Incident Overview
The problem was that the old interest rate contracts have different signatures for `getSupplyRate` and `getBorrowRate`. They return 2 uint values, the first one being an error code. So, after the swap, they were unable to call these functions on the new interest rate contracts, as the signatures do not match. Making the problem worse, these functions are checked before every interaction with these contracts (supplying, borrowing, redeeming, repaying, etc). They are also checked before changing the interest rate contract again. So, because the current interest rate contract does not work, it is impossible to change to a new one.
This meant that these 3 contracts were no longer usable, and the user funds in them were permanently locked. These amounted to: 446,813 USDC, 28 wBTC and 313 ETH.
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Percent Finance, these are the critical security checks that could have prevented this incident (November 2020).
- Verify all logic paths related to Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSources & References
Learn to Prevent the Next Percent Finance
The Percent Finance hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.