DEFI MARKET

Curve yield protocol Zunami suffers price manipulation attack, losing 2.1 million euros, native stablecoin collapses

2023/8/15

According to blockchain security company PeckShield's monitoring, the DeFi yield protocol Zunami suffered a flash loan price manipulation attack in the zStables stablecoin pool on Curve Finance, with estimated losses exceeding $2.1 million. Currently, its native stablecoin UZD has collapsed, plummeting over 99%; while zETH has dropped 89% to $206.

Table of Contents

Background: What is the Zunami Protocol?

Zunami is a DeFi liquidity mining aggregator where users can earn profits by staking stablecoins. Its largest stablecoin pool is on Curve, which was the target of a recent hack. The affected liquidity pools include Zunami USD $UZD and Zunami ETH $zETH.

Reportedly, Zunami's stablecoin annual yield is 14%, claiming to be the "highest annualized return in the cryptocurrency market," with a fluctuating APY ranging from 8% to 21%, and a total value locked (TVL) on-chain exceeding $5 million.

Zunami Price Manipulation Attack Incident

The blockchain security team PeckShield announced that they detected price manipulation attacks on the UZD and zETH liquidity pools on Curve by Zunami, involving two hacker transactions resulting in a loss of $2.1 million.

It was reported that the attacker first obtained a flash loan from the Balancer protocol, then added substantial liquidity to the two pools to significantly alter the prices and began trading on Zunami.

The attacker later removed the liquidity, changed the prices, executed a final trade, and repaid the flash loan, making a profit of 1,152 ETH.

PeckShield also discovered that the stolen funds were sent to Tornado Cash, indicating the attacker was cashing out their gains from the attack.

Official Response: Collateral Still Secure

Zunami promptly tweeted confirming the attack on its stablecoin pools, asserting the safety of the collateral but warning against purchasing the attacked UZD and zETH.

Risks Remain Despite Any Promises and Endorsements

Ironically, despite Zunami's risk assessment document on its website claiming that UZD utilizes a novel over-collateralization mechanism to withstand unpegging risks, even backed by stress tests from Silicon Valley banks, it still became unpegged.