Governance tokens will not be easily distributable to users

[mgcolburn]

Severity: Medium

The CompoundHandler contract will be a frequent recipient of COMP airdrops as it is the address that directly interfaces with the Compound system. However, as the contract has no facilities to track end-user shares of these unexpected tokens or to support their withdrawal directly by users, the tokens will be effectively lost.

In an emergency, it may be possible to recover them by authorizing an EOA or by tricking the system into thinking COMP is a cToken. However, these approaches would be incredibly manually-intensive, centralized and error-prone and should be avoided.

Recommendation

Avoid using the CompoundHandler while a long term solution to support airdrops is investigated and implemented.

[Donald-Nobel]

Since Compound Handler manages multi assets deposited in Compound at the same time, so if it receives COMP airdrops, there is no chance to identify the contribution from which asset. Here is the fix:

1. check COMP balance of Compound Handler after calling CToken Mint/Redeem, if COMP token received, will transfer it to dToken contract respectively.
2. In the short term, an external service(which will trigger rebalance of allocation of the underlying token in different handlers) will trigger a strategy to convert COMP(in the dToken contract) into the underlying token and distribute to the internal handler, as result the dToken exchange-rate will be increased and dToken holders will benefit with a higher yield.
3. In the long term, we prefer a more smart distribution strategy along with DF farming, will discuss with you in Slack.