Oracle Upgrade Leaves Compound's ETH Market Frozen for a Week

Compound's governance model produced another self-inflicted setback this week, echoing a prior episode in which the protocol's own processes had already caused financial damage.

On August 30, 2022, the community implemented Proposal 117, which upgraded the protocol's oracle contract from version 2 to version 3 and switched the anchor market reference from Uniswap v2 to Uniswap v3. The change had passed through three separate security audits, yet a defect in the new code caused transactions from ETH suppliers and borrowers to fail.

Compound's official account confirmed that the cETH market had become "temporarily frozen," adding that user funds were not in immediate danger but that the situation was still developing.

The root cause traced back to a structural difference between Compound's two flavors of interest-bearing tokens: cErc20 and cEther. According to Compound's own documentation, cErc20 wraps a standard ERC-20 token, whereas cEther wraps native Ether directly — meaning the functions handling asset transfers into the protocol are implemented with slightly different interfaces for each. That distinction, apparently, was overlooked when the new oracle logic was designed.

OpenZeppelin detailed the malfunction: the cETH contract lacks an underlying() method that the new oracle assumes exists on every cToken. As a result, calling getUnderlyingPrice against cETH returns undecodable empty bytes, causing the transaction to revert.

There was a silver lining. Even with the cEther market locked, users retained the ability to post collateral, meaning nobody faced forced liquidation because of the bug, and the incident had little visible effect on COMP's market price.

The oracle contract had already been reviewed by three firms — Dedaub, ABDK (reports here) and OpenZeppelin — the most recent report dated April 1, 2022. However, the final commit to the UniswapAnchoredView contract landed 26 days after that, apparently outside the scope of what had been reviewed.

The fix itself is simple — reverting to the previous oracle version — but Compound's governance timelock means the change cannot take effect for seven days, pending passage of Proposal 119.

This is not the first time Compound's insistence on rigid, fully on-chain governance has proven expensive. A year earlier, a separate glitch resulted in roughly $80 million in excess COMP being handed to depositors, with an additional ~$68 million following while the community waited for a governance fix to clear.

Costly mistakes are hardly unique to Compound, either. That same week, OptiFi Labs admitted it had accidentally shut down its own contract on Solana mainnet, permanently locking 661,000 USDC — most of it belonging to a team member. Separately, Crypto.com had recently drawn attention after mistakenly wiring a customer $10 million instead of $100, an error that went unnoticed for seven months.

Blunders like these, surfacing even at organizations operating under heavy public scrutiny, raise a fair question about whether fully on-chain governance helps or hinders crisis response. Decentralization purists tend to argue that a multisig safeguard undermines the whole point — but granting an emergency multisig temporary authority in moments like this might be a reasonable compromise.

Is a slow, deliberate response simply the price that comes with on-chain governance?