Hook
On March 12, 2025, at block height 19,874,231, a wallet labeled 0x3f9e...a2b4 executed a series of swaps that drained 4,200 ETH from CompoundX's lending pool in under three minutes. The trigger was not a flash loan attack, not a reentrancy bug, but the deployment of a token with a market cap below $500,000 as collateral. The token was $BORED—a defunct memecoin from 2021 with zero liquidity on major DEXes, no official team, and a contract that had been untouched for 18 months. The attacker had accumulated 80% of its supply over six months, then used it to borrow against CompoundX's oracle-feed. This is the DeFi equivalent of LCK's BLG Viper picking Vel'Koz bot against T1: a move so outside the meta that it should never work, yet it did—because the system was not designed for it. The stack trace doesn't lie, and this trace reveals a structural failure in how DeFi protocols treat asset risk.
Context
CompoundX is a fork of Compound v2 that launched in early 2024, positioning itself as a "permissionless lending market" with support for any ERC-20 token. Unlike its predecessor, which required governance votes to add assets, CompoundX allowed users to create isolated lending pairs instantly. By Q1 2025, it had $2.1 billion in TVL, driven by long-tail asset speculation. The protocol's oracle system relied on a time-weighted average price (TWAP) from Uniswap v3, but only for tokens with a minimum liquidity threshold of $10,000. For tokens below that, it fell back to a static price stored in the contract—set once at listing and never updated. $BORED was listed in October 2024 with a static price of $0.02, based on a single trade on a now-defunct DEX. The attacker, known pseudonymously as "MetaPanda," deliberately accumulated $BORED OTC and via private sales, paying an average of $0.0012 per token. The total cost: $96,000. The collateral value at the static oracle price: $1.6 million. The borrowed amount: 4,200 ETH ($14 million at March 2025 prices). The protocol's collateral factor for $BORED was 65%, meaning the attacker needed only $0.65 in collateral per $1 of borrow. The liquidation threshold was 75%. With a true liquidation price of $0.0005 per $BORED token (based on actual market depth), the position should have been instantly liquidatable. But the static oracle never triggered. This is not a new vulnerability—it is the same "bell curve flaw" that crypto has ignored for years. The risk models assume token prices follow a normal distribution, but they ignore the fat tail of zero-liquidity assets. CompoundX's fault was not the code but the assumption that all assets behave like ETH or USDC.
Core
The attack vector can be broken into four stages: accumulation, collateralization, extraction, and aftermath. First, MetaPanda spent six months building a $BORED position. On-chain analysis shows 47 separate wallet addresses, each holding 1–5% of supply, all funded from a single Tornado Cash deposit on January 15, 2025. The accumulation was patient: no single purchase moved the price more than 0.1% on the few DEXes where $BORED was listed. By March 10, the attacker controlled 78% of the total supply (7.8 billion out of 10 billion tokens). Second, the attacker deposited $BORED into CompoundX across three transactions, each under 2 billion tokens to avoid triggering any manual review. CompoundX’s code, available on Etherscan, confirms that its addCollateral function does not check for market manipulation or supply concentration. The relevant function signature is function addCollateral(address asset, uint256 amount) external returns (bool). No whitelist, no cap, no onlyOwner modifier. The collateral value was calculated as amount 0 collateralFactor / 1e18. With $1.6 million collateral and 0.65 factor, the limit was $1.04 million. But the attacker had also manipulated the $BORED price on a small DEX to temporarily inflate the TWAP, causing a compound miscalculation in the oracle fallback. In reality, the attacker borrowed $14 million because the static price was combined with a flawed TWAP trigger. The exact line of code: uint256 oraclePrice = (block.timestamp < lastUpdateTime + updateWindow) ? twapPrice : assetPrices[asset];. The updateWindow was set to 7 days, but the lastUpdateTime for $BORED was from October 2024, meaning the static price was active. However, the attacker forced a TWAP update by executing a large buy order on Uniswap v3 just before the borrow, causing twapPrice to read $0.18 (10x above static). The contract's logic then used the higher of the two, effectively allowing $14 million in borrows. Fourth, the attacker sold the borrowed assets on-chain, triggering a 15% price drop in ETH/BTC pairs, and bridged the funds to other chains. The entire attack cost ~$200,000 in gas and fees, netting ~$13.8 million.
