Briefing
The Prisma Finance decentralized lending protocol suffered a critical exploit on its MigrateTroveZap contract, resulting in the loss of approximately $11.6 million in user collateral. The incident was a direct consequence of a failure to validate external data within a flash loan callback, allowing an attacker to manipulate the protocol’s migration logic to siphon assets. This systemic flaw immediately compromised the Troves of users who had granted delegated approval to the vulnerable contract, with the total loss quantified at 3,257 ETH worth $11.6 million.
Context
The prevailing security posture in DeFi is one of high risk concerning complex, multi-step contract interactions, particularly those involving delegated permissions and external calls. The exploit leveraged the inherent risk of helper contracts, which are often introduced for user experience improvements but significantly expand the protocol’s attack surface. Specifically, the protocol’s reliance on a migration contract that handled sensitive user positions without rigid input sanitization created a known class of vulnerability in a newly deployed system.
Analysis
The attack vector targeted the MigrateTroveZap contract, a component designed to facilitate the migration of user Troves (collateralized debt positions). The attacker initiated a direct flash loan, bypassing the intended migrateTrove function and forcing the contract to execute the vulnerable onFlashloan() callback. The success was predicated on the callback’s lack of validation on the input data, allowing the attacker to spoof the parameters of a legitimate migration. This manipulation enabled the attacker to close a victim’s Trove and reopen it with the same debt but a significantly reduced collateral amount, effectively draining the difference (wstETH) from the contract.
Parameters
- Total Loss Valuation → $11.6 Million (Primary loss amount from the main attacker EOA).
- Exploit Vector → Inadequate Input Validation (Specifically on the onFlashloan callback function).
- Affected Asset → wstETH (The primary collateral token drained from user Troves).
- Vulnerable Component → MigrateTroveZap Contract (The helper contract responsible for position migration).
Outlook
Protocols must immediately implement a security-first design philosophy, mandating independent validation checks on all external call data, especially within flash loan callbacks, to prevent parameter spoofing. For users, the immediate mitigation step is to revoke all delegated approvals granted to the compromised MigrateTroveZap contract and similar helper contracts across other protocols. The second-order effect is a heightened scrutiny on all DeFi protocols utilizing complex migration or proxy contracts, establishing a new best practice of atomic, fully validated state transitions.
Verdict
This incident serves as a critical reminder that complexity in smart contract design, particularly with delegated approvals and external data, directly correlates with elevated systemic risk.
