On August 14, 2023, Beosin EagleEye detected a price manipulation attack on the Zunami Protocol, a protocol on the Ethereum blockchain. The attack resulted in a loss of 1152 ETH($2.1 million).It is understood that the Zunami Protocol is a platform that distributes stablecoins to users. It can be seen as a decentralized yield aggregator, providing more beneficial solutions for stablecoin holders.There is an interesting twist to this incident. A security company had previously warned about vulnerabilities, but the project team did not take these warnings seriously, displaying a nonchalant attitude. As a consequence, by the time the incident occurred, it was already too late.Beosin security team promptly analyzed the security incident and reported the following findings:<h2 id="header-0">Attack-related Information:</h2>● Attack Transactions:Tx1: 0x2aec4fdb2a09ad4269a410f2c770737626fb62c54e0fa8ac25e8582d4b690ccaTx2: 0x0788ba222970c7c68a738b0e08fb197e669e61f9b226ceec4cab9b85abe8cceb● Attacker&#39;s Address:0x5f4c21c9bb73c8b4a296cc256c0cde324db146df● Attack Contract:0xa21a2b59d80dc42d332f778cbb9ea127100e5d75● Targeted Contract:0xe47f1cd2a37c6fe69e3501ae45eca263c5a87b2b<h2 id="header-1">Vulnerability Analysis:</h2>The cause of this attack was the vulnerability in the contract where LP (Liquidity Provider) price calculation depended on the contract&#39;s own CRV balance and the exchange ratio of CRV in the wETH/CRV pool. The attacker manipulated the LP price by injecting CRV into the contract and manipulating the exchange ratio of the wETH/CRV pool.Attack Process:Taking transaction 0x2aec4... as an example:Attack Preparation:1. The hacker borrowed 6811 ETH using a balancer:Vault flash loan as attack funds.<img src="https://wdcdn.qpic.cn/MTY4ODg1NzYyNjQxMjMwNg_805077_7fQdS6DkUF_N2qsl_1692061932?w&#61;1080&amp;h&#61;265&amp;type&#61;image/png" />2. They exchanged 300 ETH borrowed through a flash loan for 84 zETH, preparing for the subsequent increase in zETH value<img src="https://wdcdn.qpic.cn/MTY4ODg1NzYyNjQxMjMwNg_912433_537wu0Js4cKlGQcf_1692061942?w&#61;1080&amp;h&#61;105&amp;type&#61;image/png" />Attack Phase:1. They exchanged 11 ETH for 35293 CRV and transferred it to the sEthFraxEthCurveConvex contract, enabling the attacker to manipulate the CRV balance in the sEthFraxEthCurveConvex contract for later manipulation.<img src="https://wdcdn.qpic.cn/MTY4ODg1NzYyNjQxMjMwNg_140162_uKRtovswxoX2M67N_1692062102?w&#61;1080&amp;h&#61;163&amp;type&#61;image/png" />2. They repeatedly exchanged 406 ETH for CRV in the wETH/CRV pool, causing the price of CRV to increase by approximately 10 times.<img src="https://wdcdn.qpic.cn/MTY4ODg1NzYyNjQxMjMwNg_535462_tvYySkuR-3osQbQz_1692062132?w&#61;1080&amp;h&#61;238&amp;type&#61;image/png" />3. The value calculation of zETH (LP) depended on the price of CRV tokens and the valuation of CRV to ETH calculations in the sEthFraxEthCurveConvex contract.4. The attacker manipulated the CRV price and the CRV balance in the vulnerable contract, causing the final _assetPriceCached to increase.<img src="https://wdcdn.qpic.cn/MTY4ODg1NzYyNjQxMjMwNg_591571_LvdG7WybtCF3WsAK_1692062217?w&#61;1080&amp;h&#61;264&amp;type&#61;image/png" /><img src="https://wdcdn.qpic.cn/MTY4ODg1NzYyNjQxMjMwNg_181875_HX12hX26gxlVN8qh_1692062222?w&#61;823&amp;h&#61;207&amp;type&#61;image/png" /><img src="https://wdcdn.qpic.cn/MTY4ODg1NzYyNjQxMjMwNg_926158_KkOJ5nDQ7uX9zkXs_1692062227?w&#61;586&amp;h&#61;73&amp;type&#61;image/png" /><img src="https://wdcdn.qpic.cn/MTY4ODg1NzYyNjQxMjMwNg_927100_9deA3SCoOGM9np4X_1692062234?w&#61;792&amp;h&#61;1063&amp;type&#61;image/png" />5. Due to the increased _assetPriceCached, the value of 84 zETH increased to 221 zETH.