PrimeFinance exploit analysis

Prime Finance's lending pool on HyperEVM lost 425.5 WHYPE on 2026-09-16 after a permissionless oracle handler accepted a stale signed report and overwrote the live price feed (attack transaction, block 46060987). DeFiHackLabs reconstructs the oracle overwrite on a HyperEVM fork and reproduces the drain.

The lending pool prices collateral against an off-chain report signed by a known reporter. The pool's updatePrice(bytes report, bytes signature) accepts any report whose signature verifies against the on-chain reporter key and skips any freshness check, so a report from any past round can replace the live one. The attacker held a signed report from a previous round in which the on-chain price had been manipulated; replaying it returned the pool to a manipulable price and let the attacker borrow WHYPE against thin collateral until the WHYPE reserve was exhausted.

DeFiHackLabs records a drain of ~425.5 WHYPE from the lending pool reserve, the borrower's debt summing the same amount with no collateral left to liquidate against.

A signed report should be rejected if its timestamp is older than the live report's, and the pool should reject any update whose price deviates from the live price beyond a configured bound.