Compound Finance lost tokens on $22 Milln due to error in the contract – Bits Media

The Defi Compound Finance protocol was again injured due to error in the Comptroller contract, Distributing users of remuneration for liquidity mining. It is derived from the protocol $22 million.

Comptroller smart contract in the Compound Finance protocol is responsible for the distribution of COMP tokens in the process Liquidity mining. After activating the update last week, an error arose in the protocol, allowing some users to receive excessive awards. Then tokens were brought out of the protocol on $80 million.

According to the developer of Yearn.finance under the pseudonym Banteg, Yesterday, attackers called DRIP function() and transferred to the address COMPTROLLER 202 472 COMP value $68.8 million. Users managed to get tokens on $21.5 million.

The owner of one address received 37 504 COMP ($12 million), And the other - 14 995 COMP ($4.9 million). The money was in demand under contracts with MakerDao DSPROXY and are now on two separate addresses. Owners of other addresses received 9 499, 1 699 and 2 999 Comp - the total cost of tokens led out from the protocol reached approximately $22 million.

According to the founder of Compound Robert Leshner (Robert Leshner), MakerDao developers are actively helping in finding a solution to eliminate this error. As Leshner notes, In total, it turned out to 490 000 COMP, of them 136 000 Still in Comptroller, but 117 000 Already returned to the community.

According to the developer Banteg, The possibility of replenishing an erroneous contract was "known within a few days", But the plan of the community "was to be silent and hope, that no one will know about it ".

Compound contracts do not support the multipodisy scheme, which provides faster activation of the update - changes can be made only after the end of the seven -day approval process. This security architecture now serves as an obstacle to correcting erroneous code.

The community has disputes about, what users should do with the money received. Leshner divided the participants in the discussion into two categories: "Builders" Defi, who consider protocols like compound as a public good and return tokens to the community, and "maximalists arrived", who leave money for themselves and consider the error the problem of developers.

The transfer of tokens to the contract is still ongoing. Users call the function to add money to the Compound Reservoir Compound contract, potentially exposing risk tokens. The developer Banteg said, that the initial assessment of money, in danger, in $68 Milln may be incorrect. More addresses were discovered, which may require tokens and devastate the contract.

According to Coinmarketcap, The price of the COMP token over the past day has decreased by 7% to $316.