Planet.finance exploited for ~$50K via incorrect discount calculation in the borrowing logic that treated new principal as accrued interest, enabling a flash-loan attack to reduce repayment obligations.
Security & Exploits ·
Planet.finance suffered a $50K loss after an attacker exploited a flaw in the changeUserBorrowDiscount() function within PlanetDiscountDelegate. The vulnerability stems from incorrect discount calculation logic that treats newly borrowed principal as accrued interest, allowing the borrower's discount to be inflated rather than earned through time. An attacker flash-loaned USDT and used GAMMA collateral to borrow repeatedly from multiple markets including gUSDT and gBNBx, executing a 63-iteration loop that called updateUserDiscount on each iteration.
In each loop cycle, the function calculated a fake "interest" amount equal to the freshly borrowed principal by computing currentBorrowBal - lastBorrowAmountDiscountGiven. This artificially inflated interest was then discounted by up to 50% against the reserve factor, systematically reducing accountBorrows, totalBorrows, and totalReserves without legitimate accrual. After completing the loop, the attacker repaid only a fraction of the USDT owed, absconding with the difference.
Recovery efforts managed to retrieve approximately $8,150 of the lost funds, which were returned to the Planet deployer. The vulnerable contract remains identifiable on-chain, though details regarding root cause mitigation or broader protocol impact have not been disclosed.