DeFi Money Market Compound Overpays Millions in COMP Rewards in Possible Exploit; Founder Says $80M at Risk

Compound erroneously paid out millions in liquidity mining rewards following an update to one of its smart contracts. In one transaction, $27 million was claimed.

Sep 30, 2021 at 12:36 a.m. UTC
Updated Sep 30, 2021 at 1:38 p.m. UTC

Andrew Thurman is a tech reporter at CoinDesk with a focus on DeFi.

In a possible exploit on Wednesday night, decentralized money market Compound has been erroneously paying out millions of dollars in COMP tokens intended as liquidity mining rewards.

Twitter user “napgener” first flagged the issue, pointing to three Ethereum transactions showing users receiving a total of $15 million in COMP tokens in exchange for borrowing and supplying tiny quantities of tokens, including USDC, ETH and DAI.

Compound has a liquidity mining program that rewards depositors and borrowers, but often at a rate of a single-digit APY. The botched payout sums indicate a flaw in the comptroller contract, which disburses the COMP liquidity mining rewards, possibly related to a recent upgrade.

Observers have noted that Compound’s comptroller contract is not managed by a multi-sig controlled by Compound Labs, and any fix to the exploit may require a governance vote among COMP holders.

Per DeFi Llama, Compound is the world’s fifth-largest decentralized finance protocol with a total value locked (TVL) of $10.2 billion.

Compound acknowledged the exploit on its official Twitter handle and said no user funds are at risk:

Likewise, Compound founder Robert Leshner acknowledged the exploit in a tweet, saying that “at worst” only 280,000 COMP tokens are at risk of being erroneously claimed.

He also noted that “there are no admin controls or community tools to disable the COMP distribution; any changes to the protocol require a 7-day governance process to make their way into production. Labs, and members of the community, are evaluating potential steps to patch the COMP distribution.”

Shortly after Leshner’s tweet, at 1:38 UTC on Thursday (9:38 p.m. ET on Wednesday), some 91,000 COMP tokens worth $27 million were claimed in a single transaction. The user appears to have supplied $0 in crypto assets to the platform; they paid $154.77 in gas fees to take in their dubious haul.

The same wallet then swapped $140,000 in COMP for USDC via Uniswap.

The price of COMP has plunged on the news, falling from a 24-hour high of $334 to as low as $290. At the time of this story’s latest update, it sits at $290, according to CoinGecko.

A request for comment sent to Compound Labs was not returned by press time.

This is a developing story and will be updated.

UPDATE (Sept. 30, 1:23 UTC): Adds comments from Compound founder Robert Leshner.

UPDATE (Sept. 30, 2:02 UTC): Adds detail on subsequent transactions.

UPDATE (Sept. 30, 2:08 UTC): Changes headline.

UPDATE (Sept. 30, 2:11 UTC): Updates current price of COMP.

The Festival for the Decentralized World
Thursday - Sunday, June 9-12, 2022
Austin, Texas
Save a Seat Now

DISCLOSURE

Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

The leader in news and information on cryptocurrency, digital assets and the future of money, CoinDesk is a media outlet that strives for the highest journalistic standards and abides by a strict set of editorial policies. CoinDesk is an independent operating subsidiary of Digital Currency Group, which invests in cryptocurrencies and blockchain startups. As part of their compensation, certain CoinDesk employees, including editorial employees, may receive exposure to DCG equity in the form of stock appreciation rights, which vest over a multi-year period. CoinDesk journalists are not allowed to purchase stock outright in DCG.

CoinDesk - Unknown

Andrew Thurman is a tech reporter at CoinDesk with a focus on DeFi.

CoinDesk - Unknown

Andrew Thurman is a tech reporter at CoinDesk with a focus on DeFi.

Trending

1
CoinDesk - Unknown
The Fall of Terra: A Timeline of the Meteoric Rise and Crash of UST and LUNA

A detailed timeline of Terra's journey from its underdog start as a payments app in South Korea to a $60 billion crypto ecosystem to one of the biggest failures in crypto.

A detailed timeline of Terra's journey from its underdog start as a payments app in South Korea to a $60 billion crypto ecosystem to one of the biggest failures in crypto.

CoinDesk - Unknown
2
CoinDesk - Unknown
Coinbase Co-Founder Fred Ehrsam Buys the Dip, Purchases $75M of Company Stock

The buys were made via venture capital firm Paradigm, of which Ehrsam is a co-founder and managing partner.

The buys were made via venture capital firm Paradigm, of which Ehrsam is a co-founder and managing partner.

CoinDesk - Unknown
3
CoinDesk - Unknown
Dai Creator Rune Christensen on Terra's Collapse

The MakerDAO founder said on CoinDesk TV’s “First Mover” that he wasn’t in the mood to say “I told you so,” following Terra’s stablecoin collapse.

The MakerDAO founder said on CoinDesk TV’s “First Mover” that he wasn’t in the mood to say “I told you so,” following Terra’s stablecoin collapse.

CoinDesk - Unknown
4
CoinDesk - Unknown
There Was No Terra ‘Attack’

Conspiracy theories won’t save you from financial reality, says CoinDesk's chief insights columnist.

Conspiracy theories won’t save you from financial reality, says CoinDesk's chief insights columnist.

CoinDesk - Unknown