Island Fintech Weekly (3 October)

China announces crypto ban, Visa builds its own stablecoin network, Compound Finance accidentally pays out $80m in rewards.

Oct 03, 2021

Greetings Islanders,

It’s a new month (and a new quarter, iykyk). Island Fintech Weekly will be crypto-focused every first Sunday of the month, and I am super pumped to present the second edition!

For the dives section in the crypto editions I will be doing something different - I shall be focusing on DeFi and will do my best to break down the largest news happening in the crazy world of DeFi every month.

If you would like to chat about crypto, reach out to me on Twitter! DMs always open :)

🐠 Dips

China declared all crypto transactions as illegal, prompting a 9% dip to $41,000 in the price of Bitcoin after the announcement was made. This comes after China’s plan to launch its digital yuan in the 2022 Winter Olympics. Cryptocurrency exchanges have already started banning Chinese users from their platforms following the announcement.
In response to the announcement by the Public Bank of China (PBoC) on cryptocurrency ban, Alibaba said that it will stop selling crypto mining machines on October 8th, but the company claims that this decision was also made with the “instability of laws and regulations” of crypto in mind.
In happier news, Visa recently published a paper about a “Universal Payment Channel” (UPC), which is what the company calls its blockchain interoperability hub. TLDR; the hub acts to connect multiple blockchain networks which will enable transfers of digital assets from different protocols and wallets, and engineers at Visa have been working on this initiative since 2018. In short, Visa is trying to build a stablecoin network on Ethereum L2. I personally am pretty excited to see how this rolls out, as if this succeeds, it could mean a big push for crypto going mainstream.
Twitter announced in a blog post last Thursday that users can now tip other users using not only fiat, but also crypto! More specifically, with Bitcoin over the Lightning Network. Tipping with Bitcoin will only be available to users in El Salvador and most of the U.S., while the overall tipping function is currently available for iOS users first, before Android (which means that ya girl’s gotta wait 🥲 ).
AngelList tweeted that it will now allow LPs to invest via USDC in any USDC-enabled syndicate or fund. The move was also announced in the AngelList Confidential 2021 Keynote event, where Avlok Kohli, the CEO, explained that USDC will be displayed as an option during the closing flow, where users can scan the QR code or copy the ERC-20 wallet address shown and transfer their funds over.

🐋 Dives

A single missing character bug costed Compound Finance $80m.

Ever wondered what difference one keyboard character could make?

Well, if you are a programmer, you know that one pesky missing semicolon or underscore will prompt your compiler to spew all kinds of error messages, keeping you up all night. Well, what about mistakes that your compiler cannot catch?

One such mistake led to a smart contract bug which costed Compound Finance $80m. What was the cause? A difference between ‘>’ and ‘>=’ .

Compound Finance had recently implemented Proposal 062, where the aim was to split COMP rewards distribution and fix bugs. The comptroller contract was updated and can be found here.

The error can be found on line 1217, where there is supposed to be:

if (supplierIndex == 0 && supplyIndex >= compInitialIndex)

instead of:

if (supplierIndex == 0 && supplyIndex > compInitialIndex)

When a user supplies tokens for a market that gives 0 COMP rewards like cSUSHI before the market is initialised, the supplyIndex will still be equal to compInitialIndex, resulting in the if block shown above to not be triggered.

When the if block is not triggered, value of supplierIndex will remain as 0, and supplyIndex will be 1e36, thus triggering rewards payouts for 1e36 indexes rather than zero rewards.

This resulted in Compound distributing more rewards than intended. Founder Robert Leshner mentioned in a tweet that there would be at most 280k COMP tokens impacted, which at the time of the tweet would be about ~$83,776,000.

In an ugly turn of events, Robert Leshner tweeted asking for any beneficiaries of the unintended COMP rewards payout to return the tokens to the Compound timelock. He ended off the tweet by saying that it would otherwise be counted as income to the IRS, and “most of you are doxxed”. This tweet was not received positively by the community, and he followed up with a tweet clarifying that he had only wanted to help the community get the tokens back and admitted that it was a “bone-headed tweet / approach.”

At the time of writing, nearly all 280k COMP tokens have been drained.