# COMP Distributions Can Be Manipulated And Duplicated Across Any Number Of Accounts

Bunker's Compound fork left supplier COMP index updates commented out, letting suppliers checkpoint and duplicate COMP rewards across many accounts.

- Payout: Audit contest
- Severity: medium
- Program: bunker.finance
- Found by: leastwood
- Disclosed: 2022-07-25
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2022-05-bunker#m-04
- Library page: http://bugbountylibrary.com/r/c4%3A2022-05-bunker%3AM-04
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:reward-distribution

**Target:** Comptroller.sol COMP distribution logic (updateCompSupplyIndex/distributeSupplierComp)
**Root cause:** updateCompSupplyIndex() and distributeSupplierComp() calls were commented out for suppliers while borrower distribution remained active, so supplier COMP accrual is never checkpointed correctly on enter/exit.
**Steps:**
1. Supply tokens to the market.
2. Call `updateCompSupplyIndex()` and `distributeSupplierComp()` (or trigger enter/exit paths) to checkpoint.
3. Withdraw supplied tokens.
4. Repeat the supply/checkpoint/withdraw cycle across any number of accounts.
5. Redeposit into a previously checkpointed account, call `claimComp()`, and withdraw before re-supplying on another account.
**How found:** Code review of the Compound fork noticed supplier distribution calls were commented out while borrower distribution remained, and that both indexes share compSpeeds so supplier logic cannot be cleanly disabled.
**Exploitation:** Attacker cycles supply/withdraw across many accounts to repeatedly capture COMP distributions that should be indexed once per block, then claims via claimComp() and moves to a fresh account.
**Escalation:** Scaling across unlimited accounts multiplies duplicated yield, breaking all distribution accounting.
**Insight:** In Compound forks, check whether updateCompSupplyIndex/distributeSupplierComp are actually invoked on enter/exit paths; if supplier accrual is skipped while compSpeeds still drives borrower distribution, rewards can be checkpointed and replayed per account.