What happened
On March 25, 2024, ZongZi (ZongZiFa) on BNB Smart Chain was exploited with a flash loan and price manipulation. PeckShield put the loss at over $230K. DeFiHackLabs estimates about $223K.
ZongZi rewarded users with ZZF for burning ZongZi tokens, and the reward depended on the value of the burned tokens. The contract's burnToHolder function priced ZongZi with getAmountsOut on the PancakeSwap router, which reads the ZongZi/WBNB pool's spot reserves. A large swap in the same transaction could therefore push the price used for rewards far above its real value.
Attacker: 0x2c42824eF89d6EFa7847d3997266b62599560a26. Attack contract: 0x0bd0d9ba4f52db225b265c3cffa7bc4a418d22a9. Vulnerable contract: 0xb7a254237e05ccca0a756f75fb78ab2df222911b. ZongZi/WBNB pair: 0xd695c08a4c3b9fc646457ad6b0dc0a3b8f1219fe. Exploit tx: 0x247f4b3dbde9d8ab95c9766588d80f8dae835129225775ebd05a6dd2c69cd79f.
How it happened
- The attack contract flash-borrowed WBNB from PancakeSwap's BUSDT/WBNB pair.
- A helper contract swapped the WBNB into ZongZi through the ZongZi/WBNB pool, skewing the pool's reserves so the spot price read by
getAmountsOutwas abnormal. - The helper called
burnToHolder, which valued the burn at the manipulated price, and thenreceiveRewards, collecting an outsized reward. - The helper swapped the remaining ZongZi back to WBNB, repaid the flash loan, and kept the remaining WBNB as profit.
Protocol details
Evidence
- report PeckShieldAlert on X: ZongZiFa exploited for over ~230K twitter.com
- transaction bscscan.com transaction 0x247f…d79f bscscan.com
- address bscscan.com address 0xd695…19fe bscscan.com
- code DeFiHackLabs ZongZi_exp.sol github.com
- analysis DeFiLlama defillama.com
- analysis LLM-Powered Detection of Price Manipulation in DeFi (arXiv 2510.21272, ZongZi case study) arxiv.org
- analysis bscscan.com page 0xbb65…7a68 bscscan.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
