Zunami Protocol hack — August 2023

On 13 August 2023 an attacker manipulated the internal pricing of Zunami Protocol's zStables and took roughly 1,152 to 1,178 ETH, worth about $2.1 to $2.16 million at the time.

Zunami was an Ethereum yield aggregator that issued two of its own assets, Zunami USD (UZD) and Zunami Ether (zETH), backed by positions in Curve pools. It valued collateral by reading spot prices from external pools. CertiK's analysis describes the attacker taking about $18.4 million in flash loans from Uniswap V3 and Balancer, buying roughly 4.8 million UZD across Curve and SushiSwap, then swapping large amounts through the SDT-WETH and USDT-WETH SushiSwap pairs to move the price of StakeDAO's SDT token. Calling the protocol's cacheAssetPrice() function with those manipulated prices in place inflated the attacker's UZD balance from 4.8 million to 16.9 million tokens. The inflated balance was sold back into stablecoins and ETH, the flash loans were repaid, and roughly 1,152 WETH was kept as profit.

PeckShield and Ironblocks flagged the attack while it was in progress. Zunami acknowledged it publicly, saying the zStables had been attacked and their emission compromised, told users not to buy zETH or UZD, and stated that the underlying collateral remained secure. UZD fell about 99% to under a cent and zETH fell about 88%.

CertiK traced the proceeds through Tornado Cash. The figures differ modestly between sources: CertiK puts the loss at 1,178 ETH, about $2.16 million, while Decrypt and others reported 1,152 ETH and "over $2.1 million." No recovery, reimbursement or arrests have been reported.