程式碼修改對 Pac Finance 用戶造成重大損失

週四，Aave 分叉 Pac Finance 的代碼更改導致用戶損失 2600 萬美元。這項改變降低了清算抵押品的門檻，是由有權訪問該協議管理錢包的人在沒有警告的情況下做出的。該事件凸顯了 DeFi 協議中可升級程式碼的風險，因為獲得許可的人可以隨時更改協議規則。

Code Alteration Triggers Substantial Losses for Pac Finance Users

程式碼變更導致 Pac Finance 用戶遭受重大損失

An unforeseen code modification at Pac Finance, a derivative of the well-known lending platform Aave, has inflicted significant financial losses upon its users, amounting to approximately $26 million.

知名借貸平台 Aave 的衍生性商品 Pac Finance 發生意外程式碼修改，造成了用戶約 2,600 萬美元的重大財務損失。

The incident, which occurred on April 11th at approximately 1:00 AM London time, involved an individual with access to Pac Finance's administrative wallet initiating an update to the protocol's code. This modification resulted in a reduction of the threshold at which the protocol liquidates users' collateral.

該事件發生於 4 月 11 日倫敦時間凌晨 1:00 左右，涉及一名有權訪問 Pac Finance 管理錢包的個人啟動協議代碼更新。這項修改導致協議清算用戶抵押品的門檻降低。

Within moments of the alteration, over a dozen traders utilizing Pac Finance's "leverage farming" strategy for Renzo's ezETH token faced the liquidation of their collateral, leading to substantial losses totaling $26 million.

更改發生後不久，十多名利用 Pac Finance 的「槓桿農業」策略購買 Renzo 的 ezETH 代幣的交易員面臨抵押品清算，導致總計 2600 萬美元的巨額損失。

Pac Finance, in a statement released on its X platform, attributed the incident to an "unexpected alteration of the liquidation threshold without prior notification to our team." The protocol pledged to implement a governance contract, timelock, and forum for all future upgrades to prevent similar occurrences.

Pac Finance 在其 X 平台上發布的聲明中，將該事件歸因於「在未事先通知我們團隊的情況下意外改變了清算門檻」。該協議承諾為未來的所有升級實施治理合約、時間鎖和論壇，以防止類似情況發生。

The incident highlights the potential risks associated with upgradable code in decentralized finance (DeFi) protocols. Such protocols grant those with the appropriate permissions the ability to modify the governing rules at any time, often without prior notice.

此事件凸顯了去中心化金融（DeFi）協議中可升級代碼的潛在風險。此類協議授予具有適當權限的人員隨時修改管理規則的能力，通常無需事先通知。

Not all DeFi protocols incorporate upgradable code. Prominent examples such as Uniswap and Curve Finance employ immutable code, ensuring that once deployed on a blockchain, it cannot be retroactively altered.

並非所有 DeFi 協定都包含可升級程式碼。 Uniswap 和 Curve Finance 等著名範例採用不可變程式碼，確保一旦部署在區塊鏈上，就無法追溯變更。

"Designing a lending protocol that allows an externally owned account to arbitrarily adjust the liquidation threshold without a timelock is not only poor design but also irresponsible," commented Kydo, a researcher at restaking protocol EigenLayer, on the X platform.

「設計一個允許外部擁有的帳戶在沒有時間鎖定的情況下任意調整清算閾值的借貸協議，不僅是糟糕的設計，而且也是不負責任的，」X 平台上的重新抵押協議EigenLayer 的研究員Kydo 評論道。

The liquidations and subsequent withdrawals from concerned users have significantly reduced Pac Finance's total value locked (TVL) by over 50%.

相關用戶的清算和隨後的提款已使 Pac Finance 的總鎖定價值 (TVL) 大幅減少了 50% 以上。

Pac Finance has yet to provide an official response to requests for comment.

Pac Finance 尚未對置評請求做出正式回應。

'Fundamental Problem' with Forks

叉子的“根本問題”

Pac Finance is a "fork" of Aave, the largest lending protocol in DeFi with deposits exceeding $11.2 billion. Forks involve developer teams leveraging the open-source code of existing DeFi protocols to launch similar protocols, often on different blockchains or with minor variations.

Pac Finance 是 DeFi 中最大的借貸協議 Aave 的“分叉”，存款超過 112 億美元。分叉涉及開發團隊利用現有 DeFi 協議的開源程式碼來啟動類似的協議，通常是在不同的區塊鏈上或有微小的變化。

Stani Kulechov, founder and CEO of Avara, the company behind Aave, attributed the incident to Pac Finance developers' insufficient understanding of the codebase utilized to establish the protocol.

Aave 背後的公司 Avara 的創始人兼首席執行官 Stani Kulechov 將這一事件歸因於 Pac Finance 開發人員對用於建立該協議的程式碼庫了解不夠。

"The fundamental issue with forking code is the absence of in-depth knowledge of the software and its parameters," Kulechov stated on the X platform.

「分叉程式碼的根本問題是缺乏對軟體及其參數的深入了解，」Kulechov 在 X 平台上表示。

Pac Finance is not the sole instance of forks causing difficulties in DeFi. Multiple forks of the Compound lending protocol have fallen victim to hacks due to code vulnerabilities, resulting in millions of dollars in losses. Onyx protocol, which suffered a $2.1 million exploit in November, is a recent example of this issue.

Pac Finance 並不是唯一一個因分叉而導致 DeFi 陷入困境的例子。由於程式碼漏洞，Compound 借貸協議的多個分叉已成為駭客攻擊的受害者，造成數百萬美元的損失。 Onyx 協議在 11 月遭受了 210 萬美元的攻擊，這是該問題的最新例子。

Despite the vulnerabilities being addressed and resolved in Compound, those who forked the protocol's code remained unaware of them.

儘管這些漏洞在Compound中得到了解決，但那些分叉協議程式碼的人仍然沒有意識到這些漏洞。