Code Alteration Causes Major Losses for Pac Finance Users

A code change at Aave fork Pac Finance led to $26 million in losses for users on Thursday. The change, which decreased the threshold for liquidating collateral, was made without warning by someone with access to the protocol's admin wallet. The incident highlights the risk of upgradable code in DeFi protocols, as those with permission can change the protocol's rules at any time.

Code Alteration Triggers Substantial Losses for Pac Finance Users

An unforeseen code modification at Pac Finance, a derivative of the well-known lending platform Aave, has inflicted significant financial losses upon its users, amounting to approximately $26 million.

The incident, which occurred on April 11th at approximately 1:00 AM London time, involved an individual with access to Pac Finance's administrative wallet initiating an update to the protocol's code. This modification resulted in a reduction of the threshold at which the protocol liquidates users' collateral.

Within moments of the alteration, over a dozen traders utilizing Pac Finance's "leverage farming" strategy for Renzo's ezETH token faced the liquidation of their collateral, leading to substantial losses totaling $26 million.

Pac Finance, in a statement released on its X platform, attributed the incident to an "unexpected alteration of the liquidation threshold without prior notification to our team." The protocol pledged to implement a governance contract, timelock, and forum for all future upgrades to prevent similar occurrences.

The incident highlights the potential risks associated with upgradable code in decentralized finance (DeFi) protocols. Such protocols grant those with the appropriate permissions the ability to modify the governing rules at any time, often without prior notice.

Not all DeFi protocols incorporate upgradable code. Prominent examples such as Uniswap and Curve Finance employ immutable code, ensuring that once deployed on a blockchain, it cannot be retroactively altered.

"Designing a lending protocol that allows an externally owned account to arbitrarily adjust the liquidation threshold without a timelock is not only poor design but also irresponsible," commented Kydo, a researcher at restaking protocol EigenLayer, on the X platform.

The liquidations and subsequent withdrawals from concerned users have significantly reduced Pac Finance's total value locked (TVL) by over 50%.

Pac Finance has yet to provide an official response to requests for comment.

'Fundamental Problem' with Forks

Pac Finance is a "fork" of Aave, the largest lending protocol in DeFi with deposits exceeding $11.2 billion. Forks involve developer teams leveraging the open-source code of existing DeFi protocols to launch similar protocols, often on different blockchains or with minor variations.

Stani Kulechov, founder and CEO of Avara, the company behind Aave, attributed the incident to Pac Finance developers' insufficient understanding of the codebase utilized to establish the protocol.

"The fundamental issue with forking code is the absence of in-depth knowledge of the software and its parameters," Kulechov stated on the X platform.

Pac Finance is not the sole instance of forks causing difficulties in DeFi. Multiple forks of the Compound lending protocol have fallen victim to hacks due to code vulnerabilities, resulting in millions of dollars in losses. Onyx protocol, which suffered a $2.1 million exploit in November, is a recent example of this issue.

Despite the vulnerabilities being addressed and resolved in Compound, those who forked the protocol's code remained unaware of them.