# Two Small DeFi Exploits Show the Same Root Cause: Code That Trusted Inputs It Never Verified

BonfireSwap's router lost about $50,000 across 41 holders to a missing caller check, and a third-party Uniswap v4 hook lost 10.7 ether to collateral priced at the pool's live spot rate.

- Published: 2026-09-17T05:45:36.942Z
- Canonical: https://polylog.news/crypto/2026-09-17/two-small-defi-exploits-show-the-same-root-cause-code-that-t
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [DeFiHackLabs](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/1f76eb72c0638584c79cfbf5889bf6869fb7362d), [DeFiHackLabs](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/a7b45f7a63d199b2fba3d9062ad518d326f789a2), [DeFiHackLabs](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/2992c8ba68fb39707b8033aeea4c747241de35fb), [PANews](https://panews.io/articles/01a0a931-ae81-7226-b65f-179fd3b16281)

Researchers published working proof-of-concept exploits for two incidents this week, both small in dollar terms and both instructive about where losses now originate. The BonfireSwap router contract was missing a caller authorization check…

This story is for subscribers. Read it in full at https://polylog.news/crypto/2026-09-17/two-small-defi-exploits-show-the-same-root-cause-code-that-t (subscription information: https://polylog.news/pricing).