On August 13, 2023, Zunami Protocol lost $2.1M to a flash loan attack that manipulated pricing via donation. The attacker exploited a flawed calcTokenPrice function (total_holdings / token_supply) to inflate pool value, increasing their UZD balance 3.5x before withdrawing through Tornado Cash.

The Zunami Protocol on Ethereum suffered a price manipulation attack and lost 1,179 ETH (approximately $2.2 million). The reason for the incident is that the calculation of LP price in the vulnerable contract depends on the CRV balance of the contract itself and the conversion ratio of CRV in the wETH/CRV pool. The attacker manipulated the LP price by transferring CRV to the contract and manipulating the conversion ratio of the wETH/CRV pool. According to MistTrack analysis, ETH has been transferred to Tornado Cash at present.