Oracle Exploit Sees $89 Million Liquidated on Compound

Around $89 million was liquidated on lending platform Compound in the last 24 hours, according to LoanScan. This includes the third largest COMP farmer, who was liquidated for $46 million, noted Nansen CEO Alex Svanevik.

“My understanding is that the DAI price on Coinbase was driven up to a premium of around 30%. Compound's oracle uses Coinbase for pricing data. This caused liquidations as the value of the loans exceeded collateralization-ratio thresholds,” Svanevik told Decrypt.

He added that, "As far as I can tell, Compound worked exactly as it should. But questions will be asked about the oracle."

Compound is a platform that lets users lend cryptocurrencies to other individuals. It is the third-largest DeFi platform, with $1.55 billion in assets locked up in its smart contracts. To borrow cryptocurrency, the user has to put up collateral that exceeds the amount they are borrowing. But these loans are running on the decentralized Ethereum blockchain. If the blockchain notices that the collateral has become undercollateralized, then it forces the loan to be liquidated.

What Is Chainlink? A Beginner’s Guide to the Decentralized Oracle Network

Blockchain technology is powerful but has a fundamental limitation: it cannot access real-world data on its own. Smart contracts, essential to many blockchains and decentralized finance applications, rely on external data to function. This is where “oracle networks” like Chainlink come in. Oracles enable smart contracts to securely pull data from a wide range of information sources, instead of relying on a single provider. Over 14 blockchain ecosystems are compatible with Chainlink, including Et...

However, the blockchain doesn’t itself know the current prices of each coin—prices live on exchanges, not blockchains. So it checks the price on exchanges using oracles (things that connect blockchain to real-world data). 

It appears that a malicious actor may have manipulated the price of DAI on the Coinbase Pro exchange, in order to trick the blockchain—via its oracles—into thinking that the current price of DAI really had shot up. When the blockchain thought DAI had hit $1.30, it figured that many of the loans were undercollateralized and liquidated them.

"Maybe it'll be helpful with an example for what happened. If someone has a $100 loan when DAI is $1, then the spike caused their debt to spike to $130. And so if you had only collateralized the position up to $125, you'd get liquidated," Svanevik explained.

“Close to $90m of loans were liquidated on @compoundfinance over the last 24hrs, with bulk of it DAI likely due to oracle issue as Coinbase DAI/USDC spiked to $1.3 momentarily, also the pair where yield farming is concentrated,” tweeted a crypto researcher known as Arthur.

Sergey Nazarov, co-founder of Chainlink, spoke to Decrypt about the risks associated with centralized oracles.

“DeFi protocols with centralized oracles that rely on a single exchange of any kind (Off-chain or DEX) or even a limited number of individual exchanges for their price data, are exposing user funds to significant risks,” Nazarov said.

What's more, the Compound liquidation is yet another sign that users might start to veer towards protocols with more decentralized oracles. “I expect that the realization of these technical risks by users will eventually drive them to use DeFi protocols that have decentralized and provably secure oracles, just like users are now highly sensitive to the private key security of off-chain exchanges,” Nazarov added.

In March, Compound saw $2.5 million in value liquidated, which was a record at the time. Now that pales in comparison.

Update: This article has been updated to clarify that it was $89 million, not $100 million, in liquidations during the last 24 hours.