What happened
Zunami Protocol's Ethereum deployment suffered a price-manipulation exploit affecting its zStable system. Verichains identified an LP valuation calculation influenced by SDT token holdings in the MIMCurveStakeDao strategy, which the attacker inflated through a token donation.
Technical root cause
LP valuation depended on a token balance that an attacker could enlarge through a donation. Verichains identified this manipulable calculation in the MIMCurveStakeDao strategy as the basis of the price-manipulation attack.
How it happened
- The attacker donated SDT tokens to the affected strategy.
- The holdings-dependent valuation calculation treated the enlarged balance as a higher LP value.
- The attacker exploited that artificial increase to extract value from the system.
Protocol details
Classification
Ecosystem / Yield Aggregator / Oracle Manipulation
Protocol Type
Yield Aggregator
Affected asset / contract
UZD
Implementation language
Solidity
Protocol links
Website
@ZunamiProtocol
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
