# PrimeFinance: stale signed oracle report overwrite drains lending pool

Permissionless verifyReport accepted stale DON-signed Chainlink reports, letting attacker overwrite PRFI oracle price ~52x and borrow 425.5 WHYPE against inflated collateral.

- Payout: Real-world hack
- Severity: high
- Program: PrimeFinance
- Disclosed: 2026-09-16
- Write-up quality: 8/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-09/PrimeFinance_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260916-primefinance
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:business-logic vuln:oracle-manipulation vuln:signature-replay

**Target:** Aave-fork lending pool + Chainlink DataStreamConsumer oracle on HyperEVM
**Root cause:** DataStreamConsumer.verifyReport(bytes) is permissionless and forwards reports to the Chainlink Verifier, which validates DON signatures but never checks that the report's round/timestamp is newer than the stored feed value, so any validly-signed stale report overwrites the live price.
**Steps:**
1. Fork HyperEVM at block 46060986 via archival RPC (drpc/purroof), not the public RPC which serves current storage.
2. Call `verifyReport(REPORT_1)` and `verifyReport(REPORT_2)` on DataStreamConsumer `0x04ED...2bE6` from an arbitrary address — both succeed, pushing PRFI feed to ~$0.1101 (~52x real ~$0.0021).
3. Flash-loan 100 WHYPE from Morpho Blue `0x68e3...57cD`.
4. Swap ~26.82 WHYPE into UniV2 WHYPE/PRFI pool `0x981F...5515` for ~795,587 PRFI.
5. Deposit PRFI as collateral into lending pool `0xb339...113F`.
6. Borrow 425.52 WHYPE against inflated collateral, draining the reserve.
7. Repay Morpho flash loan; net ~398.70 WHYPE profit.
**How found:** Researcher read the DataStreamConsumer contract and noticed verifyReport lacked a round/timestamp freshness check; confirmed permissionlessness by calling it from 0x1111...1111 at the parent block with captured reports, which returned success despite no role and no value.
**Exploitation:** Attacker deployed a contract in-tx, replayed two captured DON-signed Chainlink Data Streams reports through the permissionless verifyReport to inflate PRFI price ~52x, flash-borrowed 100 WHYPE from Morpho, bought ~795k PRFI on the thin UniV2 pool, supplied as collateral, borrowed 425.52 WHYPE out of the reserve, repaid flash loan.
**Insight:** Oracle consumer wrappers that delegate signature verification to a trusted verifier often omit the monotonicity/freshness check themselves — test whether any validly-signed historical report can be replayed to overwrite the live feed, especially when the consumer is Ownable but the verify function is not gated.