Zunami Protocol Incident Analysis

On 13 August 2023 the Zunami Protocol was exploited via a complex flash-loan attack that manipulated SDT prices on SushiSwap and the cached UZD asset price, inflating the attacker’s UZD balance from ~4.8M to ~16.9M and resulting in a theft of ~1,178 ETH (~$2.16M). The attacker executed large flash loans across Uniswap V3 and Balancer, performed multi-step swaps through Curve and SushiSwap, called cacheAssetPrice() to corrupt the UZD valuation, repaid the loans, and laundered proceeds through Tornado Cash; the report includes transaction references, vulnerable functions (cacheAssetPrice/assetPriceCached/totalHoldings), affected pools, and broader flash-loan statistics for August 2023.