Another $66 million was added to a defective Compound Finance contract put in place to disburse liquidity mining rewards, of which a third was exploited. The reason? The same glitch that drained $80 million in tokens from Compound last week. On Sunday morning, the Yearn.Finance DeFi developer ‘banteg’ tweeted that the remaining $44 million was also at risk.
Claims were from MakerDAO
Two Ethereum addresses claimed tokens worth about $17 million at approximately 9:30 AM EDT. Both claims came from the MakerDAO DSProxy factory. A further three claims brought the total to $22 million. MakerDAO reps have not commented.
{"partnerselectiontype":"list","curatedpartners":"[object Object]","showmorelimit":"3","layout":"default","table":"{"partnerListId":"19e2e843-40e0-4091-aec9-8fbc6e35ebcb","partnerType":"cryptoBroker","partners":[{"id":"d94c30fd-c016-401e-af60-8ed60af660cf","name":"Plus500 CFD Broker","slug":"plus500","logo":{"url":"https://storage.googleapis.com/moneturn-uploads/uploads/2022/02/1645707397-l00zoysvUG0ZXHOGJW.svg","height":100,"width":100},"defaultRating":98,"colors":{"primary":null,"secondary":null},"website":"plus500.com","reviewUrl":null,"disclaimer":"82% of retail investor accounts lose money when trading CFDs with this provider. You should consider whether you can afford to take the high risk of losing your money.
","restrictedCountries":["CA","MX"],"attributes":{},"tableRowLabel":""}],"displayAttributes":[]}"}Attempts to hush up the bug
According to Yearn.Finance core contributor banteg, the Compound community had known that it was possible to top off the bugged contract for a few days, but wanted to hush it up in the hope that nobody would find out.
Immediate upgrades not possible on Compound
Immediate upgrades are not possible on Compound because their contracts lack a multi-signature scheme. You can’t make changes before a governance process period of seven days has passed. This is why it’s not possible to patch the faulty code now.
Compound is pleading with remaining community members to return the tokens lost in the initial hit. Robert Leshner, founder of Compound Labs, tweeted:
If you received a large, incorrect amount of COMP from the Compound protocol error: Please return it. Keep 10% as a white-hat. Otherwise, it’s being reported as income to the IRS, and most of you are doxed.
On the day of the news, COMP plummeted by almost 13%, but recovered later. The community is debating on what users should do with the mistakenly received funds. Leshner sees it in the simplest terms: people will either return them or they won’t. Users of some exchanges are starting to return some of the funds.
Added funds are also at risk
More funds are being added to the contract at the time of publication. Community members are using a function to add funds from the Compound Reservoir to the Comptroller contract. This poses a risk to the added funds.
Banteg told CoinDesk that more and more addresses could make claims emptying the reservoir despite initial estimates that the impact of the exploit was just 25% of the recently added $66 million. It seems risks continue to increase. If that’s not bad enough, the COMP token has lost more than 5% in the last 24 hours.
