Compound Labs

Amount Lost: $71,101,556.00
Funds Returned: $0.00
Category: Borrowing and Lending
Date: 2021-9-30

Quick Summary

Compound's new proposal caused a loss of 237,000 $COMP tokens due to the smart contract issue

Details of the Exploit
Compound's governance Proposal 62 changed the distribution in the Comptroller contract to liquidity suppliers and borrowers from a previous 50:50 split to new governance proposed ratios:
https://compound.finance/governance/proposals/62

However, the Comptroller contract contains a bug, causing some users to receive too much COMP. The Comptroller received tokens for distribution from the Reservoir contract at:
https://etherscan.io/tx/0xe76167796646eb447cf53a72f1b912ad5028e64f8c8129b1a3fb71c1379f2322

84,000,000 in $COMP tokens are at risk

Approximately 237,000 $COMP tokens are already distributed between different addresses and can be calculated as a loss at the current moment.

Block Data Reference

Comptroller contract:
https://etherscan.io/address/0x3d9819210a31b4961b30ef54be2aed79b9c9cd3b

Reservoir contract:
https://etherscan.io/address/0x2775b1c75658be0f640272ccb8c72ac986009e38

List of addresses, which claimed a huge amount of tokens:
https://twitter.com/0xngmi/status/1443442885618278407

Proof Links:

FilesExpand file tree

Compound-Labs-2.md

Latest commit

History

Compound-Labs-2.md

File metadata and controls

Compound Labs