Crypto comp: smart contract bug puts 134million at risk as founder craves return of tokens

[ad_1]

A glitch in a smart contract on the decentralized funding platform Compound left a pool of nearly $ 134 million in cryptocurrency up for grabs.

Last week, the DeFi platform mistakenly handed out around $ 77 million worth of Comp cryptocurrency to users after an upgrade went wrong and started handing out far more tokens than it does. was supposed to do it.

On Sunday, it emerged that the error was worse than expected, as an unidentified user took advantage of the bug to send an additional $ 59 million worth of Comp coins to a distribution pool known as the Comptroller.

Users were then able to remove the crypto from the controller, exploiting the same issue to take nearly $ 19 million in tokens.

Compound founder Robert Lescher took to Twitter to demand the return of the tokens, sparking controversy in the process by apparently threatening users with “doxx” – in this case, implying that Compound would send their contact details. to the tax authorities.

Lescher confirmed that the incident brought the total of the Comp at risk “to around 490k” on Sunday, which at the time of writing is worth € 133,995,524.

Founded in 2018, Compound is one of several DeFi platforms that use “smart contracts” to automate transactions.

How did it happen?

After the initial problem was discovered last Thursday, Comp users offered to fix it.

However, the “decentralized” nature of DeFi can mean that updates take a long time to filter through.

In the case of Compound, proposals need two days for review, three days for voting, and then two more days before they can be implemented, meaning a full week goes by before they are implemented. a change does not take place.

Lescher confirmed that there was nothing anyone could do to fix the bug faster, tweeting: “There are no admin controls or community tools to disable the Comp distribution; any change to the protocol requires a seven-day governance process to work its way into production. ”

The seven-day deadline gave users time to figure out how to exploit a function called “drip ()” to send more Comp to the controller pool for distribution, with users claiming thousands of tokens.

Information from the Ethereum Etherscan blockchain data service showed a significant spike in activity in the controller pool last Thursday, followed by another Sunday.

[ad_2]