Compound Community Accuses Notorious Whale Of Engineering Governance Attack

Compound tokenholders have passed a controversial governance proposal despite analysts warning against a concerted governance attack.

On July 28, Proposal 289 passed with 51.84% of votes cast in favor compared to 48.16% against after voting began on July 25. The proposal advocated for investing 499,000 COMP (roughly $24 million) from Compound’s treasury into the goldCOMP DeFi vault from the “Golden Boys” team.

Vault depositors receive goldCOMP, a “semi-liquid wrapped token” representing their assets — which can be provided to a liquidity pool to generate yields.

“These goldCOMP tokens… creat[e] a passive income stream for COMP holders who plan to COMP for a long period of time,” Proposal 289 said. “The proposal seeks a one-year investment of 499,000 COMP of treasury funds… to generate interest on 5% of the treasury’s non-interest bearing COMP holdings.”

The proposal’s passage notably followed two previously unsuccessful attempts to allocate Compound treasury funds to the goldCOMP vault.

“It is fair to say that Humpy and the Golden Boys are operating in bad faith,”said Michael Lewellen of the web3 security firm, OpenZeppelin. “Their attempt to push through a proposal to take a large chunk of the Compound treasury without adequate protections appears to be a malicious attempt to steal funds from the protocol. In my personal opinion, the actions of Humpy and the Golden Boys can be considered a governance attack.”

The price of COMP is down 5.6% in the past 24 hours, according to CoinGecko.

Humpy

Proposal 289 has attracted widespread pushback from within the Compound community, with detractors claiming the project has come under siege from a governance attack.

The Golden Boys are led by Humpy, a controversial whale previously accused of buying the governance tokens of various DeFi protocols to vote for measures that serve their personal financial interests at the expense of the token’s issuing project.

In 2022, Humpy came under fire for amassing an outsized share of vote-escrow Balancer tokens (veBAL) — which allows holders to vote on how newly minted BAL emissions are distributed across liquidity pools on the Balancer decentralized exchange. The situation resulted in Humpy accumulating $1.8 million worth of BAL from Balancer’s CREAM/WETH liquidity pool over six weeks, while the Balancer protocol generated only $18,000 worth of protocol fee revenue over the same period.

Humpy was also embroiled inSushi’s recent infighting as the Sushi DAO sought to resist efforts from the project’s core operations to instill a centralized governance and development structure. Sushi’s head chef accused Humpy of aligning voting power with a group of disaffected community members called SushiCitizen in a bid to introduce a vote escrow tokenomics and ramp up inflation for their own gain.

Backlash

On May 7, Lewellen responded to the original Golden Boys’ Proposal 247, publishing a warning noting that 247 was launched without prior discussion by a previously unknown governance delegate.

The proposal requested 92,000 COMP for the goldCOMP vault and came days after its author was delegated more than 228,000 COMP in voting power originating from the Bybit exchange held by just five wallets. Combined with the delegate’s funds, the group controlled 325,333 COMP — equating to more than 81% of the 400,000 COMP required for a governance proposal to meet quorum.

“We alerted the community of the risk that these delegates could be in support of a potential governance attack,” Lewellen said. “The timing of the new proposal and these recent delegations is suspicious.”

The warning stirred up significant pushback, with 88% of nearly 807,000 votes against proposal 247, prompting Humpy to announce the cancellation of the proposal.

Golden Boys followed up with Proposal 279 on July 15, with voting commencing two days later. Wintermute, a crypto trading firm, identified security concerns regarding the proposal. Wintermute noted that the GoldenBoyzMultisig exercised exclusive control over withdrawal actions, adding that any deposited funds also delegated governance rights to the same multisig account — giving the delegate and associated more than 400,000 COMP in governance power.

“Any form of withdrawal action… is solely controlled by GoldenBoyzMultisig, meaning that the DAO cannot actually recall funds any time under their own discretion,” Wintermute said. “Even if the DAO wanted to withdraw funds, there is a possibility that it gets voted down.

Bryan Colligan, the head of business development at Compound, also noted that his team was already exploring opportunities for generating yield on protocol-owned liquidity (POL) that offer higher returns than 5%.

“Security concerns aside, from our early analysis there are much better POL opportunities available leveraging partnerships from emerging chains and dexes available,” Colligan said. “Most of these opportunities we are evaluating are starting at 15-20% APR, and some as high as 40%.”

Proposal 279 failed, with 83% of votes cast against it.

Proposal 289

Proposal 289 was created on July 24, with voting set to commence two days later.

Lewellen flagged that the proposal’s timing appeared intended so that voting would take place over the weekend — when many community members may be less active. As such, Lewellen characterized the proposal as a governance attack aimed at gaining access to Compound’s treasury reserves without undergoing proper scrutiny from the project’s community.

Lewellen also warned that the proposal upped the requested sum of COMP by more than 600% to 499,000 COMP and failed to address all of the criticisms levied against the previous proposals.

Related: Compound Token Surges After CEO Steps Down And Unveils New Venture