What happened
On March 1, 2025, Zoth lost approximately $285,000 after an attacker exploited loan-to-value validation in the ZeUSD minting flow. SolidityScan reported that a manipulated Uniswap V3 swap delivered only 7,669 collateral tokens but the protocol recorded 330,979, allowing ZeUSD to be minted and later redeemed against collateral that had not actually been received.
How it happened
- The attacker manipulated a Uniswap V3 pool so a collateral swap returned far fewer tokens than expected.
- The attacker used mintWithStable to enter the ZeUSD minting flow.
- LTV validation used the initial deposit rather than collateral actually received after the swap, recording 330,979 collateral tokens instead of 7,669.
- The attacker minted ZeUSD against the inflated record.
- Burning ZeUSD then enabled withdrawal of the falsely recorded collateral, producing about $285,000 in reported profit.
Protocol details
Classification
Other / Protocol Logic
Protocol Type
CDP
Implementation language
Solidity
Protocol links
Website
@zothdotio
Security review history
- Hacken View report
Evidence
- report Report blog.solidityscan.com
- analysis DeFiLlama defillama.com
- analysis Zoth Hack Analysis blog.solidityscan.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
