5 ms·

This bug happened to the crypto project Compound. I work for a crypto company that has a DeFi product that uses Compound. So I've been deep into following this

This bug happened to the crypto project Compound. I work for a crypto company that has a DeFi product that uses Compound. So I've been deep into following this since it started. The funds sent to users were "rewards" for using the platform. Compound didn't actually lose any user funds, it was Compound's "governance token" that was given out. Although user funds were not affected, billions of dollars have been pulled out of lending pools in Compound. It's really unusual for a crypto project to threaten users like this. Bugs happen all the time, heck, even giant thefts due to bugs happen all the time. Everyone usually just keeps right on doing whatever they were doing. Unfortunately the bug didn't just hand out tokens to people, it did so by messing up the stored accounting for those "lucky" users. Fixing it is not going to be trivial. Also, the tokens that it handed out already "belong" to people who had "earned" them, but not yet cashed them out. This means that once this bug is fixed, Compound is going to take the funds for this out of their own treasury to refill this so users can be paid (or face some amazing backlash). To change the smart contracts requires a community vote and a seven day period of review, voting, and timelock. This means that it's staying broken and handing out money for the next week, and people are racing to catch as much of it as they can. It's an all round mess.

phone8675309 5y ago
Wow, really sounds like this is the signal to everyone that Compound is too incompetent to be in the Dunning-Krugerrand pyramid scheme market.
vmception 5y ago
Hey can you elaborate on how to claim? I deposited some assets on Compound a year ago and I think I got the initial COMP airdrop Does this make me eligible for this glitch? There wasnt anything in the UI suggesting so, but I can skip the frontend and use the smart contract directly, with hex or bytecode if necessary Just not sure what to look for
- vmception 5y ago
  it looks like the claimComp(address) method and the claimComp(address, tokenAddresses[]) method can be used, but its only if you supplied to some pools in the past and I'm not sure which pools. Someone told me TrueUSD but I haven't been able to confirm and I can't tell which claim transactions onchain are results of the glitch versus normal Compound UI behavior from normal users so you would just make a transaction to the Compound Comptroller contract address with the hex data for that contract and method variables unfortunately it seems like there are multiple Comptrollers and its a little expensive to play around with on mainnet, I might branch off and try a few transactions in a local environment so I don't waste gas trying to figure it out on mainnet. But I really just want to be able to tell and its weird how hard it is to find these details with all of this reporting. Hope this space matures to the point where this is the baseline level of reporting.
  - vmception 5y ago
    okay, so the main comprotroller address is fine but you had to still be supplying or borrowing, you can probably still do this now, as for some reason the comptroller still gets refilled. it seems like anybody can refill it if it gets empty. due to a "timelock" that the Compound team implemented to increase confidence in the security of the system, it also takes that amount of time to fix this issue lol.. they could really get drained if people were paying more attention
forty 5y ago
The fact that you can give away millions by mistake and do nothing about it then break the systems then do not much about it says a lot about crypto currency practicality ;) I wonder when this madness is going to stop.
- sumedh 5y ago
  > it says a lot about crypto currency practicality Isnt that a feature not a bug? You dont want a central authority like a govt or a corporation messing with your money(tokens)
  - forty 5y ago
    I'm pretty sure I do want people and banks to be able to get back millions they have given away because of a bug :)
    - sumedh 5y ago
      yes that is a valid point but there are others who dont want that because then the central authority can take away your money or stop payments send to you just because they dont like you like what happened to Wikileaks.
      - forty 5y ago
        Yes, it's true that in case you are in the legendary fascist state that steals your money but allows you the hide your money in crypto currency it can be useful ;) it reminds me of https://xkcd.com/538/ https://xkcd.com/538/ (note that I do not count government taxes in democratic countries as stealing, while I do think tax avoidance is stealing in that case).
        bradwood 5y ago
        And what would you call the US dollar's monetary expansion of over 40% [1] since the start of the pandemic, if not stealing? The Cantillon Effect has never been stronger, but those that continue to measure their financial worth in a unit of account that is shrinking in its purchasing power every day are missing the point. The system _is_ stealing your savings! [1]: https://fred.stlouisfed.org/series/M1SL https://fred.stlouisfed.org/series/M1SL
Havoc 5y ago
>It's an all round mess. It's a tiny fraction of their market cap. Mistakes happen and are fixable. The CEOs reaction on the other hand is a complete write-off. Threatening to harm users for a situation that isn't their doing but rather yours? Childish at best
908087 5y ago
> Bugs happen all the time, heck, even giant thefts due to bugs happen all the time. Everyone usually just keeps right on doing whatever they were doing. What a great advertisement this is for crypto.
Apofis 5y ago
Trustless Distributed Finance sounds like money to me, if I was a hacker. Considering the forum we're on and what we know to be the actual state computer security (hint: it's theater), it's pretty laughable.

