Curriculum·J306 Smart Contract Risk for Non-Developers·about 32 min
Upgradeability and admin keys
By the end of this lesson you can
- →Explain why upgrade authority subsumes every other contract power
- →Show that a timelock protects against malice and prolongs exposure to error
- →Compute how much of a year an audit actually covers on an upgrading protocol
- →State the three upgrade questions: who, what quorum, and what delay
Junior · enrolled learners
This lesson opens with Compound Proposal 62, September 2021.
- What happened
- Proposal 62 was intended to split COMP distribution between suppliers and borrowers according to governance-set ratios rather than a fixed even share. Executed on 29 September 2021, it introduced a bug in the Comptroller contract that let users in certain markets accrue and claim far more COMP than intended, placing a capped total of 280,000 COMP worth over $80M at risk. The founder stated publicly that there were no admin controls or community tools able to disable the distribution, because any change required a seven day governance process. Proposal 63 was written to fix it and took seven days to reach production. During that window a party used the drip function to transfer $68.8M from the reservoir into the Comptroller, enlarging the pool available to be wrongly distributed. Proposal 64 subsequently passed unanimously.
- The decision point
- The upgrade mechanism was not the safeguard against the problem. It was the source of the problem and then the constraint on fixing it. A timelock is usually described as a protection, and it is, against a malicious upgrade you can see coming and exit ahead of. Against an error already live, the identical delay is a guaranteed minimum exposure window, and in this case the exposure grew by 86 percent while the clock ran.
- Recorded loss
- $80,000,000
What you will be able to answer
- →Why does upgrade authority subsume the other powers?
- →How is a timelock two-sided?
- →How much of a year does an audit cover on a quarterly upgrade cycle?
- →What are the three upgrade questions?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://www.theblock.co/amp/linked/119086/compound-bug-comp-risk-misreward
- https://compound.substack.com/p/compound-treasury-updates-comp-bug
- https://theregister.com/2021/10/01/compound_crypto_bug
- https://cointelegraph.com/news/compound-unanimously-pass-proposal-to-repair-bug
Confidence high·Volatility low·Reviewed 2026-08-06·Owner unassigned
Contested
Reported figures for the COMP at risk range from about $50M to $90M depending on the date and the token price used, and the 280,000 COMP cap is the stable quantity. The argument does not depend on the valuation.
Compound's governance process worked as designed throughout, and the community passed both remediation proposals. This lesson is not a criticism of that design. It is an argument that a delay has two signs and that only one of them is usually discussed.