# Three New Exploit Write-Ups Show Losses Coming From Checks That Were Never Written

Prime Finance lost about 425 wrapped HYPE to a replayed but validly signed oracle report, Likwid lost 74.31 BNB to a missing reserve update, and MultiversX spent Saturday investigating an undisclosed mainnet issue.

- Published: 2026-09-20T05:45:09.559Z
- Canonical: https://polylog.news/crypto/2026-09-20/three-new-exploit-write-ups-show-losses-coming-from-checks-t
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [DeFiHackLabs](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/40e046dc5dcb1593393a75ff1ef30c7089414582), [DeFiHackLabs](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/486dba7730b4dc730f66124c0ffecd60840601eb), [DeFiHackLabs](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/fe62f6863f02f0f019d81e48ff020ce50ed089fa), [crypto.news](https://crypto.news/multiversx-investigates-potential-mainnet-issue/)

Security researchers published three reproducible exploit demonstrations overnight, and none of them involved broken cryptography or a compiler trick. Each turned on a check a developer assumed someone else had made.

The largest, against the lending market Prime Finance, [replayed real oracle data](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/40e046dc5dcb1593393a75ff1ef30c7089414582). The protocol's report-verification function was open to anyone and confirmed that a price report carried a valid signature from Chainlink's decentralized oracle network, but never confirmed the report was current. The attacker took a flash loan, submitted two previously signed reports, repriced the PRFI token from roughly $0.0021 to roughly $0.1101, bought the token from a thin pool, posted it as collateral at the inflated value and borrowed against it. About 425.5 wrapped HYPE left the reserve. Every signature involved was genuine.

The second, against the margin protocol Likwid on BNB Chain, cost 74.31 BNB. In the zero-leverage borrow path the contract [updated three internal balances but not the one that feeds back into pool reserves](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/486dba7730b4dc730f66124c0ffecd60840601eb), so the automated market maker quoted the same marginal price no matter how much value moved. The attacker repeated the cycle fourteen times. SlowMist flagged the loss. The third write-up shows a [permissionless staking call inflating the reported net asset value](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/fe62f6863f02f0f019d81e48ff020ce50ed089fa) of a Flamincome vault strategy, so withdrawals overpaid.

Separately, MultiversX said at 10:00 UTC it was [investigating a potential mainnet issue](https://crypto.news/multiversx-investigates-potential-mainnet-issue/) and promised an update within twelve hours. The team disclosed no cause, and reported no confirmed losses. None of the three exploit write-ups records recovered funds or an attribution.

## What this means

All three incidents sit outside the surface that audits and bug bounties normally price. A signature check that passes, a staking function that is meant to be open, and an accounting field that exists but goes unset are not code defects in the conventional sense, which is why reviewers scoped to contract logic keep missing them. Lenders and vault depositors carry the loss directly, and the practical cost falls to protocols that must now extend monitoring to freshness windows, privileged callers and every path where an external input is trusted because it is signed.

## What to watch

- Whether MultiversX names a cause in its follow-up, since an undisclosed mainnet fault that resolves quietly and one that involved state or funds are very different signals for validators and exchanges.
- Whether oracle providers add enforced freshness windows at the consumer level rather than leaving staleness checks to each integrating protocol, which would close the replay path used against Prime Finance.
- Whether any of the three protocols publishes a recovery or attribution notice, because silence after a published proof-of-concept usually means the funds have already moved to another address.