What happened
On March 28, 2024, attackers exploited Prisma Finance's MigrateTroveZap migration helper on Ethereum. The helper trusted attacker-controlled flash-loan callback data, enabling the attackers to close approved users' troves, reopen them with less collateral but the same debt, and extract the collateral difference.
MigrateTroveZap.onFlashLoan() did not validate that its calldata originated from an authorized migration flow or ensure that the new collateral matched the collateral withdrawn from the original trove. Any caller of the public flash-loan path could therefore forge migration parameters and operate on a user trove that had granted the helper delegate approval.
Case & protocol details
Attack Timeline
The attackers bypassed the intended migrateTrove flow and called the public flash-loan entry point directly, setting MigrateTroveZap as receiver and supplying forged migration data. The callback closed a victim trove and reopened it with substantially less wstETH collateral. The residual collateral remained in the helper contract.
The attacker then created and migrated a small trove to absorb that residual collateral, closed it, and repaid the flash loans. A primary attacker was followed by two copycats. Prisma paused operations and advised users with an active delegate approval for the migration helper to revoke it.
Evidence & learning
Attack pattern
Compare incidents →Sources and on-chain records
- report Report twitter.com
- report Prisma Finance Incident Post-Mortem hackmd.io
- transaction Transaction etherscan.io
- analysis Prisma Finance Incident Analysis certik.com
- analysis Prisma Finance Exploit Analysis blog.cube3.ai
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.