# Zoomer: business logic flaw enables token mint and drain

Zoomer token's vulnerable contract allowed an attacker to mint 30M tokens for 0.02 ETH via a flash-loan-funded exploit, draining ~14 ETH from liquidity pools.

- Payout: Real-world hack
- Severity: high
- Program: Zoomer
- Analysis by: DeFiHackLabs
- Disclosed: 2024-02-23
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-02/Zoomer_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240223-zoomer
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high vuln:accounting-error vuln:business-logic

**Target:** Zoomer token contract (0x9700204D77A67A18eA8F1B47275897b21e5eFA97)
**Root cause:** The vulnerable contract had a function (selector 0x72c4cff6) that allowed minting or transferring tokens without proper validation, likely a public mint or swap function with flawed logic.
**Steps:**
1. Flash loan 200 WETH from Balancer.
2. Deploy attack contract with 200 ETH.
3. Swap 199.9 ETH for Zoomer tokens via Uniswap V2 Router.
4. Approve vulnerable contract to spend Zoomer tokens.
5. Call vulnerable contract with selector `0x72c4cff6` and arguments `(Zoomer address, 30265400 ether)` sending 0.02 ETH.
6. Transfer minted Zoomer tokens back to attacker.
7. Swap Zoomer tokens for WETH via Uniswap V2 Router.
8. Repay flash loan and keep profit.
**Exploitation:** Attacker used a Balancer flash loan of 200 WETH to fund an attack contract. The contract swapped most WETH for Zoomer tokens, then called the vulnerable contract's function with a crafted payload, likely minting a large amount of Zoomer tokens for a small ETH fee. The attacker then sold the minted tokens into the liquidity pool, extracting ~14 ETH profit.
**Insight:** Look for public functions in token contracts that accept ETH and mint tokens without proper access control or price validation; small ETH payments can mint disproportionate token amounts.