28 Mar 2024, from 11:25 UTC
Prisma Finance: MigrateTroveZap Flashloan Path Skimmed Trove Collateral
Prisma: on 28 Mar 2024 insufficient validation in MigrateTroveZap.onFlashloan let attackers close and reopen Troves with less collateral. ~3,479 ETH (~$12M) taken; protocol paused.
- Event date
- Incident typeSmart-contract exploit
- Bug classValidation
- Published
Loss, as sourced
3,479.24 ETH, approximately $12 million USD, per Prisma post-mortem. Primary exploiter alone moved ~3,257 ETH (~$11M); two copycats took smaller amounts.
Traceability
Primary sources
In brief
Root cause: Per Prisma: MigrateTroveZap flashloan callback lacked input validation, letting an attacker close a victim's Trove and reopen it with the same debt but less collateral, pocketing the difference. Affected owners who setDelegateApproval(MigrateTroveZap, true).
Timeline, as sourced: Per Prisma (UTC, 28 Mar): 11:25 Exploiter 1; 11:51 Twitter warning; 12:11 revoke advice; 12:41–12:49 copycats; 12:51 emergency pause.
Account, as sourced
Claimed (Prisma) (post-mortem (opens in a new tab)): users told to revoke MigrateTroveZap delegate approval.
Exploiter 1 EOA 0x7E39E3B3ff7ADef2613d5Cc49558EAB74B9a4202.
Summaries of public sources as of the published date; except where marked (on-chain), not independently verified by NullMeridian. Figures are the sources’ own and are attributed; where sources disagree, each is given. Sources may since have changed. Not legal, financial or investment advice.
Permalinkhttps://andromeda.observer/e/prisma-migrate-trove-zap-2024