Developer Discovers Vulnerability in Compound Protocol
A pseudonymous developer known as ‘KP’ recently uncovered a vulnerability in Compound’s v3 protocol, also known as Comet. While the vulnerability would have allowed a hacker to steal user funds, it would have been unprofitable due to the high gas fees involved. KP promptly reported the bug to Compound and OpenZeppelin, along with a proof-of-concept simulation of the attack. The bug was quickly patched, and KP requested a bug bounty reward of $125,000 from Compound DAO.
Proposal for Bug Bounty Reward
In KP’s proposal to Compound DAO, they emphasized the importance of bug bounties in motivating security researchers and developers. KP also mentioned that they were developing a startup on the Comet protocol and that the reward would greatly support their efforts. The proposal received endorsements from Kevin Cheng, head of protocol at Compound Labs, and Michael Lewellen, head of solutions architecture at OpenZeppelin.
The Vote Falls Short
Despite receiving support from the majority of delegates, the vote for the bug bounty reward failed due to falling short of the required quorum. VC firm Andreesen-Horowitz made a last-minute vote in favor but it wasn’t enough. Compound’s bug bounty program guidelines state that rewards are determined at their discretion.
Supporters and Resubmission
Wintermute supported KP’s cause, while Polychain, the largest holder of COMP tokens, did not register any vote. KP has resubmitted the proposal with a reduced reward request of $100,000.
Hot Take: A Missed Opportunity for Incentivizing Security Research
Compound DAO’s failure to approve KP’s bug bounty request highlights the challenges faced by developers who contribute to the security and improvement of decentralized protocols. By rejecting the request, Compound DAO missed an opportunity to incentivize security research and strengthen its ecosystem. The decision may discourage future researchers from reporting vulnerabilities, potentially leaving the protocol more exposed to attacks. It is crucial for decentralized platforms to recognize and reward the efforts of developers like KP to ensure the ongoing security and development of their ecosystems.
By
By
By
By