About $ 1 million in Ethereum tokens is blocked in a new DeFi app after its developers made changes to the protocol’s smart interest rate contracts.

The DeFi lending platform, PercentFinance, a fork of Compound Finance, wrote on a blog on November 4 “that some of [its] financial markets faced a problem that could result in the permanent blocking of user funds”. The team froze money markets specifically for USDC,  ETH (ethereum ) and packaged bitcoin (WBTC).

A total of 446K USDC, 28 WBTC and 313 ETH ethereum, worth approximately $ 1 million, are currently frozen. Half of these real estate funds belong to PercentFinance’s “community mod team”, according to the post. Withdrawals to other markets are open, but the team is asking users not to borrow in any of PercentFinance’s markets in the meantime.

The mistake

In a Discord discussion of the vulnerability, Vfat, an Ethereum and PercentFinance developer, said the developer who forked Compound Finance’s PercentFinance used “old Compound contracts instead of… newer and better versions”.

Vfat has moved to update some of these smart contracts, specifically those that deal with interest rates for platform loans. After Vfat finalized the changes and implemented them, he realized that the signatures of the old and new contracts were incompatible, so the transactions could not be signed with them.

“The old and new interest rate models have different function signatures on these important functions,” he said in the Discord chat. “Essentially, the symbolic contract is trying to find an interest rate function that doesn’t come out, so it always fails with every interaction.”

Vfat also said in the chat that “Compound [the team] confirmed that this means that the contract has been closed.”

The resource

In direct messages with CoinDesk, Vfat said that it is still too early in the recovery process for a definitive plan, especially considering that no one has had a chance to speak to Center or BitGo yet, the crypto dollar USDC and WBTC token issuers, respectively.

Since USDC and WBTC have backdoors in their smart contracts, these issuers would be able to blacklist blocked funds (although they are already inaccessible, Vfat said this would be a good “extra precaution”). After the blacklist, BitGo and Center could reissue new tokens to old token owners,  something Tether did  for a merchant who mistakenly transferred $ 1 million in tokens ethereum USDT to the wrong address.

Ethereum Freeze

A Center representative told CoinDesk that the company can only interfere in USDC transactions  if it receives  “a valid and binding court order from a competent US court that has authority over the Center”. 

BitGo representatives have not been available for comment at this time.

For other recovery efforts, Vfat said that an early stage proposal suggests launching new contracts for the USDC loan markets. Although 27% of loans are blocked under old contracts, these new ones would allow borrowers to pay the rest of their loans and thus recover their guarantees and pay creditors 73 cents on the dollar.

The entire WBTC of the PercentFinance lending platform is blocked, so without BitGo’s cooperation, these funds are lost to the ether. Likewise, 100% of PercentFinance’s ETH funds have also been frozen and there is no practical way to recover those funds.

“Regardless of this haircut procedure, I am taking responsibility for the total amount of these losses and will do everything I can to make everyone 100% whole,”