Zabu Finance Hack

TOTAL LOST $3.2M
Medium Flash Loan Attacks avalanche

What happened

The attacker:

https://cchain.explorer.avax.network/address/0x9ed2D048…3Abf86/transactions

The transaction behind the attack:

https://cchain.explorer.avax.network/tx/0x8b3042e5…eb75ac/token-transfers

The hack was due to the lack of deflationary token support in the MasterChef contract. By repeated deposits and withdrawals with the MasterChef, the attacker frequently triggers the tax collection, which led to the exploit.

The attacker deployed the contract with the malicious logic at:

https://cchain.explorer.avax.network/tx/0x771c4454…65c319/internal-transactions

Further, he interacted with that contract to successfully pulled out 4.5 billion ZABU tokens in Zabu Farm Contract.

The list of stolen assets:

- WETH: 402.9

- WAVAX: 23,157

- PNG: 21,501

- AVE: 106,848

- USDT: 361,267

- JOE: 23,958.93

Case & protocol details

Classification Protocol Logic / Yield Aggregator
Protocol Type Yield Aggregator
Affected asset / contract ZABU
Smart Contract Language Solidity
Official Website zabu.finance/
Protocol Twitter/X @zabufinance

Evidence & learning

Attack pattern

Compare incidents →
Flash Loan Attacks

Proof of concept

1 available

Sources and on-chain records

Practice this exploit pattern safely

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes