Weft V2 accepted HUG as collateral using a severely incorrect live oracle valuation. HUG traded around 0.000131 XRD, but Weft’s Default PriceFeed valued it at 1,330.41 XRD at the time of the borrow, roughly 10 million times its actual value. The attacker bought 539,703.17 HUG for 70.6 XRD and introduced it through the flash_remove_collateral / flash_add_collateral path, which remained enabled despite normal HUG collateral additions having been disabled. Weft valued the HUG at approximately 718M XRD and allowed the attacker to borrow 47.28M LSULP and 13.1005M XRD