Curriculum·J306 Smart Contract Risk for Non-Developers·about 33 min
Upgradeability and admin keys
By the end of this lesson you can
- →Explain why upgrade authority subsumes every other contract power
- →Show that a timelock protects against malice and prolongs exposure to error
- →Compute how much of a year an audit actually covers on an upgrading protocol
- →State the three upgrade questions: who, what quorum, and what delay
Junior · enrolled learners
This lesson opens with Compound Proposal 62, September 2021.
- What happened
- Proposal 62 was intended to split COMP distribution between suppliers and borrowers according to governance-set ratios rather than a fixed even share. Executed on 29 September 2021, it introduced a bug in the Comptroller contract that let users in certain markets accrue and claim far more COMP than intended. The founder put the impact at worst at 280,000 COMP, about $80M at the time. He stated publicly that there were no admin controls or community tools able to disable the distribution, because any change required a seven day governance process. Proposal 63, to pause COMP claims, was submitted within hours but would have broken integrations and was canceled; the fix, Proposal 64, passed unanimously on 7 October and was set to execute on 9 October. During that window the Reservoir's drip function was called for the first time in about two months, and the founder reported that this put a further 202,472.5 COMP at risk, because the drip moves the Reservoir's COMP into the Comptroller and enlarges the pool available to be wrongly distributed.
- The decision point
- The upgrade mechanism was not the safeguard against the problem. It was the source of the problem and then the constraint on fixing it. A timelock is usually described as a protection, and it is, against a malicious upgrade you can see coming and exit ahead of. Against an error already live, the identical delay is a guaranteed minimum exposure window, and in this case the COMP exposed grew by about 72 percent while the clock ran.
- Recorded loss
- $80,000,000
What you will be able to answer
- →Why does upgrade authority subsume the other powers?
- →How is a timelock two-sided?
- →How much of a year does an audit cover on a quarterly upgrade cycle?
- →What are the three upgrade questions?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://www.theblock.co/news/defi/2021-09-29-compound-bug-comp-risk-misreward-119086
- https://compound.substack.com/p/compound-treasury-updates-comp-bug
- https://www.comp.xyz/t/compound-proposal-63-temporary-patch-for-comp-distribution-bug-9-29-21/2327
- https://cointelegraph.com/magazine/compound-crisis-averted-securing-exposed-comp-could-be-just-the-start
- https://www.fxstreet.com/cryptocurrencies/news/compound-suffers-another-setback-as-new-issue-puts-65-million-comp-in-jeopardy-202110040609
- https://cointelegraph.com/news/compound-unanimously-pass-proposal-to-repair-bug
- https://www.theregister.com/software/2021/10/01/smart-contract-bug-gives-away-90m-in-comp-cryptocurrency/1372869
- https://docs.compound.xyz/v2/governance/
- https://www.ankr.com/blog/after-action-report-our-findings-from-abnbc-token-exploit/
- https://rekt.news/euler-rekt
- https://cryptodaily.co.uk/2023/03/euler-finance-hack-postmortem-reveals-8-month-old-vulnerability
- https://immunefi.com/blog/research/immunefi-crypto-losses-report-2023/
Confidence high·Volatility low·Reviewed 2026-10-22·Owner unassigned
Contested
Reported figures for the COMP at risk range from about $50M to $90M depending on the date and the token price used, so the lesson measures the growth in COMP rather than dollars. The 280,000 starting bound is the founder's, reported by The Block on 29 September 2021. The further 202,472.5 COMP put at risk by the drip call is the founder's figure as reported by Cointelegraph Magazine (about $64M at the time) and FXStreet; Cointelegraph's news report of 7 October gives $68.8M. The ratio of the two dollar figures, 68.8 to 80, mixes prices from different days, which is why an earlier version of this lesson's 86 percent has been replaced by the COMP ratio of about 72 percent.
Cointelegraph's news report says Proposal 63 took seven days to reach production. Compound's own newsletter and its governance forum record that Proposal 63, which would have made COMP claims revert, was canceled by the community multisig on 7 October, and that Proposal 64 was the fix that passed. The lesson follows the protocol's record.
Compound's governance process worked as designed throughout, and the community passed both remediation proposals. This lesson is not a criticism of that design. It is an argument that a delay has two signs and that only one of them is usually discussed.