On September 12, 2021, Zabu Finance's ZABUFarm contract on Avalanche failed to account for deflationary token transfer fees. Attacker was credited with full input amount despite fees, draining liquidity.

The Zabu Finance project on the Avalanche chain suffered a flash loan attack. Officially, the attackers withdrew 4.5 billion ZABU tokens from the Zabu Farm Contract, bringing the supply to 5 billion and dumping all of it to ZABU’s Pangolin LPs and Trader Joe LPs. According to DeFi analytics provider DeFiprime, the total was estimated at $3.2 million in exploits.