Quantstamp Submits First Idle Governance Proposal

Quantstamp Announcements
Share this article:

Gov Tokens Allocation Fix in Idle

On December 14th, a minor bug in the governance tokens distribution module in Idle protocol was reported.

The incident does not involve any deposited funds in Idle protocol (Best-Yield or Risk-Adjusted strategies) nor the accrued yield provided by the underlying protocols.

Governance tokens distribution ($IDLE and $COMP) is affected by the bug under specific circumstances, hence resulting in a misallocation of a small number of tokens to liquidity providers. According to the initial assessment, approximately ~150 IDLE and ~1 COMP have been misallocated since the launch of Idle Governance.

The bug has already been mitigated by a joint effort with Quantstamp and Idle team members, and Quantstamp has proposed a patch via a governance proposal, IIP-1. For security reasons, Quantstamp and the Idle team will fully disclose the bug once the on-chain proposal is implemented.

Core Facts

  • Assets are not at risk and never have been
  • Idle protocol continues its operations and is not paused, you can deposit/withdraw assets anytime, everything is working as expected
  • Idle protocol’s contracts can be upgraded on-chain via community governance, so there is no need to withdraw assets or move them to new contracts
  • The patch is already running and mitigates possible future issues
  • The on-chain proposal will permanently fix the issue (expected implementation in 5 days)

Quantstamp collaborated with the Idle team to investigate this inquiry, identifying the vulnerability and working on both the temporary mitigation patch and the final proposal.

Next Steps‍

The on-chain proposal, IIP-1, launched by Quantstamp is available here.

Idle Governance has 3 days to cast its vote, in favor or against it. If the “For” vote wins and 4% of IDLE tokens have casted a vote, IIP 1 will be implemented after 2 days (grace period).

If you want to get in touch with the Idle team, feel free to join their community on Twitter, Discord, or Telegram.

Back
Quantstamp Announcements

September 2026: The Approval Layer Was Exploited

Crypto lost $742.0M across 33 incidents in September 2026, almost three times August's $255.5M and the biggest month of the year so far. Bitget's $387M hack and Liquid Network's $320M exploit account for about 95% of that, with the other 31 incidents adding up to $35.0M. In August, the prices going into contracts were wrong. In September, attackers went after the systems that approve transactions in the first place. Here's the month in security 👇

Read more
about September 2026: The Approval Layer Was Exploited
Quantstamp Announcements

August 2026: The Price Feed Was Exploited

Crypto lost $255.4M across 46 incidents in August 2026, roughly level with July's $254.4M, with more incidents than any month this year. June and July incidents were largely due to key compromises, but August shifted to price manipulation. Eleven oracle and price-manipulation incidents accounted for $135.87M, or 53% of the month. Two chains stopped producing blocks and rolled back state to undo the damage. Here's the month in security 👇

Read more
about August 2026: The Price Feed Was Exploited
Quantstamp Announcements

July Security Beat: Keys Over Code (Again?)

Crypto lost more than $240 million across 29 incidents in July 2026, up roughly 216% from June's $75.87M, even as the number of attacks fell from 40 to 29. For the second month running, the damage didn't come from clever contract exploits. The same failure class ran through Web2, from a $12.3M rail-industry ransom to a 1TB bank breach that started with one employee's email. Here's the month in security 👇

Read more
about July Security Beat: Keys Over Code (Again?)