DEFISECURITY

Blast lending protocol Pac Finance suddenly changed parameters, causing users to be liquidated for $26 million.

share
Blast lending protocol Pac Finance suddenly changed parameters, causing users to be liquidated for $26 million.

Following the incident where the gaming platform Munchables was almost hacked by developers suspected to be from North Korea, resulting in the loss of $60 million, another mishap occurred with the lending protocol on the Blast chain.

Suspected North Korean hackers infiltrated the team long-term, Blast-certified project Munchables hacked for $60 million

Blast Protocol Faces Another Issue

Developer @0xkydo from Eigen Labs tweeted early on the 12th, pointing out that the lending protocol Pac Finance, based on Blast, was liquidated for $26 million.

He mentioned a suspected EOA wallet controlled by Pac Finance updated the liquidation threshold without any official announcement or contract time lock.

Just 6 seconds after the update, $26 million was liquidated on Pac Finance.

He considered the $26 million liquidation as "fortunate" and urged all protocols requiring user re-collateralization to avoid any interaction with Pac Finance.

He criticized that arbitrary changes to the liquidation threshold without a time lock are not only bad design but also irresponsible behavior on the part of developers.

Pac Finance Official: Actively Addressing the Issue

Without any announcement, Pac Finance lowered the loan-to-value (LTV) ratio to 60%, resulting in a large number of users borrowing with ezETH being liquidated.

In response, Pac Finance officials stated that they are contacting affected users and actively formulating a plan to mitigate the impact.

They stated:

During the process of adjusting the loan-to-value ratio LTV, we assigned a smart contract engineer to make the necessary updates. However, we found that the liquidation threshold was unexpectedly changed without notifying the team, resulting in this unfortunate incident.

Pac Finance will set up a governance forum to ensure that future updates are discussed in advance, but they have not disclosed any related compensation plans.