{"id":1525,"date":"2021-10-04T09:12:26","date_gmt":"2021-10-04T08:12:26","guid":{"rendered":"https:\/\/tradersofcrypto.com\/news\/?p=1525"},"modified":"2021-10-04T09:12:26","modified_gmt":"2021-10-04T08:12:26","slug":"compound-comp-slides-with-ongoing-reward-exploit","status":"publish","type":"post","link":"https:\/\/tradersofcrypto.com\/news\/compound-comp-slides-with-ongoing-reward-exploit\/","title":{"rendered":"Compound (COMP) Slides with Ongoing Reward Exploit"},"content":{"rendered":"\n<p>Compound (COMP) has entered a risky stretch, after a smart contract was found to be exploitable and distributed more rewards than previously intended. The last noted event where COMP was distributed happened this Sunday, taking away $12M in tokens.&nbsp;<\/p>\n\n\n\n<p>The exploit, which was first noted in the middle of last week, caused a loss estimate of above $100M. The news caused COMP to slump by more than 7% overnight, despite the overall market recovery.&nbsp;<\/p>\n\n\n\n<p>COMP traded at $317.11, a level about 14% lower compared to last week. COMP may be under pressure in the coming days, as more than $45M worth of tokens have been produced by the contract, and there are multiple eligible addresses that could access the outsized rewards.\u00a0<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Exploit Cannot be Stopped Immediately<\/strong><\/h3>\n\n\n\n<p>The resolution of the flawed contract is still uncertain, and there is a conflict between Compound users wanting to protect the protocol, and those that want to profit from the unusual rewards. The latter may cause outsized selling, further depressing the COMP market price.&nbsp;<\/p>\n\n\n\n<p>COMP is a deliberately scarce token, with a total supply of just 10M. Despite the exploit, there are just around 5.5M COMP in circulation. Most of the COMP activity remains within DeFi protocols, though some of the newly released tokens may be dumped on exchanges. <a href=\"https:\/\/tradersofcrypto.com\/exchanges\/binance\/\">Binance trading<\/a> pairs against USDT are a significant liquidity boost for COMP.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Fixing Smart Contract Hinges on Community Vote<\/strong><\/h3>\n\n\n\n<p>All decisions on the Compound protocol and smart contract activity are completed after voting. Right after a voting proposal changed the distribution of liquidity provider rewards, the potential for exploit was noticed.&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter\"><div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\"><p lang=\"en\" dir=\"ltr\">\ud83d\udea8 Unusual activity has been reported regarding the distribution of COMP following the execution of Proposal 062.<br><br>No supplied\/borrowed funds are at risk &#8212; Compound Labs and members of the community are investigating discrepancies in the COMP distribution.<\/p>&mdash; Compound Labs (@compoundfinance) <a href=\"https:\/\/twitter.com\/compoundfinance\/status\/1443359184897069060?ref_src=twsrc%5Etfw\">September 29, 2021<\/a><\/blockquote><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script>\n<\/div><\/figure>\n\n\n\n<p>The resolution of the bug hinges on accepting two more community proposals, which may take a few more hours.&nbsp;<\/p>\n\n\n\n<p>During the last remaining hours, it is possible more funds are at risk. Analysis by an expert related to the Yield DeFi platform shows that the smart contract and a risky function are still active for Compound. As the problem becomes more known, new calls to distribute COMP may appear.&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter\"><div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\"><p lang=\"en\" dir=\"ltr\">Update: with some numbers on the <a href=\"https:\/\/twitter.com\/search?q=%24COMP&amp;src=ctag&amp;ref_src=twsrc%5Etfw\">$COMP<\/a> at risk and numbers on the returned amounts (quite a lot!). drip() hadn\u2019t been called in weeks, but now.. <a href=\"https:\/\/t.co\/gKBY7z1Gpr\">https:\/\/t.co\/gKBY7z1Gpr<\/a> <a href=\"https:\/\/t.co\/ue9GIpjDZE\">pic.twitter.com\/ue9GIpjDZE<\/a><\/p>&mdash; drnick (@DrNickA) <a href=\"https:\/\/twitter.com\/DrNickA\/status\/1444771434828554246?ref_src=twsrc%5Etfw\">October 3, 2021<\/a><\/blockquote><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script>\n<\/div><\/figure>\n\n\n\n<p>It is possible that the coming week may put even more pressure on Compound and its native token, as the public drip() function makes it possible for even more addresses to drain COMP reserves.