Zunami hack post-mortem: what happened?
There are already lots of Zunami hack post-mortem articles that are more or less the same — here is our take.
Exploit cause
The exploit consisted of two hacks, both of which involved price caching vulnerability The first target was Zunami ETH (zETH) and the second was Zunami Stable (UZD). The first attack drained 26 WETH, unlike the second one with whopping 1178 WETH.
The root cause was the price manipulation using the MIMCurveStakeDao strategy then caching the inflated price for the whole block (suitable for flash loans) for UZD and then performing previous operations in reverse order to take profit of the inflated price.
Price caching
The caching of the liquidity pool (LP) price in UZD was partially implemented in the 1.0 version that was by Ackee Blockchain. However, it wasn’t used globally and functions like balanceOf
were doing multiple costly calls (LP price calculation from strategies) instead of caching.
The caching was extended to functions such as totalSupply
, balanceOf
and allowance
later in the UZD version 1.1 . The caching was adjusted in the following way:
This allowed calling an inflated price from other contracts with the balanceOf
function.
The version 1.1 was launched without any audit. It was later audited by HashEx in October 29, 2023, for the v1.2 launch, but according to the audit report , the attack vector using the cashed functions was not discovered.
MIMCurveStakeDao strategy
The strategy was introduced in commit . The attacker could change LP price calculation by donating SDT tokens to the strategy since the calculation was dependent on its price and balance in the strategy. This strategy was audited prior to the launch by HashEx (check out this audit report ) but the exploit possibility was not discovered.
The attack happened on August 13 and can be viewed here: https://explorer.phalcon.xyz/tx/eth/0x0788ba222970c7c68a738b0e08fb197e669e61f9b226ceec4cab9b85abe8cceb
Or you can check the of the attack (good work DeFiHackLabs!).
We hope this post-mortem analysis was helpful and may contribute to making web3 a safer space without hacks and exploits.
Originally published at https://ackeeblockchain.com on August 31, 2023.