DeltaPrime Hack

Reported loss $4.8M
Arbitrum Avalanche
Debt Swap Exploit

What happened

On November 11, 2024, an attacker drained DeltaPrime's lending pools on Arbitrum and Avalanche for about $4.75 million. Three Sigma estimated $4.85 million and PeckShield about $4.8 million. It was DeltaPrime's second loss of user funds in two months, after a separate wallet-compromise incident in September.

The exploit chained two input-validation bugs in Prime Account functions. swapDebtParaSwap did not validate _repayAmount, and claimReward accepted an arbitrary, attacker-supplied pair contract. Together they let the attacker borrow pool assets and pull them out as fake rewards while keeping the collateral.

Stolen assets included USDC, USDT, WETH, BTC.b and AVAX. The attacker (0xb87881637b5c8e6885c51ab7d895e53fa7d7c567) parked part of the funds in Avalanche DeFi protocols such as LFJ and Stargate instead of cashing out. DeltaPrime paused all pools on both chains.

How it happened

  1. The attacker took a WETH flash loan, unwrapped it to ETH and funded a DeltaPrime Prime Account with it as collateral.
  2. They called swapDebtParaSwap with _repayAmount set to 0 and a borrow amount of about 66 WETH in the transaction Verichains analyzed. The function did not validate the repay value, so the account took on new pool debt without repaying the old debt, as a real debt swap would.
  3. They called claimReward on the TraderJoe V2 facet and passed a malicious contract as the pair argument. That fake pair "swapped" ETH back into WETH. The protocol then treated the borrowed funds as reward or fee and let them leave the account while the collateral stayed in place.
  4. The attacker repaid the flash loan and kept the borrowed assets. They repeated the pattern on Arbitrum (first strike 0x9efe855cd3783462207ff8a3d94dc17a74e2b2f00bf1b4c8a7e0135dae83ab5c) and Avalanche (first strike 0xece4efbe11e59d457cb1359ebdc4efdffdd310f0a82440be03591f2e27d2b59e).
  5. DeltaPrime paused all pools. Verichains reports that the fix added a pair whitelist to claimReward.

Protocol details

Classification Protocol Logic / Yield Aggregator / Input Validation
Protocol Type Leveraged Farming
Implementation language Solidity
Protocol links Website @DeltaPrimeDefi

Security review history

Evidence

Proof of concept

1 available

Sources

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes