DeFi Protocol Compound Finance Accidentally Rewards Users With $80M In Tokens Due To Smart Contract Bug

A new upgrade gone wrong has led to $80 million in losses for the decentralized finance protocol Compound Finance COMP/USD.

What Happened: After the deployment of Proposal 62 — originally intended to split COMP rewards distribution and bug fixes — Compound Finance reported some unusual activity.

“No supplied/borrowed funds are at risk — Compound Labs and members of the community are investigating discrepancies in the COMP distribution,” stated the protocol at the time.

Shortly after, some Compound users reported receiving as much as 70 million COMP tokens, worth around $20 million.

What’s going on here? 70 million $COMP?! pic.twitter.com/KmWl0m1H0Y

— Hachiro (@isthishiro) September 30, 2021

“The new Comptroller contract contains a bug, causing some users to receive far too much COMP,” explained Compound founder Robert Leshner.

“There are no admin controls or community tools to disable the COMP distribution; any changes to the protocol require a 7-day governance process to make their way into production,” he added.

Blockchain security researcher Mudit Gupta outlined an analysis of the incident on Twitter, calling it a “reverse rug pull.”

“A small change at one place can introduce a vulnerability at another,” he said.

Price Action: The price of COMP dipped by 12% to a low of $285 following the news. At press time, COMP was trading at $298.72, down 7.5%. Trading volume is up by 437% over 24 hours.

Photo: Giorgio Trovato on Unsplash.