$1 million crypto assets frozen by DeFi PercentFinance developer error
Due to a developer error in the DeFi PercentFinance application, Compound Finance fork, 446,000 USDC, 28 WBTC and 313 ETH were frozen, the total value of which exceeds $1 million.
The DeFi PercentFinance platform team wrote in a blog that “there is a problem in some money markets that can lead to a permanent blockage of users’ assets. The team has frozen the money markets for USDC, ETH and WBTC.
A total of 446,000 USDC, 28 WBTC and 313 ETH, equivalent to approximately $1 million, have been frozen. According to the blog post, half of these assets belong to PercentFinance’s “community development team. Withdrawal from other markets is open, but the team urges users not to borrow in any of PercentFinance’s markets.
In discussing this vulnerability in Discord, developer of Etherium and PercentFinance Vfat said the other developer who forked PercentFinance from Compound Finance “used old Compound contracts instead of… newer, much better versions.
Vfat has begun updating some of these smart contracts, in particular the governing interest rates on loans platform. After Vfat completed the changes and deployed them, it realized that signatures for both old and new contracts were incompatible, so you can’t sign transactions with them.
“Old and new interest rate models have different signatures for all these important functions,” he said in a Discord chat. “In fact, a token contract tries to find an interest rate function that doesn’t work, so it fails every time it interacts.
According to Vfat, the Compound team has confirmed that this means blocking the contract. He noted that it’s too early to talk about an asset recovery plan because the protocol developers have not yet communicated with Centre or BitGo, the issuers of USDC and WBTC, respectively.
In theory, USDC and WBTC issuers could blacklist addresses with blocked assets. Once blacklisted, BitGo and Centre could reissue new tokens to the old owners, which Tether did for the trader who mistakenly transferred 1 million USDT to the wrong address.
Centre’s spokesman said the company can only intervene in USDC transactions if it receives a “valid, binding court order from a competent US court that has jurisdiction over Centre.
As for other recovery efforts, Vfat said one proposal at an early stage involves launching new contracts for USDC’s credit markets. Although 27 percent of loans are fixed in old contracts, the new contracts will allow borrowers to repay the rest of their loans, thus obtaining their collateral and paying lenders $0.73 cents for $1. There is no way to recover the ETH blocked in the contract.
“Whatever further action I take, I will take responsibility for the lost assets and do everything in my power to recover the losses,” Vfat said.
Recall that a user recently mistakenly sent $1.1 million worth of AAVE tokens to a token smart contract address. Now these tokens are blocked and it is impossible to return them.
