Unplanned Protocol Maintenance

All users, and all funds are safe.

A few hours ago, a member of the community alerted our team to a potential defect in the Compound protocol. After analyzing the report, we have confirmed that (1) there is a defect that was undetected in the audit process, (2) a potential exploit exists, (3) the potential exploit has never been used, (4) it’s necessary to temporarily disable new borrowing, to eliminate risk to users.

We’ve deployed an updated interest rate model, 0x16c2a19edbc68780dfc03708bc9021ef34db2e33, that causes new borrowing transactions to revert, while allowing all supply, withdraw, repay, and liquidate transactions. The protocol will otherwise continue to function normally — supplying assets will continue to earn interest, etc.

Our north star, and the most important metric that we judge ourselves on is safety. Over the next few days, we will evaluate how to move the protocol forward; the options include a patch, or deploying another version of the protocol.

Thank you for your support, trust, and skepticism as we work in an experimental new technology. If you have any questions, join us in Discord — we look forward to hearing from you.

— Compound

12/15/18 Update — Borrowing Resumed

For the past week, we’ve been hard at work analyzing the defect, which exists for an edge case in the liquidation process — specifically, if a user attempts to liquidate their own account, an accounting discrepancy occurs.

We’re pleased to announce that we’ve designing a patch, which requires liquidations to come from a white-listed contract address, and have awarded a bug bounty to the developer who identified the defect.

Our team has deployed the following contracts, that collectively, return borrowing (and all functions) of the protocol to normal operating condition:

• An updated rate model, 0xcdaf8cb1839952cbe6d98d248e593b782a2419c7 and stablecoin rate model, 0x8ac03df808efae9397a9d95888230ee022b997f4
• An updated price oracle, 0x9e77ad51e5c0825d6e440f49e49ef1a1bca37b5d
• A liquidation contract, 0x1055be4bf7338c7606d9efdcf80593f180ba043e— To participate in the liquidation process, you must first ERC-20 approve the liquidation contract to use your token balances, and submit transactions through the contract

We are carefully monitoring the protocol, and are ready to take further action if anything seems out of place.

— Compound