While shutting down Prisma Finance, the Resupply team discovered the contracts were littered with multiple high severity bugs

Resupply, the team behind the Prisma Finance liquid staking and stablecoin protocol, has announced a full decommissioning of Prisma Finance following the March 28, 2024 exploit that drained roughly $12 million in ETH via a critical vulnerability in the MigrateTroveZap migration contract. That earlier incident involved insufficient input validation in the onFlashloan() function, which allowed attackers to manipulate trove migrations and siphon collateral from users, prompting an emergency pause of the protocol and a post‑mortem from Prisma outlining the flaw and mitigation steps. In the wake of that exploit and the subsequent sharp decline in total value locked and user confidence, the Resupply team decided not to restart Prisma as a live DeFi protocol and instead pursued an orderly wind‑down. During the shutdown process, as Resupply audited Prisma’s codebase to prepare for decommissioning, the team reports discovering that the contracts were “littered” with additional high‑severity bugs beyond the originally exploited migration vulnerability. These newly identified issues, according to the decommissioning write‑up, reinforced the assessment that the architecture and historical code quality did not meet the safety bar required for a permissionless DeFi protocol handling substantial collateral, making long‑term maintenance or revival unjustifiable from a risk standpoint. The discovery matters because it reframes Prisma’s failure as not just a single incident but an example of how accumulated technical debt and complex upgrade paths in DeFi systems can mask multiple latent critical bugs, and it underscores why some teams, like Resupply, may opt to sunset compromised protocols rather than attempt incremental patching on a fragile base.

✨ AI-generated background, compiled from web sources — not editorial content.

More coverage

• Prisma Finance hacker demands public apology from developers (tradingview.com)
• Prisma Finance Exploit - March 28, 2024 - Post-Mortem - HackMD (hackmd.io)
• PANIC: timer has gone away · Issue #29312 · prisma/prisma - GitHub (github.com)
• Prisma Finance Incident Analysis - CertiK (certik.com)
• Known and Fixed Issues on Prisma Cloud (docs.prismacloud.io)

Explore the topic

• Prisma