COMP Balancer’s allowance gets hacked two times in 24hrs

Its the second time within 24hrs a hacker has succeeded in stealing from the COMP balancer, the hacker first stole about $500,000 worth of Ethereum, and later stole about $2300 worth of COMP; which is about 10 COMP. It is not yet known if it's the same hacker who stole the first time that is stealing again.

Hao an engineer at Debank, tried to explain on Twitter how the hacker fooled the system and got away with it. The attacker was able to fool the balancer system into thinking he owed a significant part of COMP stored in the decentralized pool. 

The hacker was then able to transfer the COMP token to a balancer pool, he then successfully made to accused by the pool during its operation, he forced the balancer to update its balance, at the time the balancer included all of the flash loaded money. This made the system to believe that he was entitled to a significant share of the pool, even when he has not held any money previously.

He was able to withdraw a small amount of COMP, which was about 10 COMP. Hao noted that the attacker used a similar method in the previous attack.

The balancer has pledged to return the amount of money of the account that was hacked and plans start a bug bounty to reward users that finds a bug in the system.

"After thorough discussions with the community, the Balancer Labs team decided that it will fully reimburse all the liquidity providers who lost funds in the attack of yesterday. We will also pay out the highest bug bounty available for @Hex_Capital"