DeFi Whales Execute $24 Million Governance Attack on Compound

Decentralized governance is often celebrated as the gold standard for managing protocols, but it appears to be susceptible to manipulation by “whales,” who may have less than stellar intentions. A recent incident involving the decentralized lending protocol, Compound Finance, highlights this vulnerability. 

Yesterday, a group of whales successfully passed a proposal to move $24 million from the Compound DAO for what some see as dubious “yield farming” strategies. They managed this by securing 682,191 COMP tokens, worth about $33 million at the time.

The proposal that was passed allows for a one-year investment of 499,000 COMP from Treasury funds into a vault named goldCOMP DeFi vault 1, which aims to generate interest on 5% of the Treasury’s non-interest-bearing COMP holdings. The group behind this proposal will control the vault and have the freedom to invest these funds as they see fit.

It is worth noting that this wasn’t the group’s first attempt to push through such a proposal. They had tried twice before; their first attempt on May 6 was rejected, but their latest attempt succeeded.

Despite the proposal’s acceptance, several key players in the Compound ecosystem raised their concerns. One of the largest market makers in the space, Wintermute, mentioned that the withdrawal actions are entirely controlled by the proposal team, meaning the DAO can’t retrieve the funds on its own terms.

A security researcher from OpenZeppelin expressed his opinion that the proposal could be classified as a governance attack if they continue trying to siphon funds from the protocol contrary to the wishes of the other Compound DAO delegates. 

This scenario has raised alarms that the group might be planning to borrow COMP at low rates to use for yield farming, without a guaranteed plan to return the funds. 

However, the leader of the group defended their actions, urging those against the proposal not to mislead the public by labeling their actions as theft, asserting that the investments are safeguarded through a Trust Setup that prohibits misusing the funds. 

Trus Setup defines a constrained set of actions that can only be executed with prior approval from Compound Governance through a process referred to as granting a “Phase”.

Interestingly, that the group, have allegedly engaged in similar governance manipulations for personal gain on other platforms like Balancer and Sushi.

Although their actions are technically legal, since they are passed through legitimate governance mechanisms, they set a worrying precedent where governance funds are used for personal gain, potentially risking the depletion of all funds. 

Following these developments, the price of COMP tokens has fallen by about 5% today, reflecting the community’s concerns about these governance challenges. 

How this issue will ultimately be resolved is still up in the air. This might paradoxically necessitate some level of centralization to counteract such proposals in the future.