Compound V2 Hack

What happened

On September 29, 2021, Compound Proposal 62 changed COMP reward accounting and introduced a bug that allowed excessive reward claims. The affected asset was COMP distributed by the Comptroller. In its October 14 update, Compound reported 163,000 COMP returned, 130,000 still in the Comptroller and about 200,000 misallocated COMP outstanding.

Technical root cause

Missing equality checks in reward-index initialization caused excessive COMP accrual. Proposal 64 changed the initialization comparisons to >=; it did not reverse previously distributed rewards.

How it happened

1. Proposal 62 separated COMP distribution speeds for suppliers and borrowers.
2. An initialization condition used > where >= was needed. Accounts at the initial market index could remain under-initialized and accrue excessive rewards.
3. Interacting with affected markets or claiming rewards could transfer more COMP than intended.
4. Proposal 64 patched the comparisons and temporarily blocked potentially affected reward transfers. Further accounting corrections were proposed through Proposal 65.

Protocol details

Classification Protocol Logic / Reward Accounting

Protocol Type Lending

Affected asset / contract COMP

Implementation language Solidity

Protocol links Website @compoundfinance

Security review history

• Trail of Bits View report
• OpenZeppelin View report

Evidence

• report Post-mortem rekt.news
• report @rleshner incident report twitter.com
• transaction Sample erroneous COMP claim etherscan.io
• analysis Website reference archive.is
• analysis Website reference beincrypto.com
• analysis Website reference coindesk.com
• analysis DeFiLlama defillama.com
• analysis Compound Treasury Updates, COMP Bug Fix, Dynamic Risk Parameters compound.substack.com
• analysis Analysis of Proposal 64 comp.xyz
• analysis Compound Proposal 65: Correct Over-Accrued COMP comp.xyz

Understand the attack patterns

Compare incidents →

Arithmetic Overflow & Underflow Attacks