Zunami protocol loses $2.1 mln in price manipulation hack

• The hack exploited the protocol’s vulnerability by utilizing a flash loan to inject liquidity.
• Unknown attackers then manipulated prices and executed trades on the platform’s decentralized exchange.

The Zunami Protocol, a prominent player in the decentralized finance (DeFi) sector, faced a significant setback with a security breach resulting in a loss surpassing $2.1 million. Blockchain security firms PeckShield and Ironblocks reported the breach, which targeted the platform’s liquidity pool hosted on Curve Finance.

Operating primarily through the “zStables” pool on the Curve network, Zunami Protocol facilitated decentralized exchange (DEX) services for stablecoins within the Ethereum ecosystem. The protocol aimed to empower users to diversify their stablecoin holdings, reducing the risk tied to the potential collapse of any individual stablecoin.

The attack’s modus operandi appeared familiar to seasoned blockchain observers. Ironblocks shed light on the attacker’s tactics, revealing that they initiated the assault by leveraging a flash loan from the “balancer.”

This loan allowed the attacker to inject liquidity into the system, enabling them to significantly manipulate the price. The attacker traded on the exchange with this liquidity. Subsequently, they withdrew the funds, manipulating the price once more, and concluded by returning the flash loan, pocketing 1,152 ETH in the process.

Price manipulation attack exposes vulnerabilities

PeckShield and Ironblocks, blockchain security experts, provided insights on social media platform X. PeckShield alerted Zunami Protocol to the ongoing attack, advising users to take precautions. Additionally, they identified the breach as a “price manipulation issue” exploitable by malefactors to inaccurately calculate prices.

In response, Zunami Protocol promptly engaged with its community, acknowledging the breach. An ongoing investigation was disclosed, with a warning for users against acquiring zETH and UZD.

https://twitter.com/ZunamiProtocol/status/1690885809639948288?ref_src=twsrc%5Etfw

The attack’s aftermath significantly impacted the prices of Zunami’s native assets. Firstly, the Zunami USD stablecoin (UZD) witnessed a staggering decline of over 98%. Secondly, the Zunami Ether (zETH) plummeted by over 85%, settling at $278.

Adding complexity, the stolen funds were channeled through Tornado Cash, a controversial coin mixing service.

Security challenges are not unique to Zunami Protocol. Curve Finance, the DeFi platform hosting Zunami’s liquidity pool, faced a series of recent attacks.