phone8675309 5y ago

Wow, really sounds like this is the signal to everyone that Compound is too incompetent to be in the Dunning-Krugerrand pyramid scheme market.

vmception 5y ago

Hey can you elaborate on how to claim? I deposited some assets on Compound a year ago and I think I got the initial COMP airdrop Does this make me eligible for this glitch? There wasnt anything in the UI suggesting so, but I can skip the frontend and use the smart contract directly, with hex or bytecode if necessary Just not sure what to look for

vmception 5y ago
it looks like the claimComp(address) method and the claimComp(address, tokenAddresses[]) method can be used, but its only if you supplied to some pools in the past and I'm not sure which pools. Someone told me TrueUSD but I haven't been able to confirm and I can't tell which claim transactions onchain are results of the glitch versus normal Compound UI behavior from normal users so you would just make a transaction to the Compound Comptroller contract address with the hex data for that contract and method variables unfortunately it seems like there are multiple Comptrollers and its a little expensive to play around with on mainnet, I might branch off and try a few transactions in a local environment so I don't waste gas trying to figure it out on mainnet. But I really just want to be able to tell and its weird how hard it is to find these details with all of this reporting. Hope this space matures to the point where this is the baseline level of reporting.
- vmception 5y ago
  okay, so the main comprotroller address is fine but you had to still be supplying or borrowing, you can probably still do this now, as for some reason the comptroller still gets refilled. it seems like anybody can refill it if it gets empty. due to a "timelock" that the Compound team implemented to increase confidence in the security of the system, it also takes that amount of time to fix this issue lol.. they could really get drained if people were paying more attention

forty 5y ago

The fact that you can give away millions by mistake and do nothing about it then break the systems then do not much about it says a lot about crypto currency practicality ;) I wonder when this madness is going to stop.

sumedh 5y ago
> it says a lot about crypto currency practicality Isnt that a feature not a bug? You dont want a central authority like a govt or a corporation messing with your money(tokens)
- forty 5y ago
  I'm pretty sure I do want people and banks to be able to get back millions they have given away because of a bug :)
  - sumedh 5y ago
    yes that is a valid point but there are others who dont want that because then the central authority can take away your money or stop payments send to you just because they dont like you like what happened to Wikileaks.
    - forty 5y ago
      Yes, it's true that in case you are in the legendary fascist state that steals your money but allows you the hide your money in crypto currency it can be useful ;) it reminds me of https://xkcd.com/538/ https://xkcd.com/538/ (note that I do not count government taxes in democratic countries as stealing, while I do think tax avoidance is stealing in that case).
      - bradwood 5y ago
        And what would you call the US dollar's monetary expansion of over 40% [1] since the start of the pandemic, if not stealing? The Cantillon Effect has never been stronger, but those that continue to measure their financial worth in a unit of account that is shrinking in its purchasing power every day are missing the point. The system _is_ stealing your savings! [1]: https://fred.stlouisfed.org/series/M1SL https://fred.stlouisfed.org/series/M1SL

Havoc 5y ago

>It's an all round mess. It's a tiny fraction of their market cap. Mistakes happen and are fixable. The CEOs reaction on the other hand is a complete write-off. Threatening to harm users for a situation that isn't their doing but rather yours? Childish at best

908087 5y ago

> Bugs happen all the time, heck, even giant thefts due to bugs happen all the time. Everyone usually just keeps right on doing whatever they were doing. What a great advertisement this is for crypto.

Apofis 5y ago

Trustless Distributed Finance sounds like money to me, if I was a hacker. Considering the forum we're on and what we know to be the actual state computer security (hint: it's theater), it's pretty laughable.