Whale Sabotages Compound DeFi Treasury in $24M Governance Attack

This article comes to you with the generous support of Betplay.io. Discover the excitement and rewards that await you at Betplay.io with a 100% welcome bonus and 10% weekly cashback!

Crypto Whale's $24M Heist Exposes Compound's Governance Flaws

Proposal 289, which narrowly passed with 51.84% in favor (682,191 votes) against 48.16% (633,636 votes) on July 28, 2024, sought to allocate 499,000 COMP tokens, valued at approximately $24 million, from Compound's treasury to the goldCOMP vault. This yield-bearing protocol, managed by the "Golden Boys" team, aimed to create a passive income stream for COMP holders by converting their tokens into goldCOMP tokens for liquidity pool yields.

The proposal quickly sparked allegations of a governance attack due to the concentrated voting power and narrow approval margin. Humpy, a prominent crypto whale, was accused of using his significant holdings to influence the vote, raising concerns about the security and integrity of Compound's governance system. Critics, including Michael Lewellen of OpenZeppelin, labeled Humpy's actions and those of the Golden Boys as malicious attempts to divert funds from the protocol.

Previous attempts to pass similar proposals had failed. Proposal 247, which requested 92,000 COMP, was withdrawn after facing strong resistance, while Proposal 279 was defeated with 83% voting against it. Consistent concerns were raised about the lack of control over funds once transferred to the vault and the insufficient governance discussion before initiating votes.

Critics emphasized the risks associated with transferring significant treasury funds without adequate safeguards. Wintermute Governance highlighted that the GoldenBoyzMultisig controlled any withdrawal actions, meaning the DAO could not recall funds at its discretion. The timing of the proposal over a weekend, when community activity might be lower, was seen as a strategic move to pass the vote with minimal opposition.

Despite Humpy defending the proposal by stating that the requested investment went through a trust setup with constraints that prevented stealing or diverting funds, skepticism remained. The controversy led to a more than 6% drop in COMP's price within 24 hours, highlighting market concerns and the need for stronger governance mechanisms within the DAO.

On July 30, 2024, Humpy announced the cancellation of Proposal 289, emphasizing the attention it brought to Compound and its native token. As part of a settlement, Compound Finance introduced a new staking product that will allocate 30% of existing and new market reserves annually to staked COMP holders. This new product will be governed by the Compound DAO and audited by a designated security partner, with continuous scrutiny from the DAO's Market Risk Manager.

The community, including DeFi risk manager Gauntlet, supported the new staking product and stressed the importance of improving governance security. Recommendations included implementing governance changes to prevent similar incidents and ensuring a healthy reserve ratio is maintained.

The governance controversy at Compound sparked broader discussions within the DeFi community about balancing decentralization and security. Curve Finance founder Michael Egorov highlighted Curve's governance model, which requires long-term token locking to mitigate governance attack risks, contrasting it with Compound's recent issues.

Humpy had previously been involved in similar controversial activities, including accumulating governance tokens in other DeFi protocols to push proposals that benefited his financial interests. The incident at Compound is compared to a 2022 event where Humpy allegedly manipulated Balancer's governance to redirect incentives to a pool he controlled.