Compound DAO’s proposal to “pay a bug bounty of US$125,000 to a developer” was not approved

Compound DAO’s proposal to reward an anonymous developer “KP” who reported and helped fix a vulnerability failed to pass a community vote. Hackers can exploit this vulnerability to steal user funds directly, although the cost is too high to be profitable. After the vulnerability was discovered and verified, KP reported it to Compound and its security partner OpenZeppelin and provided a code repository containing a proof-of-concept simulation of the attack. This vulnerability was quickly fixed, so KP made a request to Compound DAO for a reward of US$125,000, which is slightly more than 80% of the Compound DAO bug bounty limit (US$150,000). Although more than two-thirds of the votes were cast in favor of the proposal (including a last-minute 256,000 yes votes provided by a16z), it ultimately failed to reach the 400,000-vote threshold (just 15,000 votes short). The Tally.xyz page shows that Polychain, the largest holder of COMP and the crypto venture capital institution, abstained from voting on the proposal, but Wintermute voted in favor. KP has now resubmitted the proposal, seeking a $100,000 award. (The Block)