An exploit on Compound is allowing users to leverage their initial capital multifold, creating more Compound DAI than real DAI, and a situation that some are terming “impossible.”
This is not a security lapse or bug in the Compound protocol, but a sneaky loophole that makes borrowing against borrowed collateral possible.
More Compound DAI than circulating DAI
DeversiFi COO Daniel Yanev noted on a tweet Friday that on-chain DAI was just 108 million, compared to Compound DAI that’s more than 3x the value:
DAI on chain: 108m
DAI in @compoundfinance : 344m
This seems safe. @MakerDAO pic.twitter.com/ASCu6n0ahO
— Dan Yanev (@dan_yanev) July 2, 2020
Thread commentator @degenspartan explained the situation arises as a user immediately deposits the DAI they borrow “which becomes collateral so [they] can borrow more DAI,” which in turn, can be further pooled to gain collateral on.
Real-time data on DAIStats shows there must only be 164 DAI (at press time). However, the Compound protocol shows over 540 million DAI in gross supply:
Compound calculates each DAI deposit under additional gross supply, regardless of if it was just-borrowed and quickly re-deposited. Using three or more wallets makes this task easy; borrowing DAI with a small stablecoin capital and using all that amount to quickly borrow more DAI.
Interestingly, an application is touting such “recipes” already. Instadapp, a self-styled management tool for DeFi tokens, tweeted June 3 that such “debt swaps” can help maximize one’s capital:
The season is coming to an end. It's time to rotate the crops ?? to maximize your $COMP earnings.
Introducing Debt Swap – switch your Compound stablecoin debt from USDT to DAI in a single click. Pay less interest and earn more COMP.https://t.co/bRDr55iv30 pic.twitter.com/XLkRITj5tj
— Instadapp (@Instadapp) July 2, 2020
CryptoSlate did not independently verify Instadpp’s claims. A mail to Compound requesting information on the topic was unanswered at press time.
“Infinite leverage” glitch
The above loophole is reminiscent of the notorious “infinite leverage” glitch on Robinhood last year. One user, at the time, found out they could borrow capital on leveraged options, going back-and-forth multiple times to over 100x in leverage and theoretically unlimited capital.
A stock-trading Reddit forum has minted a group of hall-of-famers who best exploited Robinhood's 'infinite leverage' glitch. Here's how much money each has amassed through the hack. https://t.co/5QLfM9y5kJ
— Business Insider (@businessinsider) November 7, 2019
Robinhood has since patched the issue.
Meanwhile, Compound has a set of new governance rules on the platform, quelling opportunists from pooling illiquid tokens and farming the most yields.
Last month, the Compound community noted BAT poolers were taking the chunk of yield rewards, despite no borrowers taking out BAT loans. This led to a governance poll last week, as CryptoSlate reported, with a majority calling for tweaking the rules to suit actual deposits and borrowed assets — instead of high-interest rates.
The prominence of DAI on Compound is creating some discussion around the token’s market supply on MakerDAO forums. Risk manager Cyrus Younessi noted last week:
“There is a chance (likelihood, even) that we see unprecedented demand for Dai. Much of the natural supply for Dai could also be locked up in COMP farming, thinning out sell-side order books.”
(Author’s Note: Compound figures are real-time and are subject to change than those mentioned above.)
