Comet Vulnerability Disclosure (Patched) - Bug Bounty Program Reward
01Summary
Bug bounty reward proposal for a security researcher who responsibly disclosed a vulnerability in the Base Comet WETH market. Proposes to grant 1,791 COMP tokens (~$100,000 USD) to the researcher. The vulnerability has been patched and no user funds were at risk.
- Type
- treasury allocation
- Funding
- $100000
Key changes
- Transfer 1,791 COMP tokens to security researcher as bug bounty reward for responsible disclosure of Base Comet WETH market vulnerability(high)
Notable concerns
- This is a resubmission of a previous proposal (#202) that did not pass, with the reward amount reduced by approximately 33%
Generated by Kvorum
02Description
Comet Vulnerability Disclosure (Patched) - Bug Bounty Program Reward
This is a resubmission of proposal #202 with a lower bug bounty reward amount which I believe to be in line with the DAO's wishes, given the closeness of reaching quorum for the previous amount.
A heartfelt thank you to she256, PGov, Wintermute, and a16z for having voted in favor of proposal #202. While the proposal did not pass, your support did not go unnoticed and will not be forgotten by myself nor the broader community.
Background
NOTE: The vulnerability has been patched and no user funds are at risk.
For the full details and context related to the vulnerability disclosure, as well as discourse between the OpenZeppelin and Compound Labs teams, and Compound community members, please see here.
On November 13th, I had disclosed a vulnerability for the Base Comet WETH market’s smart contracts which would have enabled an attacker to directly steal user funds via the withdraw and transfer methods. I was given the blessings from the OpenZeppelin and Compound Labs teams in making this proposal for the purposes of proposing a reward for my professionalism and collaboration in addressing the vulnerability.
Bug Bounty Program Reward
Leaning on the support from the OpenZeppelin and Compound Labs teams and other Compound community members (such as experienced security researcher Daniel Von Fange) for guidance and their assessment of reward fairness, I would like to make a humble ask for ~33% less than the maximum Compound Bug Bounty Program reward: $100,000 worth of COMP tokens, at $55.82 per COMP, rounded down; the COMP price was sourced from Etherscan (publicly and freely accessible) at 10:30am EST on December 9, 2023.
I am sincerely appreciative of the opportunity to have collaborated alongside the best teams and individuals in discussing and remedying this vulnerability, and look forward to continuing my contributions both as a Compound builder and vigilant community member.
Thank you very much for both your time and consideration.
03Mismatch analysis
The proposal describes a single ask: a bug bounty reward equal to $100,000 worth of COMP, calculated at $55.82/COMP and rounded down. $100,000 / $55.82 ≈ 1791.47 COMP, and rounding down yields exactly 1791 COMP, which matches the decoded _grantComp call amount of 1791000000000000000000 wei (1791 COMP with 18 decimals). There is only one on-chain action, and it corresponds directly to the single claim in the description — no additional or omitted actions are present. The recipient address is not named in the prose, but this is standard for a self-directed bounty payout and not a material omission since no conflicting recipient is claimed. No value, target, or characterization mismatches were found.The description honestly and completely matches the calldata.
Generated by Kvorum
04Actions
- Target
- 0x3d98…cd3b
- Value
- 0 wei
- Function
- _grantComp(address,uint256)
- Arguments
{ "amount": "1791000000000000000000", "recipient": "0x9c9dC2110240391d4BEe41203bDFbD19c279B429" }- Calldata
05Tally
Summed from votes
06Voters
| Voter | Choice | % of total | Rationale | ||
|---|---|---|---|---|---|
| 9A0x9aa8…ccf1 | For | 256K | 55.06% | — | 3y ago |
| 8D0x8d07…a265 | For | 70K | 15.06% | — | 3y ago |
| B90xb933…8dd1 | For | 53.9K | 11.60% | — | 3y ago |
| 2B0x2b38…bf33 | Against | 32.5K | 6.99% | — | 3y ago |
| 3F0x3fb1…4c8a | For | 25.6K | 5.50% | — | 3y ago |
| DAdakeshi.eth0xe3c9…6b21 | For | 21.3K | 4.58% | — | 3y ago |
| 4C0x4c9f…fb01 | For | 5.3K | 1.14% | — | 3y ago |
| 660x66cd…65f9 | For | 368.6 | 0.08% | — | 3y ago |
| 8B0x8bc8…7276 | For | 1.1 | 0.00% | — | 3y ago |
| 6C0x6cc8…903c | For | 1 | 0.00% | — | 3y ago |
| E40xe459…e666 | For | 0.7 | 0.00% | — | 3y ago |
07Forum
- Comet Vulnerability Disclosure (Patched) ↗discourse · high confidence
Arguments for
- OpenZeppelin and Compound Labs directly confirmed the vulnerability was real, validly disclosed, and professionally handled by brrito, warranting a generous reward.— cylon, kevin, brrito
- A neutral third-party security engineer assessed that $125K is a reasonable bounty given industry norms and the theoretical severity before discounting for infeasibility.— dvf, brrito
- The bug report has long-term value beyond the immediate patch by preventing future market configurations from being susceptible to the same flaw, justifying a higher payout.— kevin
- Since Compound's bug bounty program lacks a clear severity/payout rubric, rounding up sets a good precedent for future researchers and encourages responsible disclosure.— kevin, joeysantoro
- The underlying vulnerability was actually severe (potentially high or low-critical, capable of breaking the solvency invariant across differently configured markets), not merely 'medium', supporting a generous reward rather than a reduced one.— joeysantoro
- Generosity toward an earnest researcher who responsibly disclosed a serious bug with proof-of-concept and is building on Compound sets a strong positive precedent for the ecosystem.— joeysantoro
Arguments against
- The bug bounty reward should not be paid from protocol reserves, which were never intended for this purpose; it should follow the same payment process used for DAO service providers.— jayson, kevin
- The proposed $120-125K reward is absurdly high given the bug's severity (characterized as merely 'medium'), and a $50K payout in COMP would be more appropriate.— arr00
- The proposal may be exploiting DAO voter apathy to push through an inflated reward, and delegates should vote no.— arr00
- The whitelisting of the proposal by the Compound governance multisig/Pause Guardian does not constitute an endorsement of the payout amount by OpenZeppelin or Compound Labs.— arr00, cylon
Unresolved concerns
- Requests for additional sources/evidence supporting the $125K reward figure as fair and industry-standard were made but never fully answered.— arr00
- Disagreement over the true severity of the bug (medium vs. high/critical) was never conclusively resolved between arr00 and joeysantoro.— arr00, joeysantoro
- Compound's bug bounty program lacks a clear rubric for classifying severity and payout ranges, which Labs acknowledged needs to be modernized but was not resolved within this thread.— kevin
Notable participants
- brritoProposer who disclosed the vulnerability, requested the bounty, and responded to community feedback by revising the proposal's funding source.
- cylonOpenZeppelin representative who confirmed the vulnerability report, recommended a generous payout, and later clarified the limits of proposal whitelisting.
- kevinCompound Labs representative who confirmed the bug, supported a higher payout, and insisted reserves not be used.
- dvfNeutral third-party security engineer who provided an independent assessment validating the reasonableness of the $125K figure.
- arr00Delegate who challenged the proposal's fairness, disputed the bug's severity, and pushed back on using reserves and on the reward size.
- jaysonRaised the objection that reserves should not be used for the bounty, prompting a proposal revision.
- joeysantoroSecurity collaborator who validated the bug's severity as higher than 'medium' and strongly advocated for a generous reward, pushing back on arr00's criticisms.
Generated by Kvorum
08Similar proposals
- compoundexecutedOpenZeppelin Security Partnership - 2023 Q4 Compensation70%
- compoundcanceled"# OpenZeppelin Security Partnership - 2023 Q4 Compensation ## Background Starting on Dec 21st, 2021, OpenZeppelin was [selected](https://compound.finance/governance/proposals/76) to offer the Compo…69%
- compounddefeatedOpenZeppelin Security Partnership - 2024 Q2 Compensation69%
- compoundexecutedOpenZeppelin Security Partnership - 2024 Q1 Compensation69%
- compoundexecutedOpenZeppelin Security Partnership - 2024 Q2 Compensation69%
- compoundexecutedOpenZeppelin Security Partnership - 2023 Q3 Compensation68%
- compoundexecutedOpenZeppelin Security Partnership - 2023 Q2 Compensation67%
- compoundexecutedOpenZeppelin Security Partnership - 2022 Q4 Adjustment67%
- compoundexecutedOpenZeppelin Security Partnership - 2023 Q1 Compensation67%
- compoundexecutedOpenZeppelin Security Partnership - 2022 Q3 Adjustment67%