Compound's Proposal 62 bug
From Invertopedia, the encyclopedia of how things fail
Compound is a lending protocol whose rewards are paid in its COMP token. Proposal 62, which went live on September 29, 2021, was meant to let governance set reward rates market by market[1]. The new Comptroller code instead paid some users far too much COMP[1][2]. Because every change needed a seven-day review, the bug ran until a fix was executed in the second week of October[1][2][3].
What happened
| Sep 29, 2021 | Proposal 62 passes unanimously and takes effect.[1] |
|---|---|
| Sep 29 to 30, 2021 | ForkLog reports the protocol paid users $15 million in COMP for borrowing and supplying only a negligible amount, with one address receiving 91,000 COMP for providing zero liquidity and the worst case put at 280,000 COMP.[3] |
| Oct 8, 2021 | The fix is executed with 1,037,107 votes for and none against.[2] |
| Oct 11, 2021 | Blockworks reports 163,000 COMP returned to the community, and 200,000 still not returned.[1] |
The kill shot
A change to code that paid out real tokens went live with a bug, and the protocol had no fast way to turn rewards off.
ForkLog reported that there were no administrative controls or community tools to disable COMP distribution, and that any change needed a seven-day review before deployment[3]. Blockworks noted that a fix passed on October 7 and was executed the following Saturday[1]. Compound's own digest said the episode pushed the community toward more rigorous code testing and simulation before future proposals[2].
The inversion
Governance that cannot act for a week needs an emergency brake, and code that moves money needs to be simulated before the vote, not after it.
References
- ^ “Leading DeFi Protocol Compound Leaked Over $100 Million in Rewards”. Blockworks, October 11, 2021. What Proposal 62 was meant to do, the unanimous vote, the seven-day delay, the fix and the COMP returned and outstanding.
- ^ “Compound Treasury Updates, COMP Bug Fix, Dynamic Risk Parameters”. Compound Digest, October 14, 2021. Compound's own account of the bug, the Proposal 64 vote and the community response.
- ^ “Compound suffers multimillion-dollar losses due to protocol update bug”. ForkLog, September 30, 2021. The early reports of the bug, the $15 million and 91,000 COMP payouts, Leshner's worst case and the missing controls.