What happened
On July 23, 2024, an attacker took over 13 DeltaPrime Prime Accounts on Arbitrum and withdrew about $1 million of user collateral. DeltaPrime traced the breach to a misconfiguration in its DiamondBeaconProxy setup: an initialization method that should have been removed after deployment was still reachable from Prime Accounts, and its re-initialization guard read a different storage slot from the one that stores the account owner. That let the attacker re-initialize accounts and set himself as owner.
After negotiation the attacker returned about $900,000 and kept the remaining roughly $100,000 as a bounty, which DeltaPrime covered from its stability pool so affected users were made whole. On July 24, AstraSec reported a similar but separate ownership bug in DeltaPrime's account-creation contract that was fixed before anyone exploited it.
How it happened
- Each Prime Account is a
DiamondBeaconProxy, so calls it cannot handle itself are routed to shared implementation facets, including theDiamondBeaconinit()method left accessible after deployment. init()checked an_initializedflag in theDiamondBeaconstorage slot (0xc8fcad8d...c131c), not in the Prime Account storage slot (0x8d5bb42e...960a) where the account owner lives, so the "already initialized" check passed on live accounts.- The attacker called it on 13 accounts and wrote his own address as owner.
- Solvency checks and withdrawal guards still applied to the hijacked accounts, so the attacker unwound positions and repaid each account's pool loans before withdrawing the remaining collateral, about $1M in total.
Protocol details
Security review history
- PeckShield View report
Evidence
- report @DeltaPrimeDefi incident report x.com
- analysis DeFiLlama defillama.com
- analysis Jul 2024 - DeltaPrime Smart Contract Vulnerability - $1m (Global) quadrigainitiative.com
- analysis How AstraSec team prevented DeFi protocol from suffering $64m hack dlnews.com
- analysis Lending protocol Delta Prime suffers second exploit in two months, bringing losses above $10 million theblock.co
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