<img src="https://wdcdn.qpic.cn/MTY4ODg1NzYyNjQxMjMwNg_653088_O02GMbiGvuZzO7vL_1692062313?w&#61;776&amp;h&#61;116&amp;type&#61;image/png" /><img src="https://wdcdn.qpic.cn/MTY4ODg1NzYyNjQxMjMwNg_809122_8VkBOXGHfQa-2Qy5_1692062319?w&#61;779&amp;h&#61;202&amp;type&#61;image/png" /><img src="https://wdcdn.qpic.cn/MTY4ODg1NzYyNjQxMjMwNg_228344_k0LurI2RenoxmH5f_1692062324?w&#61;614&amp;h&#61;69&amp;type&#61;image/png" />6. They exchanged the CRV obtained in step 4 back to ETH to repay the flash loan.<img src="https://wdcdn.qpic.cn/MTY4ODg1NzYyNjQxMjMwNg_426497_13NT36pT-gtdxicG_1692062331?w&#61;1080&amp;h&#61;251&amp;type&#61;image/png" />7. They exchanged the increased 221 zETH (LP) for 389 ETH.<img src="https://wdcdn.qpic.cn/MTY4ODg1NzYyNjQxMjMwNg_103907_tQjTlbYZSdvYcqPI_1692062336?w&#61;1080&amp;h&#61;72&amp;type&#61;image/png" /><img src="https://wdcdn.qpic.cn/MTY4ODg1NzYyNjQxMjMwNg_483582_oBP00xp4gqTGatXm_1692062344?w&#61;1080&amp;h&#61;59&amp;type&#61;image/png" />8. They repaid the 6811 ETH flash loan and other fees, resulting in a profit of 26 ETH.<img src="https://wdcdn.qpic.cn/MTY4ODg1NzYyNjQxMjMwNg_632706_DPYyuVvX9AuJFV4b_1692062350?w&#61;1080&amp;h&#61;159&amp;type&#61;image/png" /><h2 id="header-2">Funds Tracing:</h2>As of the time of writing, the Beosin security analysis team found that the stolen funds had all been transferred to Tornado cash.<img src="https://wdcdn.qpic.cn/MTY4ODg1NzYyNjQxMjMwNg_146975_8mfSQKR2XKymnyNC_1692062377?w&#61;1080&amp;h&#61;410&amp;type&#61;image/png" /><h2 id="header-3">Summary:</h2>In response to this incident, the Beosin security team recommends:1. Similar projects should consider different token pool dependencies when calculating LP value.2. Before the launch of a project, it&#39;s advisable to engage a professional security auditing company for comprehensive security audits to mitigate security risks.Beosin is a leading global blockchain security company co-founded by several professors from world-renowned universities and there are 40&#43; PhDs in the team, and set up offices in 10&#43; cities including Hong Kong, Singapore, Tokyo and Miami. With the mission of &#34;Securing Blockchain Ecosystem&#34;, Beosin provides &#34;All-in-one&#34; blockchain security solution covering Smart Contract Audit, Risk Monitoring &amp; Alert, KYT/AML, and Crypto Tracing. Beosin has already audited more than 3000 smart contracts including famous Web3 projects PancakeSwap, Uniswap, DAI, OKSwap and all of them are monitored by Beosin EagleEye. The KYT AML are serving 100&#43; institutions including Binance.<h2 id="header-4">Contact</h2>If you need any blockchain security services, welcome to contact us:<a href="https://beosin.com/" rel="noopener noreferrer nofollow">Offiial Website</a> <a href="https://eagleeye.beosin.com/ProjectSearch" rel="noopener noreferrer nofollow">Beosin EagleEye</a> <a href="https://twitter.com/Beosin_com" rel="noopener noreferrer nofollow">Twitter</a> <a href="https://t.me/beosin" rel="noopener noreferrer nofollow">Telegram</a> <a href="https://www.linkedin.com/company/beosin" rel="noopener noreferrer nofollow">Linkedin</a>

Recklessness Comes at a Cost? Zunami Protocol Attacked for Price Manipulation with a Loss of Over $2.1 Million

Table of Contents

Beosin

Other articles published on Aug 15, 2023

Ault Alliance Announces Settlement of SEC Investigation

Is History Repeating? Michael Burry’s New Positions Raise Market Crash Speculations

SHIB Breaking News: Shiba Inu Taps Leading Investment Firm for Doggy Dao Advisor

STX Blockchain: Advantages and List of the Popular NFTs

US Grand Jury Files New Seven Count Charges Against Sam Bankman-Fried

Binance Files a Motion Against the SEC’s “Fishing Expedition.”

Join our free newsletter for daily crypto updates!