PrismaLST Hack
What happened
On March 28, 2024, attackers exploited Prisma Finance's MigrateTroveZap migration helper on Ethereum. The helper trusted attacker-controlled flash-loan callback data, enabling the attackers to close approved users' troves, reopen them with less collateral but the same debt, and extract the collateral difference.
MigrateTroveZap.onFlashLoan() did not validate that its calldata originated from an authorized migration flow or ensure that the new collateral matched the collateral withdrawn from the original trove. Any caller of the public flash-loan path could therefore forge migration parameters and operate on a user trove that had granted the helper delegate approval.
How it happened
The attackers bypassed the intended migrateTrove flow and called the public flash-loan entry point directly, setting MigrateTroveZap as receiver and supplying forged migration data. The callback closed a victim trove and reopened it with substantially less wstETH collateral. The residual collateral remained in the helper contract.
The attacker then created and migrated a small trove to absorb that residual collateral, closed it, and repaid the flash loans. A primary attacker was followed by two copycats. Prisma paused operations and advised users with an active delegate approval for the migration helper to revoke it.
Protocol details
Security review history
- Nomoi View report
- Zellic View report
Evidence
- report @PeckShieldAlert incident report twitter.com
- report Prisma Finance Incident Post-Mortem hackmd.io
- transaction Prisma Primary Exploit Transaction etherscan.io
- analysis DeFiLlama defillama.com
- analysis Prisma Finance Incident Analysis certik.com
- analysis Prisma Finance Exploit Analysis blog.cube3.ai
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
