Shezmu hack — September 2024

Shezmu, an Ethereum-based collateralised borrowing protocol that issued the ShezUSD stablecoin against deposited collateral, was drained on 20 September 2024. An attacker found that a Shezmu vault contract left its minting function unprotected, so anyone could mint ShezUSD without supplying backing collateral. The attacker deployed a helper contract, minted an enormous ShezUSD supply and used the tokens to borrow and drain the protocol's assets. Reporting also describes a second leg against ShezETH, in which roughly 9,900 tokens worth about $880,000 were minted; analysts attributed that to a possible key leak rather than to the same contract flaw. Selling the minted tokens also drained an sDAI pool, with MEV bots capturing part of the value.

Published loss estimates cluster at about $4.9 million, and some accounts round the figure to $5 million. QuillAudits linked the vulnerability to a contract upgrade deployed on 3 September 2024.

Shezmu publicly offered the attacker a 10 percent bounty for the return of the remaining 90 percent within 24 hours and said it would not pursue legal action. The attacker countered with 20 percent and Shezmu accepted. The attacker then returned 282.18 ETH, followed by a further 137 WETH. Shezmu's own incident report states that, apart from the agreed bounty, the missing funds were recovered and redistributed to users through migration contracts, an audit, and a Dune Analytics snapshot used to calculate each affected user's share.