Curriculum·G204 Tools a Non-Developer Can Run·about 30 min
Reading a contract page on a block explorer
By the end of this lesson you can
- →Read a contract's block-explorer page for the facts that decide risk without reading any Solidity
- →Explain how Compound Proposal 062 shipped a one-character bug into community-reviewed, verified, on-chain code
- →Compute what a verified source, a proxy pattern, an owner and a timelock each tell you before you deposit
- →Decide whether a contract is what it claims to be from its explorer page alone
Graduate · enrolled learners
This lesson opens with Compound Proposal 062, 29 September 2021.
- What happened
- Compound is a large lending protocol governed on-chain by token vote. Proposal 062 upgraded the Comptroller, the contract that distributes the COMP reward token, and the new code used a greater-than comparison where it needed greater-than-or-equal, one missing character that the auditor Kurt Barry found in two places. That missing character let users claim COMP they had not earned. Rekt put the erroneous distribution at about 80 million dollars, with over 200,000 COMP, about 68 million dollars, still in the reserve the bug could keep drawing on. The contract was live, verified, and governed by a timelock, so the code was public and readable the entire time, and the fix itself had to crawl back through the same multi-day governance process before it could take effect. Nothing was hidden; the bug sat in deployed code that several community members had reviewed and that anyone with a block explorer could open.
- The decision point
- The people who lost by trusting Compound that week were not hacked in any secret way. The upgraded contract was verified on the explorer, its governance ran on a public timelock, and the flawed proposal was visible and simulatable before it ever executed. The barrier was not access; it was literacy. A user who could read a contract's explorer page, that the source is verified, that it is a proxy someone can upgrade, who the owner is, whether a timelock stands between a decision and its effect, has most of what decides whether to trust it, and needs no Solidity to get there. The autopsy of this course is that the information a user needs is almost always public, and the skill is reading it, not obtaining it.
- Recorded loss
- $80,000,000
What you will be able to answer
- →Where did the Compound Proposal 062 bug live?
- →What does a verified source mean, and not mean?
- →What can a non-developer read off an explorer page?
- →What does a timelock give a user?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://blocksec.com/blog/the-butterfly-effect-the-compound-security-incident-caused-by-a-bugfix
- https://rekt.news/compound-rekt
- https://docs.etherscan.io/contract-verification
- https://www.tally.xyz/gov/compound/proposal/62
- https://www.comp.xyz/t/auditing-compound-protocol/2543
- https://cryptoslate.com/how-the-tiniest-of-errors-resulted-in-an-80-million-loss-for-compound-finance/
Confidence high·Volatility medium·Reviewed 2026-09-14·Owner unassigned
Contested
The 80 million dollar figure is Rekt's estimate of the excess COMP first distributed, at the price of the day; BlockSec's root-cause analysis gives no dollar total. Rekt also quotes a tally of 147 million dollars that adds COMP claimed after a later refill of the reserve and a further sum then at risk, so the figure here is an approximation of the first distribution, not a settled number.
Proposal 062 was not a formally audited change. The Compound forum post that opened the audit discussion says it was reviewed by several community members and none spotted the flaw in time, and OpenZeppelin's reply describes the audit Proposal 062 would have had under the process it was proposing. The date is the proposal's execution, 29 September 2021, per its governance record; reports of the bug began the same day.
Block-explorer field names and layouts differ between explorers and change over time; the lesson teaches the categories of fact to look for, not one explorer's exact interface.