What happened
Permapod is a lending protocol on ZIGChain where users supply assets and borrow against collateral through credit accounts. On 29 August 2026 an attacker exploited a mock incentives contract that had been left connected to the live protocol. By claiming USDC rewards and restaking them over and over, they inflated their account's recorded position from 14,000 USDC of real capital (4,000 supplied plus a 10,000 borrow) to about 3.25 million USDC-denominated units. About 99.57% of that came from rewards. They then used the inflated position to borrow and withdraw 168,434 USDC, 14,250,000 ZIG and a large amount of stZIG.
Permapod froze all its contracts and said the cause was its own deployment and configuration controls, not a private key or admin compromise, and not ZIGChain or any integrated asset. It hired Zeroshadow to trace the funds. It said the mock functionality would be removed and the deployment independently reviewed before relaunch. The asset amounts are confirmed, but no final dollar figure has been published because outstanding debt and the stZIG price were still being reconciled. On 22 September Permapod said it was working with the ZIGChain Foundation and that all affected users will be made whole; the details were still to be announced.
How it happened
- On 27 August the attacker probed the incentives path: they configured a 17,840.5 USDC reward schedule without funding it (it succeeded) and opened a small credit account. A first claim-and-restake attempt reverted.
- On 29 August at 10:32 UTC they created the main credit account, supplied and staked 4,000 USDC, then borrowed 10,000 USDC and staked that too.
- Because the mock incentives contract was still wired into live accounting, each claimed USDC reward became part of the account balance and could be restaked, raising the recorded staked position by the same amount. The attacker did this in 1,138 claim-and-restake transactions, restaking 3,234,015.52 USDC of rewards.
- At 15:26 UTC, in transaction
171662A1A7A528D39416EA60047E0299B8043E5A912D31311FB04E11C4287DC3, they withdrew a final 2,843.52 USDC reward and their 4,000 USDC principal. They then borrowed and withdrew 168,434.45 USDC, 14,250,000 ZIG and 18,602,853,978,526 raw units of stZIG. - The health check counted the reward-inflated stake as collateral, so the account still read as healthy and the transaction completed. The debt was never repaid.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
