Decentralized finance platform Compound mistakenly sent it's users about $90-million-worth of cryptocurrency after an upgrade went wrong. The CEO of the company later begged it's user to voluntarily return the crypto tokens to the platform
“If you received a large, incorrect amount of COMP from the Compound protocol error: Please return it,” Robert Leshner, founder of Compound Labs, tweeted late Thursday. “Keep 10% as a white-hat. Otherwise, it’s being reported as income to the IRS, and most of you are doxxed,” continued the tweet.
On Wednesday, Compound rolled out an upgrade. But soon after implementation, it was clear that something had gone seriously wrong.“The new Comptroller contract contains a bug, causing some users to receive far too much COMP,” explained Leshner in a tweet. “There are no admin controls or community tools to disable the COMP distribution; any changes to the protocol require a 7-day governance process to make their way into production,” he added, indicating that no fix could take effect for a week.
Leshner said the impact was limited to 280,000 COMP tokens, which on Friday were worth about $89.3 million. “This is not an event that calls into question whether DeFi can be operated safely. It's a wake up call for decentralized, community-run protocols to improve the processes by which changes are introduced,” Leshner said.
Many users of Compound claimed they received tokens, Leshner on Twitter even threatened to reveal their identities to the Internal Revenue Service if they didn't return most of them. But later he apologized for the threat.
“Open source, decentralized protocols are early & hard. But every hiccup leads to a more anti-fragile system,” Leshner wrote.
Gupta, a core developer at decentralized crypto exchange SushiSwap, said in a tweet that the entire episode could be blamed on a “one-letter bug” in the code.