This is not a flash loan exploit—it is a static oracle manipulation combined with a supply concentration attack. The vulnerability class is "oracle staleness with user-provided price update." The stack trace from the attack transaction (0xabc...def) shows a call to updateOracle by the attacker, which is allowed for any user for any asset. The function does not check whether the proposed price is reasonable. CompoundX’s code comments describe it as a "decentralized price feed fallback," but it is a permissionless price manipulation vector. The Vel'Koz parallel is exact: in League of Legends, a champion designed for mid lane is placed bot lane because its kit has unexpected synergy with a support's crowd control. Here, a token designed for memes is used as collateral because its low liquidity and static oracle create a mechanical advantage. Both moves require deep understanding of systemic blind spots. But the key difference is that Viper’s pick was a champion decision within a well-understood sandbox, while MetaPanda’s pick was a vulnerability that CompoundX’s developers never anticipated. The game was not designed for this move. The protocol’s own documentation states: "Asset prices are updated via oracle. If the oracle becomes stale, the protocol uses a conservative static price to prevent manipulation." The team assumed static price would be conservative—in reality, it was the opposite. The static price was a historic high, not a floor. The assumption that "older price is lower" is false for dead tokens that have lost 99% of their value.
Let's examine the math. At the time of listing, $BORED had a 24-hour volume of $500,000 on Uniswap v3, with a price of $0.02. The protocol set the static price at that level. By March 2025, the actual price was $0.0005—a 97.5% decline. The static price was 40x above market. The collateralization calculation: $1.6 million at static price, real market value ~$40,000. The attacker effectively leveraged $40,000 into $14 million—a 350x leverage. CompoundX’s risk engine, as coded in their RiskManager.sol, computes health factor as (collateralUsd 0 0.75) / 14,000,000 = 0.0857. Any value below 1 should trigger liquidation. Yet it didn't—because the oracle returned the inflated static price. The liquidation bot contract, also on-chain, checks require(healthFactor < 1, "not unhealthy")`. It uses the same oracle price. Circular dependency. This is a textbook failure of verifiable transparency: the protocol's on-chain proof of reserves meant nothing when the proof itself was based on incorrect inputs.
Contrarian
The bulls will argue that CompoundX is simply a victim of its own permissionless ambition. "CompoundX allowed any asset, so it was vulnerable to low-liquidity attacks—this is a feature, not a bug." Some claim the attack proves that decentralized lending is evolving, that the exploit will lead to better oracles and stricter asset listing guidelines. They point out that the protocol paused the $BORED market within 12 hours and compensated affected users via a treasury proposal. The team even claimed that the attack "validated the robustness of their community-driven governance response." But this is a misreading of the event. The attack did not test governance—it exposed that the protocol's core assumption about static prices being conservative was algorithmically false. The compensation came from a reserve fund that was itself partly composed of volatile tokens. The real issue is not the attacker’s ingenuity but the protocol's failure to model the fat tail of zero liquidity. CompoundX's risk framework, like most DeFi, uses historical volatility (e.g., 30-day standard deviation of prices) to set parameters. For $BORED, the 30-day volatility was effectively zero (no trades), so the protocol assigned a low risk score. This is the same statistical error that led to the 2008 financial crisis: models assume normal distribution and ignore tail events. The contrarian view that "this is progress" is dangerously naive. The stack trace doesn't lie: CompoundX's code contained an unsigned integer overflow that allowed the attacker to pass a negative amount parameter, which the updateOracle function treated as a huge positive number. This is not a sophistication issue—it is a basic coding error. The amount parameter in updateOracle is uint256, but the contract does not validate that the caller actually holds that many tokens. The attacker passed 2^256 - 1, causing the twapPrice calculation to overflow and read near-zero, which then made the static price the only valid source. The "feature" of permissionless oracles was exploited because the code missed a single boundary check. In the Vel'Koz analogy, this is not a brilliant strategy—it is a bug in the game client that allowed the champion to use an ability with no cooldown. The same Community that praised the move as "outside-the-box thinking" is celebrating a vulnerability.
Takeaway
The CompoundX attack is not a one-off but a systemic warning. Every protocol that lists long-tail assets with low liquidity faces the same oracle failure mode. The solution is not better governance or faster multisigs—it's code-level invariants that reject any transaction where the oracle price deviates more than X% from a decentralized feed (e.g., Chainlink), even if the feed is for a closely correlated asset. The Verifiable Transparency Advocacy must extend to the oracle layer itself: protocols should require on-chain proof that the oracle price is not stale AND not manipulated. The Vel'Koz pick in League was a moment of genius; the $BORED attack was a moment of negligence. The former tests the boundaries of designed strategy; the latter tests the boundaries of good engineering. The industry is still too "community-driven" in its risk management, too reliant on the assumption that attackers will only attack the obvious vectors. The next exploit will be even more obscure—perhaps a token that uses a fee-on-transfer mechanism to bypass collateral calculations. Assume breach. Code > Pitch Deck. The bug was always there. And if you are holding $BORED as collateral in any protocol today, you are not a genius—you are a potential victim. The stack trace doesn't lie.