Prism is relaunching on a new Ethereum contract after disclosing that an attacker spent most of July siphoning off nearly 40% of the project’s trading fees.
Prism distributes a share of trading fees to everyone who holds the token. The project is now abandoning the original PRISM token. According to CoinGecko data, the old token fell about 91% in the 24 hours through 2:13 p.m. ET on Tuesday, while Bitcoin rose 4% over the same period. PRISM traded near $16, down from about $1,145 on June 3, with a market value of roughly $82,000 and about $288,000 in 24-hour volume.
Attack Used Extra Fee-Earning Positions
In a post on X on Tuesday, Prism said the attacker used purpose-built helper contracts to create 2,500 fee-earning positions beyond the 5,000 positions allowed by the token’s design. By the time the team found them, those extra positions were diverting just under 40% of every trading fee away from ordinary holders.
Early Stress Test for a Uniswap v4 Hook Design
The incident is an early stress test for a newer DeFi building block. Prism is built as a Uniswap v4 hook, code that allows a token to double as a liquidity pool. Under that structure, simply holding the token earns a share of trading fees, without any manual staking. The design is meant to make token holders and liquidity providers the same group of users.
The exploit showed how a single gap in that code can reroute the rewards that the model depends on.
“This was never a theft of principal,” Prism wrote in the post. “It was a corruption of the fee layer — the very thing that made Prism worth holding.”
One Missing Check Created “Phantom” Shares
According to the disclosure, the flaw came down to one missing check. In the original contract, a fee-earning position could be moved to addresses that were never supposed to hold one, including the pool manager and the token contract itself.
Those addresses sit outside the token’s internal accounting. Prism said that meant a position parked there could keep earning fees while counting as no one’s position in the books. The result was a “phantom” share whose cut could be pulled from the pool’s balance.
The team said a patch on the old deployment would not solve the issue because the phantom positions already sit inside the pool and cannot be removed. It chose to build a new contract instead.
What the New Contract Changes
Prism said the new contract blocks that route. A position can now belong only to a wallet whose token balance backs it, and any attempt to send one to the pool manager or to the contract itself will fail outright.
The team added that the number of fee-earning positions can no longer exceed the 5,000-position cap guaranteed by the design, and that fees can only flow to genuine holders.
Relaunch Team Says It Did Not Create Prism
The team handling the relaunch said it did not create the project. In its statement, it wrote that it “found this project the way everyone else did” and bought the token on the open market with its own money. The disclosure was signed by the pseudonymous account @0xsolazy.
The team did not say how holders of the old token would move to the new contract.
Other Projects Already Use the Fee Mechanism
Even at a small scale, Prism has attracted a handful of projects that build on its fee mechanism. According to Spectrum’s site, Spectrum — a tool for launching baskets of tokens — uses Prism and has deployed baskets across Ethereum, Base, and Robinhood’s chain.
Prism has promoted several of those baskets, including one that holds Sky, Aave, Maple, Curve, Spark, Ondo, and Ethena tokens.
Damage Was Limited, Review Still Unpublished
The damage was limited largely because Prism never gained much traction. The team said the absolute losses were small only because trading volume had been low, and warned that the drain would have grown along with the token if adoption had picked up.
Prism has not published an independent review of either the exploit or the fix.