Morning Edition · Thursday, September 17, 2026Published at 1:45 AM EDT · New York

Two Small DeFi Exploits Show the Same Root Cause: Code That Trusted Inputs It Never Verified

BonfireSwap's router lost about $50,000 across 41 holders to a missing caller check, and a third-party Uniswap v4 hook lost 10.7 ether to collateral priced at the pool's live spot rate.

Researchers published working proof-of-concept exploits for two incidents this week, both small in dollar terms and both instructive about where losses now originate. The BonfireSwap router contract was missing a caller authorization check…