members of the community are investigating discrepancies in the COMP distribution.
— Compound Labs (@compoundfinance) September 29, 2021
Likewise, Compound founder Robert Leshner acknowledged the exploit in a tweet, saying that “at worst” only 280,000 COMP tokens are at risk of being erroneously claimed.
He also noted that “there are no admin controls or community tools to disable the COMP distribution; any changes to the protocol require a 7-day governance process to make their way into production. Labs, and members of the community, are evaluating potential steps to patch the COMP distribution.”
A few hours ago, Proposal 62 went into effect, updating the Comptroller contract, which distributes COMP to users of the protocol.
The new Comptroller contract contains a bug, causing some users to receive far too much COMP. https://t.co/Fy6nLgDqKy
— Robert Leshner (@rleshner) September 30, 2021
Shortly after Leshner’s tweet, at 1:38 UTC on Thursday, some 91,000 COMP tokens worth $27 million were claimed in a single transaction. The user appears to have supplied $0 in crypto assets to the platform; they paid $154.77 in gas fees to take in their dubious haul.
The same wallet then swapped $140,000 in COMP for USDC via Uniswap.
The price of COMP has plunged on the news, falling from a 24-hour high of $334 to as low as $290. At the time of this story’s latest update, it sits at $290, according to CoinGecko.
A request for comment sent to Compound Labs was not returned by press time.
This is a developing story and will be updated.
UPDATE (Sept. 30, 1:23 UTC): Adds comments from Compound founder Robert Leshner.
UPDATE (Sept. 30, 2:02 UTC): Adds detail on subsequent transactions.
UPDATE (Sept. 30, 2:08 UTC): Changes headline.
UPDATE (Sept. 30, 2:11 UTC): Updates current price of COMP.
Source: Coindesk
Original Post: DeFi Money Market Compound Overpays Millions in COMP Rewards in Possible Exploit; Founder Says M at Risk
