Curriculum·J306 Smart Contract Risk for Non-Developers·96 min
Upgradeability and admin keys
By the end of this lesson you can
- →Explain why upgrade authority subsumes every other contract power
- →Show that a timelock protects against malice and prolongs exposure to error
- →Compute how much of a year an audit actually covers on an upgrading protocol
- →State the three upgrade questions: who, what quorum, and what delay
Junior · account required
This lesson opens with Compound Proposal 62, September 2021.
Orientation and Freshman are open to everyone, no account needed. From Sophomore onward we ask you to sign in, because progress through the later levels only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://www.theblock.co/amp/linked/119086/compound-bug-comp-risk-misreward
- https://compound.substack.com/p/compound-treasury-updates-comp-bug
- https://theregister.com/2021/10/01/compound_crypto_bug
- https://cointelegraph.com/news/compound-unanimously-pass-proposal-to-repair-bug
Confidence high·Volatility low·Reviewed 2026-08-06·Owner unassigned
Contested
Reported figures for the COMP at risk range from about $50M to $90M depending on the date and the token price used, and the 280,000 COMP cap is the stable quantity. The argument does not depend on the valuation.
Compound's governance process worked as designed throughout, and the community passed both remediation proposals. This lesson is not a criticism of that design. It is an argument that a delay has two signs and that only one of them is usually discussed.