What happened
The attacker:
The transaction behind the attack:
The hack was due to the lack of deflationary token support in the MasterChef contract. By repeated deposits and withdrawals with the MasterChef, the attacker frequently triggers the tax collection, which led to the exploit.
The attacker deployed the contract with the malicious logic at:
Further, he interacted with that contract to successfully pulled out 4.5 billion ZABU tokens in Zabu Farm Contract.
The list of stolen assets:
- WETH: 402.9
- WAVAX: 23,157
- PNG: 21,501
- AVE: 106,848
- USDT: 361,267
- JOE: 23,958.93
Protocol details
Classification
Protocol Logic / Yield Aggregator
Protocol Type
Yield Aggregator
Affected asset / contract
ZABU
Implementation language
Solidity
Protocol links
Website
@zabufinance
Evidence
Proof of concept
1 availableSources
- report Post-Mortem slowmist.medium.com
- report Report immunebytes.com
- analysis Website reference beincrypto.com
- analysis Website reference cointelegraph.com
- analysis DeFiLlama defillama.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
