PERCENT FINANCE

DESCRIPTION OF EVENTS

"Percent Finance is a decentralized protocol that came to life in September 2020." "Percent Finance is a community-owned fork of Compound, which uses Chainlink as its price oracle. These two key differences meant that Percent could innovate quickly, and carve its own path, while of course standing on the shoulders of the above two giants. Percent already succeeded in adding 15 tokens to its money market, all securely using Chainlink prices, and there are plans for more."

"On Nov 5, Percent Finance, a community-owned fork of Compound Finance declared that some trouble in the platform might cause locking up of user funds. According to the reports, almost $1M was stuck in money market smart contracts. Further explanation reveals that the markets were frozen as they used an old style of CToken."

"The one million frozen by the company consists of 313 Ethereum, 446k USDC, 28 WBTC. The total amount of value frozen is $996,000. The blog described how the error came from an update that has frozen Percent Finance’s markets across the USDC, ETH, and WBTC."

"This meant that these 3 contracts were no longer usable, and the user funds in them were permanently locked. These amounted to: 446,813 USDC, 28 wBTC and 313 ETH." "As the team further explained, the frozen markets use an older style of CToken copied from Compound protocol as part of the fork. The error occurred when old-style tokens were updated to use a new style interest rate model, which is not compatible with them. As a result, CToken failed when trying to accrue interest."

"I attempted to contact both Circle and BitGo to see about possibly retrieving the USDC and wBTC, but both avenues were dead-ends. I was not able to get an official response from either, however I was made aware that Circle does not offer this functionality, at least currently, although they might do in the future. They only respond to requests from law enforcement. BitGo on the other hand only offers this functionality for funds send to the wBTC contract, but no other contracts."

"Percent Finance’s clients are no longer able to withdraw, repay, supply, or borrow their funds. The team said that they would try and do all they could to rectify the situation." "According to the thread, while the team has detected the error and can code for a new contract that will be compatible, the tokens from the old contract cannot be migrated over to the new contract." "The affected users are invited to contact the community moderator via direct messages of a dedicated Discord channel."

"Unfortunately, it seems the locked ETH may be irretrievable, but we are currently working on potential scenarios to make affected users whole."

Percent finance was originally launched by an anonymous developer.

The smart contract was handed off to be managed by the community in a multi-signature fashion. Some members of this new management were not familiar with how all of the assets operated, and made a mistake which resulted in almost a full million dollars worth of users funds being locked up.

At last check, the project still has not changed since November 2020, so the situation does not look promising for affected users.

HOW COULD THIS HAVE BEEN PREVENTED?

Unfortunately, cryptocurrency is not forgiving when funds are locked in an inaccessible wallet.

It is therefore prudent that all changes be tested before deployment.

To have certainty of security, it would be recommended to stick to known wallet setups that leave the funds in the control of an multi-sig of trained, background checked individuals who store keys properly offline.

Check Our Framework For Safe Secure Exchange Platforms

Crypto Hacks 2020: A Comprehensive List - ImmuneBytes (May 18)
Percent Finance Homepage (May 24)
Percent Finance Incident Post-Mortem (May 24)
Percent Finance announces $1 million frozen | Cryptopolitan (May 24)
Over $1 million locked in a DeFi protocol due to a smart contract error (May 24)
@PercentFinance Twitter (May 24)
Over $1M in user funds on Compound fork Perfect Finance are frozen after code change error (May 24)
Percent Finance - Important Announcement (May 24)
DeFi Protocol Percent Finance Accidentally Freezes $1M of Users Funds | News | ihodl.com (May 24)
Close to $1 Million Frozen in Percent Finance Smart Contracts (May 24)
SlowMist Hacked - SlowMist Zone (May 18)
Millions Lost: The Top 19 DeFi Cryptocurrency Hacks of 2020 | Crypto Briefing (May 22)
@PercentFinance Twitter (Jun 27)

More case studies

Axion Staking
Inside Job

Cheese
Bank Heist