Compound Pauses YFI, ZRX, BAT and MKR Supply to Protect Against Potential Exploits

Attackers have recently been exploiting DeFi protocols by manipulating thinly traded tokens and eventually draining liquidity.

AccessTimeIconOct 25, 2022 at 3:47 p.m. UTC
Updated Oct 26, 2022 at 1:59 p.m. UTC
10 Years of Decentralizing the Future
May 29-31, 2024 - Austin, TexasThe biggest and most established global hub for everything crypto, blockchain and Web3.Register Now

Decentralized finance (DeFi) application Compound has paused the supply of four prominent tokens to protect users against a potential market manipulation attack – a new type of exploit that has seen over $100 million in stolen funds this month alone.

Tokens 0x (ZRX), yearn finance (YFI), basic attention token (BAT) and maker (MKR) will no longer be lent to users on Compound v2, the protocol’s latest version.

“An oracle manipulation-based attack analogous to the one that cost Mango Markets $117 [million] is much less likely to occur on Compound due to collateral assets having much deeper liquidity than MNGO and Compound requiring loans to be over-collateralized,” Paul Lei, a risk manager at modeling tool Gauntlet, wrote in the proposal on Tuesday.

“However, out of an abundance of caution, we propose pausing supply for the above assets, given their relative liquidity profiles,” Lei added.

The move came after a proposal floated by Compound’s governance community was passed Tuesday morning with over 99% of all voters in favor, with some 554,000 COMP staked to vote. Crypto data provider Gauntlet was the biggest voter, with some 126,000 COMP staked as votes, followed by Compound founder Robert Leshner, who staked some 70,000 COMP.

The proposal, floated initially in September, flagged low liquidity for the four tokens on Compound as a potential attack vector for market manipulation exploits.

Developers wrote at the time that attackers could manipulate lending markets on Compound to be able to illicitly borrow funds in excess of their holdings. They also flagged a more sophisticated strategy that would exploit the pricing difference on two assets that use different oracles, or third-party services that fetch data from outside a blockchain to within.

Market manipulations: The new crypto exploit strategy

Market manipulation led to a $100 million exploit on Solana-based trading and lending protocol Mango Markets earlier this month. The exploit helped bring more attention to the September proposal, which initially failed to garner much attention.

Mango, like other decentralized exchanges (DEX), relied on smart contracts to match trades between decentralized finance (DeFi) users. This is key to understanding how such exploits take place: Smart contracts are wholly decentralized and are not overseen by a centralized party – which means a rogue trader can deploy enough money to exploit loopholes in any protocol without the risk of anyone stepping in to stop the attack before it takes place.

In such exploits, rogue traders use initial funding to buy up a relatively illiquid spot token, which often leads to the prices of that token shooting up in a very short time span.

As spot prices increase, the rogue trader then uses the artificially inflated tokens as collateral to quickly borrow other tokens – with the motive of eventually draining all funds from the attacked protocol.

It’s important to note that the above manipulation strategy won't work on two centralized exchanges, because a trader placing high bids on one venue would mean prices automatically move higher on that exchange and other exchanges immediately raise the price of assets on their own systems – meaning the strategy is unlikely to net any profits.

Disclosure

Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by Block.one; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.

Shaurya Malwa

Shaurya is the Deputy Managing Editor for the Data & Tokens team, focusing on decentralized finance, markets, on-chain data, and governance across all major and minor blockchains.


Learn more about Consensus 2024, CoinDesk's longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to consensus.coindesk.com to register and buy your pass now.