Percent Finance Hack

TOTAL LOST $1.9M
Medium Other

What happened

The problem was that the old interest rate contracts have different signatures for getSupplyRate and getBorrowRate. They return 2 uint values, the first one being an error code. So, after the swap, they were unable to call these functions on the new interest rate contracts, as the signatures do not match. Making the problem worse, these functions are checked before every interaction with these contracts (supplying, borrowing, redeeming, repaying, etc). They are also checked before changing the interest rate contract again. So, because the current interest rate contract does not work, it is impossible to change to a new one.

This meant that these 3 contracts were no longer usable, and the user funds in them were permanently locked. These amounted to: 446,813 USDC, 28 wBTC and 313 ETH.

Case & protocol details

Classification Borrowing and Lending
Protocol Type Lending
Affected asset / contract PCT
Official Website percent.finance/
Protocol Twitter/X @PercentFinance

Evidence & learning

Practice this exploit pattern safely

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.