Leading DeFi Protocol Compound Leaked Over $100 Million in Rewards

The Compound money-market protocol is recovering from a bug that caused it to distribute too much of its governance token COMP to some users, though no deposited funds were at risk.

article-image
share

key takeaways

  • Over $51 million of the erroneously distributed COMP has been returned to the Compound treasury
  • The mishap points to decentralized governance as a double-edged sword

It started as a technocratic tweak to a long-running DeFi blue chip. “Proposal 62” voted on by holders of the Compound protocol’s governance token, COMP, was meant to give governance wider latitude in distributing incentives to lenders and borrowers.

Compound kicked off the 2020 “DeFi summer” with its then-novel use of liquidity mining following the debut of its COMP governance token in June of last year. With it, anyone providing or using liquidity in the money market protocol would earn COMP — lenders and borrows benefitted equally — rewards were split 50/50.

After a year of real-world testing, it became clear there were some unintended and deleterious side effects, particularly in non-stablecoin markets: WBTC (wrapped bitcoin), for example, could be borrowed at effectively a negative interest rate.

To address this problem, Proposal 62, enabled COMP rewards to be set heterogeneously across markets. It passed unanimously and went into effect on September 29.

Then, trouble:

Loading Tweet..

The protocol was paying out too much in COMP rewards to a subset of its users. It needed an immediate patch, first to pause all COMP distribution and then to repair the design flaw in Prop 62.

Compound Labs Inc., a Delaware corporation headquartered in San Francisco, originally developed the protocol, but in a move to decentralize control over its future evolution, they implemented a governance process of reviews, voting, and finally what’s known as a “timelock” on all changes approved by COMP token holders. The mechanism was aimed to prevent malicious code from being quickly rammed through and to move the company out of a primary decision-making role, but in this case, it also meant that any attempt to fix the bug would take at least seven days.

So, is decentralization partly to blame? The founder of Compound, Robert Leshner, doesn’t think so:

“This is not an event that calls into question whether DeFi can be operated safely. It’s a wake-up call for decentralized, community-run protocols to improve the processes by which changes are introduced,” Leshner told Bloomberg.

Leshner was quick to downplay the consequences of the bug on Twitter:

Loading Tweet..

A fix was passed through governance on October 7, and was executed on Saturday, stopping the COMP bleed.

In a typically DeFi twist, Leshner announced that 163,000 COMP tokens that were incorrectly claimed had been returned to the Compound community. That’s about $50 million worth of windfall tokens not taken. A further 130,000 — or roughly $40 million — that could have been expropriated, were left untouched. It’s as though the code to your front door security system was sent to everyone in your address book, along with a picture of the suitcase full of cash just inside, but no one wanted to turn the handle.

For now, there remain 200,000 COMP tokens that were in fact claimed and which have not been returned. That has the effect of diluting all holders of COMP.

Despite the slip-up, the COMP price has remained around $300 per token, without seeing a marked adverse reaction to its price.

Tags

Upcoming Events

Old Billingsgate

Mon - Wed, October 13 - 15, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

Industry City | Brooklyn, NY

TUES - THURS, JUNE 24 - 26, 2025

Permissionless IV serves as the definitive gathering for crypto’s technical founders, developers, and builders to come together and create the future.If you’re ready to shape the future of crypto, Permissionless IV is where it happens.

Brooklyn, NY

SUN - MON, JUN. 22 - 23, 2025

Blockworks and Cracked Labs are teaming up for the third installment of the Permissionless Hackathon, happening June 22–23, 2025 in Brooklyn, NY. This is a 36-hour IRL builder sprint where developers, designers, and creatives ship real projects solving real problems across […]

recent research

Featured.png

Research

Helium stands at a pivotal moment in its evolution as a decentralized wireless network, balancing rapid growth, economic restructuring, and global expansion. With accelerated growth in domestic DAUs and Hotspots supporting its network, Helium is leveraging strategic partnerships and innovative proposals to scale internationally. The recent implementation of HIP 138, “Return to HNT,” has unified its token economy under HNT, simplifying participation and strengthening liquidity, while HIP 139’s phase-out of CBRS refocuses efforts on scalable Wi-Fi offload. Meanwhile, governance shifts under HIP 141 raise questions about centralization as Nova Labs consolidates control over the roadmap.

article-image

In 2011, WikiLeaks faced a financial blockade imposed by the US government. It was Bitcoin’s first major test.

article-image

Kado’s founder Emery Andrew spoke to Blockworks about the acquisition and what’s next for the team

article-image

LayerZero’s Bryan Pellegrino chatted with Blockworks about the firm’s next steps and its 10-year runway

article-image

Colosseum co-founder Matty Taylor is seeing “high-performance [Solana] founders showing a lot of interest in private trading technology”

article-image

Executives weigh the growth potential they see in the public stock and private credit/equities arenas

article-image

Players can stake ME, trade tokens and link wallets to climb the leaderboard