<\/p>\n\n\n\n<p>The function is now making calls on the Reservoir, where COMP for rewards is sitting, thus speeding up the schedule of distributing rewards.&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter\"><div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\"><p lang=\"en\" dir=\"ltr\">The Reservoir contract holds the majority of COMP reserved for users, and drips 0.50 COMP\/block into the protocol.<br><br>Nobody had called the function in weeks, and community developers were hopeful that Proposal 63 or 64 (in governance) could go into effect before it was called. <a href=\"https:\/\/t.co\/FK3sew2W0b\">https:\/\/t.co\/FK3sew2W0b<\/a><\/p>&mdash; Robert Leshner (@rleshner) <a href=\"https:\/\/twitter.com\/rleshner\/status\/1444691278986457095?ref_src=twsrc%5Etfw\">October 3, 2021<\/a><\/blockquote><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script>\n<\/div><\/figure>\n\n\n\n<p>The ability to drain the Reservoir through a smart contract extends the COMP at risk to an estimated 490,000 tokens. Distributing those rewards before schedule may limit the ability of COMP to incentivize liquidity providers in the future, thus undermining the attractiveness of the protocol.<\/p>\n\n\n\n<p>The Compound Reservoir address has been drained of 204,305 COMP in the past seven days, of which some coins may be released based on the usual schedule, but also due to attempting to remove the coins faster.&nbsp;<\/p>\n\n\n\n<p>The Reservoir address holds more than 2.9M COMP as of October 4. Records on the Ethereum blockchain show calls to the drip() function continue over the past few hours. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"942\" height=\"500\" src=\"https:\/\/tradersofcrypto.com\/news\/wp-content\/uploads\/2021\/10\/Drip_call-942x500.png\" alt=\"\" class=\"wp-image-1526\" srcset=\"https:\/\/tradersofcrypto.com\/news\/wp-content\/uploads\/2021\/10\/Drip_call-942x500.png 942w, https:\/\/tradersofcrypto.com\/news\/wp-content\/uploads\/2021\/10\/Drip_call-300x159.png 300w, https:\/\/tradersofcrypto.com\/news\/wp-content\/uploads\/2021\/10\/Drip_call-768x408.png 768w, https:\/\/tradersofcrypto.com\/news\/wp-content\/uploads\/2021\/10\/Drip_call.png 1366w\" sizes=\"auto, (max-width: 942px) 100vw, 942px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Can COMP Affect DeFi<\/strong><\/h3>\n\n\n\n<p>The exact fallout of the Compound exploit is still being estimated. The Compound protocol locks in more than $9B in value, or above 10% of the total value locked in Ethereum-based DeFi.&nbsp;<\/p>\n\n\n\n<p>Compound has lost some of its clout, falling down from its top position along with Maker (DAO).<\/p>\n\n\n\n<p>Compound may also have to rethink its community approach to code updates, as currently there is no emergency mechanism to stop the smart contracts. The proposal to reverse the faulty functions is still in its community discussion and voting stage.&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter\"><div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\"><p lang=\"en\" dir=\"ltr\">Proposal 064 by <a href=\"https:\/\/twitter.com\/Arr00c?ref_src=twsrc%5Etfw\">@Arr00c<\/a> <a href=\"https:\/\/twitter.com\/tylerether?ref_src=twsrc%5Etfw\">@tylerether<\/a> and other community members patches the bug introduced in Proposal 062, and resumes the COMP distribution for the majority of users.<br><br>Discussion: <a href=\"https:\/\/t.co\/xgMp2fB3pb\">https:\/\/t.co\/xgMp2fB3pb<\/a><br>Proposal: <a href=\"https:\/\/t.co\/yo4I0zed8e\">https:\/\/t.co\/yo4I0zed8e<\/a><\/p>&mdash; Compound Labs (@compoundfinance) <a href=\"https:\/\/twitter.com\/compoundfinance\/status\/1444327521810624513?ref_src=twsrc%5Etfw\">October 2, 2021<\/a><\/blockquote><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script>\n<\/div><\/figure>\n\n\n\n<p>For now, the COMP market price is within its usual level of fluctuation, as well as usual trading volumes above $260M in 24 hours.