# Zunami Protocol: UZD price manipulation via SDT donation

Zunami Protocol's UZD token price was manipulated via SDT donation to MIMCurveStakeDao, inflating UZD balance and draining ~$2M from Curve pools.

- Payout: Real-world hack
- Severity: critical
- Program: ZunamiProtocol
- Analysis by: DeFiHackLabs
- Disclosed: 2023-08-14
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-08/Zunami_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230814-zunami
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical technique:chained vuln:oracle-manipulation

**Target:** UZD token and Curve pools
**Root cause:** UZD's price calculation relied on the SDT balance of MIMCurveStakeDao, which could be inflated by direct donation, and the price was cached without proper validation.
**Steps:**
1. Flash loan 7M USDC and 10,011 WETH from Balancer.
2. Add liquidity to FRAX/USDC pool to mint crvFRAX, swap crvFRAX to UZD in UZD/crvFRAX pool.
3. Swap USDC to crvUSD, then crvUSD to UZD in crvUSD/UZD pool.
4. Swap WETH to SDT in ETH/SDT pool.
5. Donate SDT to MIMCurveStakeDao to inflate UZD balance.
6. Swap WETH to SDT via SushiSwap, then USDT to WETH to manipulate reserves.
7. Call `UZD.cacheAssetPrice()` to update UZD price based on manipulated reserves.
8. Swap UZD back to crvFRAX and crvUSD, remove liquidity, and convert to USDC.
9. Repay flash loans and keep profit.
**How found:** Likely identified that UZD's price oracle depended on the SDT balance of a stake dao contract, which could be manipulated by direct token donation.
**Exploitation:** Attacker used flash loans to manipulate the price of UZD by donating SDT to MIMCurveStakeDao, inflating UZD's balance. Then called cacheAssetPrice to lock in the inflated price, and swapped UZD for other assets at the inflated rate, draining value from Curve pools.
**Insight:** Check if a protocol's price oracle relies on token balances that can be donated to or manipulated by external parties; direct transfers to a contract can skew internal accounting.