Three New Exploit Write-Ups Show Losses Coming From Checks That Were Never Written

Security researchers published three reproducible exploit demonstrations overnight, and none of them involved broken cryptography or a compiler trick. Each turned on a check a developer assumed someone else had made.

The largest, against the lending market Prime Finance, replayed real oracle data. The protocol's report-verification function was open to anyone and confirmed that a price report carried a valid signature from Chainlink's decentralized oracle network, but never confirmed the report was current. The attacker took a flash loan, submitted two previously signed reports, repriced the PRFI token from roughly $0.0021 to roughly $0.1101, bought the token from a thin pool, posted it as collateral at the inflated value and borrowed against it. About 425.5 wrapped HYPE left the reserve. Every signature involved was genuine.

The second, against the margin protocol Likwid on BNB Chain, cost 74.31 BNB. In the zero-leverage borrow path the contract updated three internal balances but not the one that feeds back into pool reserves, so the automated market maker quoted the same marginal price no matter how much value moved. The attacker repeated the cycle fourteen times. SlowMist flagged the loss. The third write-up shows a permissionless staking call inflating the reported net asset value of a Flamincome vault strategy, so withdrawals overpaid.

Separately, MultiversX said at 10:00 UTC it was investigating a potential mainnet issue and promised an update within twelve hours. The team disclosed no cause, and reported no confirmed losses. None of the three exploit write-ups records recovered funds or an attribution.