Compound Finance Faces Governance Attack Allegations

Compound Finance, a decentralized lending protocol, is facing intense scrutiny after the narrow passage of Proposal 289, which moved 499,000 COMP tokens—valued at approximately $24 million to $25 million—from the project's treasury to a yield-bearing vault [1, 2, 3]. The proposal, spearheaded by a crypto whale known as "Humpy" and a group called the "Golden Boys," passed with 51% of the vote, sparking widespread allegations of a governance attack [1, 2].

Key takeaways

• Proposal 289 passed with 682,191 votes in favor and 633,636 against, narrowly clearing the threshold for approval [1, 3].
• Critics, including security experts, argue the "Trust Setup" fails to prevent the Golden Boys from potentially diverting treasury funds [1, 2].
• The DAO cannot recall the funds at its own discretion because withdrawal actions are controlled by the GoldenBoyzMultisig [1, 2].
• Humpy has been involved in similar governance controversies with other protocols, including Balancer [1, 3].

Concerns Over Governance Integrity

The controversy centers on whether the "Trust Setup" proposed by Humpy provides adequate security for the protocol's assets. While Humpy maintains that the setup includes constraints that prevent the stealing or diverting of funds, security experts remain skeptical [1, 3]. Michael Lewellen, a security advisor for Compound, argued that the actions of Humpy and the Golden Boys constitute a governance attack, noting that the group appeared to acquire large amounts of COMP tokens on the open market specifically to push the proposal through [2, 3].

Internal discord has also emerged within the group behind the proposal; at least one member of the multisig, Ogle, claimed they were unaware of the vote and did not participate in it [2]. Furthermore, industry observers like Wintermute Governance and Hedi Navazan of Crystal Intelligence have pointed out that because the GoldenBoyzMultisig controls all withdrawal actions, the Compound DAO lacks the ability to unilaterally recall its own funds [1, 2]. This lack of control has led to criticism from figures like Michael Bentley of Euler Finance, who expressed shock that so few community members voted against the measure [1].

Why it matters

The passage of Proposal 289 has highlighted significant vulnerabilities in decentralized governance systems, particularly regarding how DAOs handle treasury management and prevent concentrated voting power [1, 3]. As the protocol faces these allegations, the price of the COMP token has experienced a decline, reflecting market uncertainty [1, 3]. The incident has prompted calls for more robust security measures and increased transparency to protect DAO treasuries from similar "corporate raids" in the future [1, 3]. While the debate continues, the situation serves as a case study for the risks inherent in decentralized decision-making when protocols lack proactive safeguards against coordinated token acquisitions [1, 4].