COMPOUND FINANCE

DESCRIPTION OF EVENTS

"Compound Finance is one of the most widely used protocols in the DeFi ecosystem. Deployed on Ethereum, its purpose is to issue automatic, permissionless loans of Ether and various ERC20 tokens. As of February 2022, the protocol held more than $10 billion in assets across 18 markets."

"To invest in Compound, users deposit Ether or supported ERC20 tokens into one of the protocol’s markets. In exchange, they receive cTokens for that market, with which they can redeem their investment. Compound’s cTokens are differentiated and denominated according to the underlying asset. For example, investors who deposit Ether (ETH) receive cETH tokens, which are redeemable for ETH. Similarly, investors who deposit USDC receive cUSDC tokens, which are redeemable for USDC, and so on. In addition to being redeemable for the underlying asset, cTokens can be traded according to their market value."

"The total value of each market increases as funds are lent out and repaid. As the value held in a market grows, the cTokens for that market increase in value and can be redeemed for more of the underlying asset. In this way, investors accrue interest. When the protocol operates as intended, the value of a cToken relative to its underlying asset should only increase, i.e., only positive interest rates should be possible."

"We're excited to announce the launch of our new fee-sharing initiative, allowing you to directly benefit from Compound's success!"

"Key Points: 30% of all protocol fees are now redistributed to active users. Compound III users receive a 2.5x multiplier on rewards. Open to all: Anyone who has interacted with Compound can claim."

"How It Works: Visit the claims portal below. Connect your wallet. View and claim your accured rewards."

"Reward Calculation: Based on your lending/borrowing activity, COMP holdings, and governance participation. Accrues in real-time, claimable at your convenience. No lock-ups or vesting periods - rewards are liquid upon claim."

"SECURITY PSA: The official @compoundfinance Discord server has been hacked. Do NOT click on any links or trust any interactions in the server until further notice."

"Discord channel is compromised, hackers are spamming the channels. would someone have a look at it?"

".@compoundfinance Discord has been compromised for over 6 hours. Still no updates from the team, what is going on?"

"Compound community’s Discord server has been hacked. Please do not click on any links until the situation is resolved."

"Attention: On 9/20/24 the Compound community’s Discord server was compromised.

Access has been regained and secured.

Always stay vigilant for scams and do not click any suspicious links."

Explore This Case Further On Our Wiki

Compound Finance is one of the most popular decentralized finance protocols for loans. On September 21st, their official Discord account posted about a new initiative to redistribute 30% of the collected fees to users. Users were instructed to visit a claim portal to see what their eligible payout would be. It turns out that the Discord server was compromised, which allowed the attacker to post malicious phishing links. While the link was up for several hours and many users reported almost falling for the phishing attack, it is unclear whether anyone was actually impacted.

@compoundfinance Twitter (Oct 24)
Compound-TUSD Integration Issue Retrospective - OpenZeppelin blog (Oct 24)
@defnothikariii Twitter (Oct 24)
@Dimash20222531 Twitter (Oct 24)
@JulianApeSwap Twitter (Oct 24)
@DooWanNam Twitter (Oct 24)
@ark_tme Twitter (Oct 24)
@LewellenMichael Twitter (Oct 24)
@PleaseL97187 Twitter (Oct 24)
@PleaseL97187 Twitter (Oct 24)
@BCVInvesting Twitter (Oct 24)
@BCVInvesting Twitter (Oct 24)
@RiskGPT Twitter (Oct 24)
@ReportingVision Twitter (Oct 24)
@SnoopX_ai Twitter (Oct 24)
@Friedrich__Wil Twitter (Oct 24)
@ChrisNavigato Twitter (Oct 24)
@HarshaKaramchat Twitter (Oct 24)
@coloredcoins Twitter (Oct 24)
@coloredcoins Twitter (Oct 24)

More case studies

Shezmu Unbacked
Collateral Vulnerability

Immutable Discord Server
Account Compromise