Zabu Finance hack — September 2021

On 12 September 2021 an attacker drained the staking contract of Zabu Finance, a yield farm on Avalanche. CoinDesk, citing analytics provider DeFiprime, described it as an estimated $3.2 million loss and probably the first large exploit on that chain.

The flaw was in how the ZABUFarm contract accounted for SPORE, a token that charges a fee on every transfer and redistributes it to holders. Halborn's analysis found the farm recorded the amount a user said they were staking rather than the smaller amount that actually arrived after the fee, so each deposit and withdrawal cycle returned more SPORE than had been supplied and steadily emptied the contract. Once its SPORE balance was near zero, the reward formula, which divides accumulated block rewards by the tokens staked, returned an inflated figure, and the attacker used that to mint the remaining reward pool. Knownsec Blockchain Lab's write-up describes two attacker contracts and the use of SPORE flash-borrowed from Pangolin to run the cycle at scale.

About 4.5 billion ZABU were taken and dumped on Trader Joe and Pangolin, driving the price from roughly $0.0047 to near zero. How the $3.2 million estimate was derived is not shown in the sources: 4.5 billion tokens at the pre-attack price would be a much larger notional sum, and the price collapsed as the tokens were sold, so what the attacker actually realised is not established.

Zabu said it would take a snapshot from immediately before the exploit to separate holders who bought before the attack from those who bought after, and discussed reissuing tokens. No completed compensation or recovery has been documented. Halborn notes the same fee-on-transfer accounting bug had hit PolyYeld Finance two months earlier.