One-character bug gives away $90m in COMP tokens – recipients can keep 10% or consider themselves doxxed

Robert Leshner, founder of decentralized finance biz Compound Labs, has asked for the return of roughly $90m worth of COMP tokens after a smart contract bug distributed more of the cryptocurrency than it should have.

COMP tokens get distributed on a daily basis to users of the Compound protocol. They grant holders a say in the communal governance of the protocol, which is used for financial transactions like borrowing and lending with cryptocurrencies.

Decentralized finance relies on smart contracts that don’t necessarily live up to their name to handle transactions. That is to say, the code controlling these smart contracts often contains dumb mistakes.

“A few hours ago, Proposal 62 went into effect, updating the Comptroller contract, which distributes COMP to users of the protocol,” said Leshner on Wednesday, via Twitter. “The new Comptroller contract contains a bug, causing some users to receive far too much COMP.”

According to Leshner, at most 280,000 tokens were wrongly distributed. At the current COMP token value of about $322, that’s more than 90m US dollars.

On Thursday, Leshner pleaded for the tokens to be returned, offering to let Good Samaritans keep 10 per cent, and hinting at consequences for those who fail to comply.

He wrote:

Those discussing the incident on Compound’s Discord chat space note that recipients of the errant funds need to use the claimComp function manually to get the COMP tokens – the tokens won’t just show up in one’s account automatically. Some individuals have already done so – here’s a transaction claiming about $29m.

Discord chat participants also appear to be none too pleased with the doxxing threat. “Total clown show up in here,” one individual complained. “Protocol error and innocent people threatened w dox.”

Despite Leshner’s commitment to report windfall recipients to US tax authorities – as his company is presumably obligated to do under US tax law – some participants in the Compound community have already returned their accidental COMP riches. Others have suggested keeping the money and paying whatever tax is due on the COMP windfall would still be rather lucrative.

Meanwhile, Compound Proposition 63 is being reviewed and is scheduled to be voted on in a few days. It “disables the ability to claim COMP, until the correct distribution logic is restored.” That still leaves time for recipients of misdirected funds to cash in.

The bug, according to blockchain security researcher Mudit Gupta, consists of a single character: the Compound code update used a > operator where it should have used >=.

Compound Incident Analysis:

Compound upgraded their comptroller contract to https://t.co/mgLGKCywxf which had a one letter bug on L1217.

This led to a reverse rug pull in which Comptroller is giving away more rewards to (past) Suppliers than expected. 🧵👇 pic.twitter.com/BskHIibsUJ

— Mudit Gupta (@Mudit__Gupta) September 30, 2021

“The bug happens when someone supplies tokens for a market with zero comp rewards like cSUSHI, and cTUSD before the market is initialized or migrated,” said Gupta via Twitter. “supplyIndex for such tokens remains equal to compInitialIndex which means that the if block on is not triggered.”

By using the > operator rather than the >= operator, the if code block is not called and the supplierIndex variable stays at 0 while supplyIndex is 1e36. The delta, or difference between the two values, becomes 1e36 and the Compound protocol then pays out a reward for 1e36 indexes instead of zero.

In the Compound forum, developers discussing the incident believe it would be a good idea to commit to rigorous testing and auditing prior to major code changes. ®

Note: This article have been indexed to our site. We do not claim ownership or copyright of any of the content above. To see the article at original source Click Here

Related Posts
NASA hits up 7 space companies to take on orbital squad goals thumbnail

NASA hits up 7 space companies to take on orbital squad goals

NASA has announced Space Act agreements with seven private space companies in the hopes of spurring tech developments the government may invest in down the line, from space stations to human transport and robotics. While no money is changing hands, these partnerships are official collaborations, with NASA providing expertise and resources to aid and guide
Read More
OnePlus Ace 2 Pro touchscreen outperforms iPhone 14 when wet thumbnail

OnePlus Ace 2 Pro touchscreen outperforms iPhone 14 when wet

The Ace 2 Pro is expected to launch in China later this month, but global release details are unclear Aug 11, 20233:19 PM EDT 0 comments Although smartphone technology is constantly improving, one of the most annoying things about using a smartphone still remains how it behaves when it gets wet. Whether it’s from rain
Read More
Hardkernel reveals ODROID-H3 series SBCs with Intel Jasper Lake processors thumbnail

Hardkernel reveals ODROID-H3 series SBCs with Intel Jasper Lake processors

The ODROID-H3 series starts at US$129 with a Celeron N5105 processor. (Image source: Hardkernel)Hardkernel has announced the ODROID-H3 and ODROID-H3+, a pair of single-board computers powered by 10 nm Intel processors. Available from US$129, the ODROID-H3 series supports PCI3 Gen 3 SSDs and has plenty of I/O, among other features. Hardkernel has introduced the ODROID-H3
Read More
Over 1000 euros off the Acer Predator Helios 300 gaming laptop! thumbnail

Over 1000 euros off the Acer Predator Helios 300 gaming laptop!

Aujourd'hui, Amazon propose une excellente offre sur le PC gaming Predator Helios 300 de ACER avec un prix de 784 euros au lieu de 1799 euros, soit une réduction de 56% ! Amazon propose aujourd’hui une nouvelle offre XXL sur l’ordinateur Acer Predator Helios 300 avec une réduction de 1015 euros exactement ! Attention à…
Read More
Index Of News
Total
0
Share