Compound's Reservoir Drains Again, Pushing the COMP Bug Past $147M

The damage from Compound's governance bug turned out to be far larger than initially assumed.

A week earlier, a flaw in the updated Comptroller contract had caused roughly $80 million in COMP to be mistakenly distributed to depositors. Compound's team downplayed the scale of the problem publicly, though internally they understood the situation could still get worse.

It did. A further ~$68.8 million has since flowed into the same vulnerable vault, resulting in even more COMP being erroneously handed out.

The reason the problem kept compounding: anyone could trigger the drip() function on Compound's Reservoir vault, which would top up the Comptroller and enable another round of faulty distribution. The Reservoir accrues COMP at a fixed rate of 0.5 tokens per block, and at the time the first incident surfaced, it had gone roughly two months without being tapped — leaving it holding over 200,000 COMP, worth close to $68 million.

Compound's team, led by Robert Leshner, could do little but wait and hope that the exposed Reservoir would go unnoticed while Proposal 64 — carrying the actual fix — worked its way through the governance process.

That hope didn't hold. Roughly three and a half days after the original incident, word got out that the Comptroller had been refilled, sending another $68.8 million worth of COMP into the same broken mechanism.

As Banteg summarized it:

If you tally the initial $80m, $22m already claimed after the drip and the $45m currently at risk, the bug tallies to $147m.

Despite being closer to an accounting error than a deliberate exploit, the scale of the loss earns Compound a spot on rekt's leaderboard — and it isn't the first protocol to land there after a self-inflicted mistake. Alchemix, for example, previously lost around $6.5 million to its own error. Like Leshner, the Alchemix team asked users to voluntarily return misdirected funds, and had considerably more success: 55% of the money came back, a recovery rate Compound looks unlikely to match.

The contrast suggests users tend to respond better to being asked politely than to being threatened with legal consequences.

That gap is especially stark set against Leshner's own past rhetoric. Reflecting on the Curve Wars, he had previously argued:

Crying to meatspace courts deeply undermines the "code is law" principles that DeFi was founded on.

If you want courts and politicians to protect and control you, there is "finance". If you want a system that is resilient, self-sufficient, open, and upgradable, there is DeFi.

Yet his response to this incident took a strikingly different tone. In an appeal to holders of the mistakenly distributed COMP, he wrote:

If you received a large, incorrect amount of COMP from the Compound protocol error:

Please return it to the Compound Timelock (0x6d903f6003cca6255D85CcA4D3B5E5146dC33925). Keep 10% as a white-hat.

Otherwise, it's being reported as income to the IRS, and most of you are doxxed.

Framed either as a threat or an offer, the message boiled down to: hand the funds back and keep a 10% reward, or face a 40% tax bill on the rest while keeping 60%.

Arguably, that ultimatum did more reputational harm to Compound than the financial loss itself. Leshner has since apologized for the remarks, though whether the damage to his standing can be undone remains an open question.

It's still unclear whether existing legal and financial frameworks are equipped to handle a system built around decentralized finance. For now, the episode is a reminder that embracing DeFi means accepting the responsibilities that come with it.