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>DeFi Exploits Hinge on Smart Contracts<\/strong><\/h3>\n\n\n\n<p>The Compound token distribution is not a true hack, as the feature to call on the smart contract is entirely accessible. But in the past week, other protocols showed that smart contracts remain the weakest spot in DeFi.&nbsp;<\/p>\n\n\n\n<p>One of the latest exploits was VeeFinance, which only days after its launch ran a smart contract with limited price discovery information, thus draining the deposited liquidity of <a href=\"https:\/\/tradersofcrypto.com\/news\/global-crypto-market-cap-touches-2t-bitcoin-and-ethereum-outperform\/\">BTC and ETH<\/a>.\u00a0<\/p>\n\n\n\n<p>Exploits may seek to drain the deposited liquidity, exploit decentralized trading pairs or seek other flaws in smart contracts. In the case of <a href=\"https:\/\/tradersofcrypto.com\/news\/vee-finance-exploit-uncovers-defi-limitations\/\">VeeFinance<\/a>, the smart contract was not open source, so the exact cause of the exploit was unknown.\u00a0<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>DeFi Still Shakes Off Losses<\/strong><\/h3>\n\n\n\n<p>The almost daily exploits of smaller and bigger DeFi protocols does not seem to affect the sector\u2019s growth. The rise of ETH market prices closer to the $3,400 range is boosting all pools and protocols.&nbsp;<\/p>\n\n\n\n<p>One of the sources of stability is the DeFi Saver protocol, which automates some of the collateral deposits to avoid liquidations during more significant price moves.&nbsp;<\/p>\n\n\n\n<p>DeFi Saver is one of the factors protecting Maker DAO.&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter\"><div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\"><p lang=\"en\" dir=\"ltr\">The <a href=\"https:\/\/twitter.com\/MakerDAO?ref_src=twsrc%5Etfw\">@MakerDAO<\/a> Risk Core Unit published an analysis of vault risk levels and we&#39;re happy and honoured to see that all DFS Automation users and their vaults are rated as low risk.\ud83d\ude4f<br><br>In their own words: &quot;Vaults being protected by DeFi Saver show a strong indication of security.&quot;\ud83d\udee1\ufe0f <a href=\"https:\/\/t.co\/mzHeFbfokF\">https:\/\/t.co\/mzHeFbfokF<\/a><\/p>&mdash; DeFi Saver (@DeFiSaver) <a href=\"https:\/\/twitter.com\/DeFiSaver\/status\/1442611149611151369?ref_src=twsrc%5Etfw\">September 27, 2021<\/a><\/blockquote><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script>\n<\/div><\/figure>\n\n\n\n<p>Despite the attempts to limit losses, DeFi remains one of the riskiest venues of holding digital assets. DeFi can be highly rewarding, but also lead to significant collateral losses, as well as unexpected exploits to steal coins and tokens.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The Compound (COMP) protocol is open to exploits, flooding the market with newly released tokens. The COMP token is under pressure until a fix for the flawed smart contract.<\/p>\n","protected":false},"author":3,"featured_media":1527,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[392,136,5,393],"class_list":["post-1525","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorised","tag-comp","tag-compound","tag-defi","tag-exploit","entry"],"_links":{"self":[{"href":"https:\/\/tradersofcrypto.com\/news\/wp-json\/wp\/v2\/posts\/1525","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tradersofcrypto.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tradersofcrypto.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tradersofcrypto.com\/news\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/tradersofcrypto.com\/news\/wp-json\/wp\/v2\/comments?post=1525"}],"version-history":[{"count":0,"href":"https:\/\/tradersofcrypto.com\/news\/wp-json\/wp\/v2\/posts\/1525\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/tradersofcrypto.com\/news\/wp-json\/wp\/v2\/media\/1527"}],"wp:attachment":[{"href":"https:\/\/tradersofcrypto.com\/news\/wp-json\/wp\/v2\/media?parent=1525"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tradersofcrypto.com\/news\/wp-json\/wp\/v2\/categories?post=1525"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tradersofcrypto.com\/news\/wp-json\/wp\/v2\/tags?post=1525"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}