VC-backed Compound is alleging that a fast-growing DeFi startup stole its code. The dispute raises questions about what 'open-source' actually means

A lending protocol launched by Chinese decentralized finance (DeFi) platform dForce has gathered steam in recent months, but VC-backed startup Compound says dForce stole its copyrighted code.

Lendf.Me launched in Sep. 2019. Over the past two months, its locked value more than tripled, as shown by statistics provided by dForce. According to the company's founder and CEO Mindao Yang, the figure rose from $2 million to $7.8 million after the platform added support for USDT and expanded its collateral options to include the interest-bearing Ethereum token imBTC.

Based on data published by DeFi Pulse, on which Lendf.Me is not currently listed, the protocol’s locked value would make it the fifth-largest lending platform in the DeFi space.

But in the process of reporting this story, the allegation emerged that dForce had taken Compound’s code – which is publicly available but governed by a license stating that any licensee “shall not modify, transfer, assign, share, or sub-license the Software or any derivative works of the Software” – and used it to create Lendf.Me.

Compound is the developer of a decentralized finance-focused lending protocol and is backed by notable venture capital firms like Andreessen Horowitz, Bain Capital Ventures, Polychain Capital and Coinbase, among others.

“[Lendf.Me] stole 100.00% of the Compound v1 code,” Compound CEO Robert Leshner told The Block. “The proof is on-chain.”

A comparison between Lendf.Me’s and Compound’s code appears to confirm Leshner's statement. For example, Lendf.Me’s smart contract notes on its 654th line that “`MoneyMarket` is the core Compound MoneyMarket contract.” The term "Compound" appears four times in the Lendf.Me contract. 

After The Block reached out to dForce for comment, the company added an attribution to Compound on its website and GitHub page, which now reads: “Lendf.me comprises of the following modules: Money Market Contract (based on Compound V1), Interest rate models, oracle, liquidator, liquidation monitor, market dashboard and front-end UI&UE.” It also states that “[a]ll the codes (except otherwise specified) of this project are open source and are licensed under MIT License.”

Yang told The Block that he was surprised that Compound never reached out to dForce regarding the potential copyright infringement given that Lendf.Me was launched over four months ago.

“It’s a bit surprising that Compound didn’t lodge this with us if this is really an issue or concern,” Yang said. “This was the first time that we knew that Compound took the attribution so heavily.”

Leshner confirmed that Compound has not contacted dForce and claimed that he was just made aware of the situation.

“We actually were just tipped off about LendF.Me. It’s new to us and we are evaluating our legal options,” he said.

The meaning of "open source"

The dispute appears at first glance to be a nuanced one; the term “open source” is more often than not taken to mean that the code itself can be used, modified and repurposed at will.

Indeed, it was bitcoin’s open-source code that served as the seed for many other cryptocurrencies and blockchain-based projects and initiatives.

Merriam-Webster defines “open-source” as “having the source code freely available for possible modification and redistribution,” and open-source advocacy group the Open Source Initiative, which was founded in the late 1990s, contends that “the license must allow modifications and derived works, and must allow them to be distributed under the same terms as the license of the original software.”

Speaking to The Block, Compound’s Leshner argued that the code being openly available is a separate issue from the company’s licensing decisions.

“All Compound code is available for review, inspection, and auditing, but that does not mean you can freely steal or republish it – in fact, all of our code is copyrighted, e.g ‘rights reserved’,” he said.

But Yang believes that the idea of copyright exists in contrast with the open-source ideal that the cryptocurrency movement stands for.

“What really makes crypto shine is its open source merits,” he said. “If Compound really wants to steer its open finance endeavor toward closed finance pursuit and old school patented monopoly, I think they have an uphill battle to fight and a battle regarding its own existence.”

According to Yang, the issue of using Compound’s code was brought up very early in Lendf.Me’s development process but it was dismissed as a serious concern because many lending protocols already use similar models.

“The assessment at the time was that, almost all the projects out there are using similar models or pretty much the same model. There is no monopoly in terms of lending protocol in the market and the money market module itself is not a complete product,” he said.

But experts reached by The Block contend that the reality, such as it is, sits in Compound’s favor here.

Though Compound’s website describes its protocol as open-source, that doesn’t mean that the company can’t exert ownership claims over the work it produces.

“A problem with the term ‘open-source’ is that it’s very hard to define,” he said. “It doesn’t necessarily provide legal guarantees that the information is not copyrightable,” Chris Padovano, founder of Decentralized Legal and a former legal advisor at MakerDAO Foundation, told The Block. “It may be somewhat misleading to describe oneself as an open project but secretly, from a marketing and business perspective, to keep all the copyrights. And it seems like this is exactly what Compound is doing.”

Primavera De Filippi, a legal scholar and permanent researcher at the National Center of Scientific Research (CNRS), told The Block that “the license used by Compound is obviously not an open source license, hence if dForce has copied it, they cannot license it under MIT, because they do not own the copyright over it (except for the parts that they have written themselves, if any).”

“Compound probably advertised their code as ‘open source’ in the sense that the code is available for anyone to see (but not for anyone to freely reproduce or modify),” she continued. “This might be slightly deceiving, but since they didn't mention any specific license, dForce should have known better and go check the actual terms of the license before forking the code.”

Padovano echoed that sentiment, noting that it’s problematic for dForce to open source its code given that the code is based on Compound’s copyrighted code.

“You can't take a derivative work of something that's already been infringed upon and make a copyright decision to make it open-source,” he said.