代码修改给 Pac Finance 用户造成重大损失

周四，Aave 分叉 Pac Finance 的代码更改导致用户损失 2600 万美元。这一改变降低了清算抵押品的门槛，是由有权访问该协议管理钱包的人在没有警告的情况下做出的。该事件凸显了 DeFi 协议中可升级代码的风险，因为获得许可的人可以随时更改协议规则。

Code Alteration Triggers Substantial Losses for Pac Finance Users

代码更改导致 Pac Finance 用户遭受重大损失

An unforeseen code modification at Pac Finance, a derivative of the well-known lending platform Aave, has inflicted significant financial losses upon its users, amounting to approximately $26 million.

知名借贷平台 Aave 的衍生品 Pac Finance 发生意外代码修改，给用户造成了约 2600 万美元的重大财务损失。

The incident, which occurred on April 11th at approximately 1:00 AM London time, involved an individual with access to Pac Finance's administrative wallet initiating an update to the protocol's code. This modification resulted in a reduction of the threshold at which the protocol liquidates users' collateral.

该事件发生于 4 月 11 日伦敦时间凌晨 1:00 左右，涉及一名有权访问 Pac Finance 管理钱包的个人启动协议代码更新。这一修改导致协议清算用户抵押品的阈值降低。

Within moments of the alteration, over a dozen traders utilizing Pac Finance's "leverage farming" strategy for Renzo's ezETH token faced the liquidation of their collateral, leading to substantial losses totaling $26 million.

更改发生后不久，十多名利用 Pac Finance 的“杠杆农业”策略购买 Renzo 的 ezETH 代币的交易员面临抵押品清算，导致总计 2600 万美元的巨额损失。

Pac Finance, in a statement released on its X platform, attributed the incident to an "unexpected alteration of the liquidation threshold without prior notification to our team." The protocol pledged to implement a governance contract, timelock, and forum for all future upgrades to prevent similar occurrences.

Pac Finance 在其 X 平台上发布的一份声明中，将该事件归因于“在未事先通知我们团队的情况下意外改变了清算门槛”。该协议承诺为未来的所有升级实施治理合约、时间锁和论坛，以防止类似情况发生。

The incident highlights the potential risks associated with upgradable code in decentralized finance (DeFi) protocols. Such protocols grant those with the appropriate permissions the ability to modify the governing rules at any time, often without prior notice.

该事件凸显了去中心化金融（DeFi）协议中可升级代码的潜在风险。此类协议授予具有适当权限的人员随时修改管理规则的能力，通常无需事先通知。

Not all DeFi protocols incorporate upgradable code. Prominent examples such as Uniswap and Curve Finance employ immutable code, ensuring that once deployed on a blockchain, it cannot be retroactively altered.

并非所有 DeFi 协议都包含可升级代码。 Uniswap 和 Curve Finance 等著名示例采用不可变代码，确保一旦部署在区块链上，就无法追溯更改。

"Designing a lending protocol that allows an externally owned account to arbitrarily adjust the liquidation threshold without a timelock is not only poor design but also irresponsible," commented Kydo, a researcher at restaking protocol EigenLayer, on the X platform.

“设计一个允许外部拥有的账户在没有时间锁定的情况下任意调整清算阈值的借贷协议，不仅是糟糕的设计，而且也是不负责任的，”X 平台上的重新抵押协议 EigenLayer 的研究员 Kydo 评论道。

The liquidations and subsequent withdrawals from concerned users have significantly reduced Pac Finance's total value locked (TVL) by over 50%.

相关用户的清算和随后的提款已使 Pac Finance 的总锁定价值 (TVL) 大幅减少了 50% 以上。

Pac Finance has yet to provide an official response to requests for comment.

Pac Finance 尚未对置评请求做出正式回应。

'Fundamental Problem' with Forks

叉子的“根本问题”

Pac Finance is a "fork" of Aave, the largest lending protocol in DeFi with deposits exceeding $11.2 billion. Forks involve developer teams leveraging the open-source code of existing DeFi protocols to launch similar protocols, often on different blockchains or with minor variations.

Pac Finance 是 DeFi 中最大的借贷协议 Aave 的“分叉”，存款超过 112 亿美元。分叉涉及开发团队利用现有 DeFi 协议的开源代码来启动类似的协议，通常是在不同的区块链上或有微小的变化。

Stani Kulechov, founder and CEO of Avara, the company behind Aave, attributed the incident to Pac Finance developers' insufficient understanding of the codebase utilized to establish the protocol.

Aave 背后的公司 Avara 的创始人兼首席执行官 Stani Kulechov 将这一事件归因于 Pac Finance 开发人员对用于建立该协议的代码库了解不够。

"The fundamental issue with forking code is the absence of in-depth knowledge of the software and its parameters," Kulechov stated on the X platform.

“分叉代码的根本问题是缺乏对软件及其参数的深入了解，”Kulechov 在 X 平台上表示。

Pac Finance is not the sole instance of forks causing difficulties in DeFi. Multiple forks of the Compound lending protocol have fallen victim to hacks due to code vulnerabilities, resulting in millions of dollars in losses. Onyx protocol, which suffered a $2.1 million exploit in November, is a recent example of this issue.

Pac Finance 并不是唯一一个因分叉而导致 DeFi 陷入困境的例子。由于代码漏洞，Compound 借贷协议的多个分叉已成为黑客攻击的受害者，造成数百万美元的损失。 Onyx 协议在 11 月份遭受了 210 万美元的攻击，这是该问题的最新例子。

Despite the vulnerabilities being addressed and resolved in Compound, those who forked the protocol's code remained unaware of them.

尽管这些漏洞在Compound中得到了解决，但那些分叉该协议代码的人仍然没有意识到这些漏洞。