What happened
On September 20, 2024, an unprotected mint function in Shezmu's Ethereum vault system enabled unlimited ShezUSD and ShezETH creation and liquidity-pool drains. QuillAudits estimated the impact at $4.9 million. Shezmu later recovered part of the stolen assets.
Technical root cause
An unprotected mint function allowed unlimited token issuance in the vault system.
How it happened
- An unverified contract associated with an ERC20 vault was approved for public minting.
- The attacker exploited its unprotected mint function to create unbacked tokens and drain pool liquidity.
- MEV bots also drained the sDAI pool after assets lost their pegs.
- Shezmu negotiated an asset return. Its January 2025 response said millions of dollars had been redistributed to users, with the Balancer ShezETH/wstETH pool still pending.
Protocol details
Classification
Borrowing and Lending / Protocol Logic / Token & Share Accounting
Protocol Type
CDP
Implementation language
Solidity
Protocol links
Website
@ShezmuTech
Security review history
- Spearbit View report
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
