DeFi money market compound overpays millions in comp rewards in possible exploit; founder says $80m at risk

Compound erroneously paid out millions in liquidity mining rewards following an update to one of its smart contracts. In one transaction, $27 million was claimed.

In a possible exploit on Wednesday night, decentralized money market Compound has been erroneously paying out millions of dollars in COMP tokens intended as liquidity mining rewards.

Twitter user “napgener” first flagged the issue, pointing to three Ethereum transactions showing users receiving a total of $15 million in COMP tokens in exchange for borrowing and supplying tiny quantities of tokens, including USDC, ETH and DAI.

Some funky business happening on $COMP
possible rug in the @compoundfinance comptroller. ⚠️@rleshner https://t.co/IRTJIQnBEx

— napgener 0xbullmarket.eth (@napgener) September 29, 2021

Compound has a liquidity mining program that rewards depositors and borrowers, but often at a rate of a single-digit APY. The botched payout sums indicate a flaw in the comptroller contract, which disburses the COMP liquidity mining rewards, possibly related to a recent upgrade.

Observers have noted that Compound’s comptroller contract is not managed by a multi-sig controlled by Compound Labs, and any fix to the exploit may require a governance vote among COMP holders.

Per DeFi Llama, Compound is the world’s fifth-largest decentralized finance protocol with a total value locked (TVL) of $10.2 billion.

Compound acknowledged the exploit on its official Twitter handle and said no user funds are at risk:

Some funky business happening on $COMP
possible rug in the @compoundfinance comptroller. ⚠️@rleshner https://t.co/IRTJIQnBEx

— napgener 0xbullmarket.eth (@napgener) September 29, 2021

Likewise, Compound founder Robert Leshner acknowledged the exploit in a tweet, saying that “at worst” only 280,000 COMP tokens are at risk of being erroneously claimed.

He also noted that “there are no admin controls or community tools to disable the COMP distribution; any changes to the protocol require a 7-day governance process to make their way into production. Labs, and members of the community, are evaluating potential steps to patch the COMP distribution.”

Some funky business happening on $COMP
possible rug in the @compoundfinance comptroller. ⚠️@rleshner https://t.co/IRTJIQnBEx

— napgener 0xbullmarket.eth (@napgener) September 29, 2021

Shortly after Leshner’s tweet, at 1:38 UTC on Thursday, some 91,000 COMP tokens worth $27 million were claimed in a single transaction. The user appears to have supplied $0 in crypto assets to the platform; they paid $154.77 in gas fees to take in their dubious haul.

The same wallet then swapped $140,000 in COMP for USDC via Uniswap.

The price of COMP has plunged on the news, falling from a 24-hour high of $334 to as low as $290. At the time of this story’s latest update, it sits at $290, according to CoinGecko.

A request for comment sent to Compound Labs was not returned by press time.

UPDATE (Sept. 30, 1:23 UTC): Adds comments from Compound founder Robert Leshner.

UPDATE (Sept. 30, 2:02 UTC): Adds detail on subsequent transactions.

UPDATE (Sept. 30, 2:08 UTC): Changes headline.

UPDATE (Sept. 30, 2:11 UTC): Updates current price of COMP.