How a Migration Helper Contract Bled Prisma Finance of $11.6M in wstETH

Prisma Finance had marketed itself as the definitive platform for liquid restaking. On March 28th, it earned a less flattering distinction: the first restaking protocol to be successfully exploited via flash loan, with attackers making off with 3,258 wstETH — roughly $11.6 million at the time.

Security firm Cyvers was first to flag unusual activity, posting an alert that pushed Prisma to examine its TroveManager contract. The team acknowledged the issue publicly shortly afterward, saying core engineering contributors would pause the protocol while they investigated, and followed up by telling vault owners to revoke delegate approvals immediately.

Roughly four hours after the initial alert, Prisma confirmed that its emergency multisig had frozen the protocol and that remaining funds were secure. The team also noted that its stablecoins, mkUSD and ULTRA, remained overcollateralized and unaffected.

Separately, researchers at Decurity spotted a second, copy-cat exploit contract that had been deployed on-chain but, as far as anyone could tell, never actually triggered — flagged in a tweet.

The incident lands amid a broader uptick in attacks as crypto markets emerge from their bear-market lull. Prisma itself is a modified fork of the Liquity Protocol; Liquity has since stated that the vulnerability exploited on Prisma does not exist in its own codebase. Given restaking's current popularity, this may be the opening incident in a wider trend rather than an isolated event.

The mechanism

According to a root-cause writeup from ExVul, the flaw lived in the MigrateTroveZap contract — a helper meant to automate moving a user's position from one version of a Trove Manager to another for the same collateral type.

The contract's onFlashloan() function failed to properly validate its inputs, which let the attacker feed it manipulated data. That manipulation allowed calls to closeTrove and openTrove against arbitrary addresses — including troves the attacker did not own.

Mechanically, the attack unfolded in stages within a single exploit transaction:

• The attacker selected a target address and closed its trove, which returned 1,745 wstETH into the MigrateTroveZap contract.
• The attacker then opened a fresh trove of their own, using 463 wstETH.
• Once the onFlashloan callback finished executing, about 1,282 wstETH was left sitting in the MigrateTroveZap contract.
• The attacker opened another trove, invoked MigrateTroveZap to "migrate" it, and redirected that leftover 1,282 wstETH into their own position.
• Finally, they closed the trove and withdrew the profit.

Across multiple repeated executions of this pattern, the attacker extracted a combined $11.6 million.

On-chain trail

• Attacker contract: 0xD996073019c74B2fB94eAD236e32032405bC027c
• Attacker address: 0x7E39E3B3ff7ADef2613d5Cc49558EAB74B9a4202
• Attack transaction: 0x00c503b595946bccaea3d58025b5f9b3726177bbdc9674e634244135282116c7

Funds were subsequently moved to:

• 0x5d0064f3B54C8899Ab797445551058Be460C03C6
• 0x57f7033F84894770F876bf64772E7EBA48990D65
• 0x2d413803a6eC3Cb1ed1a93BF90608f63b157507a

A full flow-of-funds trace is available via MetaSleuth. Notably, one recipient address attached a message to an outbound transaction describing the transfer as "a white hat rescue" and inviting contact to arrange a return of funds.

Security researcher Nick Franklin also pointed out that five days prior to the attack, an address had granted approval to the MigrateTroveZap contract in two separate transactions (one, two) — raising the question of whether earlier scrutiny of that approval might have headed off the exploit.

What comes next

Prisma has said it will publish a post-mortem and pursue fund recovery, though no timeline has been given. The protocol had undergone three separate audits — MixBytes in September 2023, Zellic in July 2023, and Nomoi in early 2024. Because the MigrateTroveZap contract had only been deployed within the week prior to the attack, none of these reviews appear to have covered it.

It's a familiar irony: a protocol with a solid audit history undone by a piece of newly shipped code that hadn't yet been reviewed. And the copy-cat contract sitting dormant on-chain suggests this story may not be finished — someone else appears to have reverse-engineered the same vulnerability and simply hasn't pulled the trigger yet.

This marks the first confirmed exploit against a restaking protocol specifically, and given how quickly the category has grown, it likely won't be the last. The broader lesson echoes what DeFi has repeatedly demonstrated: rapid growth and hype tend to draw attackers as reliably as they draw users, and shipping unaudited contracts alongside live user funds remains a persistent source of risk — regardless of how much diligence a protocol has done elsewhere.