Comb Compound $80 million token distribution error event

Compound Mistakenly distributed $80 million in tokens, fix bug takes seven more days

Azuma, The Daily Planet

September 30, head of a decentralized lending agreementCompoundAccording to Yu's official tweet, after the adoption and implementation of "Governance Proposal 062" today, a BUG was incorrectly sent in the upgrade contract, resulting in abnormal distribution of COMP tokens.

Specifically, the bug appears in the upgraded"Compound : Comptroller "(0x3d9819210A31b4961b30EF54bE2aeD79B9c9Cd3B) within the contractCOMP tokens that were supposed to be distributed slowly through the contract to all liquidity providers (debits, credits) were released in error, and some users received far more ComPs than normal. As shown in the figure below, only addresses beginning with 0x2e4ae have an address from"Compound : Comptroller received nearly 30,000 COMP tokens, worth about $9 million.

Vulnerability impact assessment

First of all, it is important to emphasize that, from the impact of the vulnerability, this time.Compound events only directly affect the expected returns of all liquidity providers, and users' deposits, loans and positions are theoretically unaffected, so there is no need to panic too much.

In addition, according to  Compound Founder & NBSP;Robert Leshner says,"Compound : The total amount of comPs in the Comptroller contract is limited, and more COMP tokens for mining distribution are actually another contract "Compound" : X2775b1c75658be0f640272ccb8c72ac986009e38 Reservoir "(0), the contract is still in the normal distribution at the speed of each block 0.5 pieces of COMP. At its most extreme, this is"Compound : When the tokens in the Comptroller contract are vacated, about 280,000 comps will be affected, with a total value of about $80m.

As far as the chain is concerned, right now"Compound : About 170,000 comps had been withdrawn from the "Comptroller" contract, leaving about 110,000 comps"Compound: ReservoirThe current operation of the contract is not abnormal, and  Leshner's story fits.

Cause of incident

The cause of this vulnerability lies in the above mentioned"Governance Proposal 062", which aims to adjust COMP allocations to different liquidity provision roles.

Under the agreement's operating rules, Compound will distribute 2,880 COMP tokens per day to all liquidity providers, half of which will be distributed to debits and half to lenders. However, in daily operation,Compound found that the 50-50 distribution did not take sufficient account of market demand, leading to distortions (such as negative interest rates). So on September 22nd, community members. Tyler Loewen in & have spentAn improvement proposal was submitted within the Compound Governance module to change this 50-50 allocation to a dynamic adjustment based on interest rates.

The starting point of the proposal is obviously positive, and the community's attitude towards the proposal is mainly supportive. About a week, that is, this morning, the proposal was successfully passed and implemented.

Unfortunately, code-level bugs are often this unpredictable. Although some other members of the community did.Tyler Loewen's upgrade code, and all upgrade contracts are already in Ethereum & NBSP;Ropsten's test network worked smoothly for a month, but the bugs still appeared.

Solution and process

Regarding the remedial work, Leshner himself has tweeted: "There are no administrative controls or community tools to interrupt the current abnormal distribution of COMP, and any changes at the protocol level will require a governance process of nearly a week to take effect. Compound Labs  and community members are currently evaluating possible ways to fix the release."

As it says, Compound has an established governance process:

· Any address can lock up to 100 comPs to initiate autonomy proposals, when the proposals have accumulated at least   65,000 COMP commissions will be upgraded to governance proposals, which will then enter the community referendum;

· The community referendum lasts for 3 days. When a proposal has the support of at least 400,000 COMPs (i.e., ≥4% of the supply) and a majority of people vote in favor of the proposal, the referendum will be approved.

· Proposals that pass the referendum will queue into the time lock and be formally executed after a 2-day time lock.

Combing through the entire process of governance, we can see that the referendum and the time lock process alone require at least 5 days, including the initial proposal and the time needed for the transition work of the process,Leshner wasn't exaggerating when he said one week.

As for the fact that there are no administrative controls to interrupt the current exception distribution of COMP,There is a Compound protocol for dealing with extremesCustody address of the situation (The Set Pause the Guardian, 0 xbbf3f1421d886e9b2c5d716b5192ac998af2012c), the address had previously been occupied by  Compound Labs held, but in August"Governance Proposal 057"Has been converted to multi-check control. However, for the time being, the guardianship address is only authorized in extreme casesThe suspension of deposits, borrowings and liquidations of the agreement does not explicitly mention whether they are available for use in the current situation.

The process has now been clarified, but what remedial action should be taken nowNo one givesspecificSolution. Community members have gathered at theOne was created in the Compound Governance ForumTopic discussion thread, intends to pass theGovernance Proposal 063"To perform the repair.Given the information released, there is a high probability that the distribution of the COMP will be suspended in advance (possibly via the guard address)?) until the full fix patch can be tested.

Lessons learned

As one of the pioneers of decentralized governance,The cause and treatment of the incident have come to light to a certain extentDAOB side of governance.

In our conventional wisdom, decentralization often means trading efficiency for equity. inDeFiWhen a protocol achieves complete decentralized governance and no single subject can modify the contract at will, mobilizing the community as a whole to participate in governance decisions often costs a lot of organizational energy and time, which is why.It took seven days for Compound to fix a bug that was clearly going to have a very negative impact on the agreement. In fact, among the many header DeFi protocols,Compound's seven-day governance cycle is not too slow,UniswapGo through a complete set of governance processesThe time cycle (poll -- consensus check -- governance vote -- time lock) takes at least half a month.

Then again, knowing that remediation is so costly after the fact, is there a need for stricter evaluation criteria for major contract upgrades before they happen? This is the first lesson the Compound community has learned since the incident -- community member Phaze Jeff started a discussion thread on the Governance Forum titled "Enforcing stricter reviews for major code Changes."

In particular, after community member Loewen submitted "Governance Proposal 062", too few community members participated in the testing work (which seems to be a common problem with most DeFi protocols), resulting in bugs being missed and"Release ". Therefore, Jeff believes in more careful monitoring of major updates to the protocol and encouraging more community members to participate in community work prior to mainnet deployment. In addition, Jeff mentioned the need to further clarify the specific permissions of multi-signed custody addresses to allow them to respond quickly in similar emergencies.

At present, the discussion on this topic is still in progress, interested friends can directly visitpostParticipate in the discussion.

The original link

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia