{"investigation":{"slug":"zabu-finance","entity_name":"Zabu Finance","trust_score":52,"severity_base":null,"score_modifier":34,"confidence":0.82,"status":"published","content_type":"investigation","summary":"Zabu Finance was an Avalanche-based yield farming protocol that suffered a $3.2 million flash loan exploit on September 12, 2021, marking what was widely described as the first major DeFi hack on the Avalanche blockchain. The vulnerability — a known deflationary token accounting flaw that had already been exploited on Polygon two months prior — drained the protocol's SPORE staking pool and caused the ZABU token to collapse from approximately $0.004 to near-zero. The protocol attempted a v2 token relaunch but has since gone effectively dormant, with a TVL of approximately $5,000 and a website SSL certificate that expired in August 2022.","sections":[{"content":"On September 12, 2021, Zabu Finance was exploited for approximately $3.2 million, in what security researchers described as the first significant DeFi hack on the Avalanche blockchain. The attacker deployed two contracts: the first staked SPORE tokens (a deflationary token that charges a transfer fee) into the ZABUFarm contract; the second took out a flash loan of SPORE tokens from Pangolin and executed repeated deposit/withdraw cycles. The ZABUFarm contract's critical flaw was that it recorded the pre-fee amount the user deposited rather than the actual post-fee amount received by the contract. By cycling through deposits and withdrawals, the attacker gradually drained the contract's SPORE balance to near-zero. With total staked SPORE approaching zero, the reward-per-token calculation — which divides accumulated block rewards by total SPORE staked — produced an astronomically large payout. The attacker collected approximately 4.5 billion ZABU tokens as rewards via contract 1, then sold them on Trader Joe and Pangolin DEXes. Attack contract 1 address: 0x0e65Fb2c02C72E9a2e32Cc42837df7E46219F400. Attack contract 2 address: 0x5c9AD7b877F06e751Ee006A3F27546757BBE53Dd. Attacker address: 0x9ed2D048e90CfFa5e4A778678CBc3acb8A3Abf86.","heading":"Flash Loan Exploit — September 2021","sources":[{"url":"https://slowmist.medium.com/brief-analysis-of-zabu-finance-being-hacked-44243919ea29","name":"slowmist.medium.com","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-zabu-finance-hack-september-2021","name":"halborn.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/tech/2021/09/13/avalanche-based-zabu-finance-exploited-in-32m-hack","name":"coindesk.com","type":"other","credibility":3},{"url":"https://beincrypto.com/zabu-finance-exploited-on-avalanche-3-2m/","name":"beincrypto.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Security firm PeckShield commented immediately after the hack that 'the same bug happened many times before,' highlighting that the deflationary-token accounting flaw was a publicly known vulnerability in the DeFi ecosystem. The identical attack vector had been used to exploit PolyYeld Finance on Polygon in July 2021 — two months before Zabu's deployment — where a deflationary xYELD token was used to drain a MasterChef pool, causing the YELD token price to crash to zero and resulting in an estimated $250,000 loss. The Zabu Finance team deployed a yield farm with a deflationary token (SPORE) integrated into its staking pool without implementing the standard safeguard of recording actual received token balances rather than nominal staked amounts. No evidence of a pre-deployment security audit from an established firm has been identified in public records.","heading":"Known Vulnerability — Prior Warning Ignored","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-zabu-finance-hack-september-2021","name":"halborn.com","type":"other","credibility":3},{"url":"https://beincrypto.com/zabu-finance-exploited-on-avalanche-3-2m/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://www.quadrigainitiative.com/casestudy/polyyeldfinancexyeldexploit.php","name":"quadrigainitiative.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Immediately following the exploit, the ZABU token price collapsed from approximately $0.004 to approximately $0.00002, a decline of roughly 99.5%. The attacker dumped 4.5 billion ZABU tokens on Avalanche's Pangolin and Trader Joe decentralized exchanges, overwhelming available liquidity. Cointelegraph described the price as having 'flatlined.' CoinTelegraph reported the token briefly recovered approximately 25% to trade around $0.00005, but the token never recovered to pre-hack levels. As of 2026, ZABU is not listed for active trading on major exchanges including Coinbase and Binance, and the token has effectively no market.","heading":"Token Price Collapse and Market Impact","sources":[{"url":"https://beincrypto.com/zabu-finance-exploited-on-avalanche-3-2m/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://ambcrypto.com/avalanche-based-zabu-finance-loses-3-2m-to-defi-exploit/","name":"ambcrypto.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the exploit, the Zabu Finance team set all farm rewards to zero to allow users to withdraw remaining funds without further losses. The team announced a recovery plan: a pre-hack snapshot would be taken, and ZABU v2 tokens would be distributed to users who held positions before the exploit. Users who purchased ZABU after the exploit would be allowed to participate in Farm V2 via a Zabu v1 Staking Pool. The team also burned approximately 93.12 million remaining ZABU tokens, then valued at approximately $360,000, as part of the recovery effort. The team's identities have not been publicly confirmed in available sources; the project operated under pseudonymous or anonymous leadership, which is consistent with the broader small-cap yield-farm landscape of 2021. No funds were recovered from the attacker.","heading":"Team Response and V2 Recovery Attempt","sources":[{"url":"https://www.coindesk.com/tech/2021/09/13/avalanche-based-zabu-finance-exploited-in-32m-hack","name":"coindesk.com","type":"other","credibility":3},{"url":"https://beincrypto.com/zabu-finance-exploited-on-avalanche-3-2m/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://www.quadrigainitiative.com/hackfraudscam/zabufinancestakingcalculationbug.php","name":"quadrigainitiative.com","type":"other","credibility":3}],"severity":"medium"},{"content":"As of 2026, Zabu Finance appears effectively defunct. The protocol's website SSL certificate expired in August 2022 and was not renewed. DefiLlama lists Zabu Finance with a total value locked of approximately $5,147 on Avalanche, indicating negligible active usage. The protocol is not listed for trading on Coinbase or Binance. No evidence of meaningful development activity, team communications, or community engagement has been identified since 2022. Users who deposited funds into the protocol after the v2 relaunch should assume those positions have minimal to no recoverable value.","heading":"Current Protocol Status","sources":[{"url":"https://defillama.com/protocol/zabu-finance","name":"defillama.com","type":"other","credibility":3},{"url":"https://www.coinbase.com/price/zabu-finance","name":"coinbase.com","type":"other","credibility":3}],"severity":"medium"},{"content":"ZachXBT, the pseudonymous on-chain investigator known for flagging fraudulent and high-risk crypto projects, has flagged Zabu Finance as a risky entity. The specific basis for ZachXBT's flag was not recoverable from publicly indexed posts at the time of this investigation. Given the protocol's history — a preventable exploit using a known vulnerability, anonymous team, no recovered funds, token collapse, and protocol abandonment — the flag is consistent with ZachXBT's documented focus on projects that cause user harm.","heading":"ZachXBT Flag","sources":[{"url":"https://en.wikipedia.org/wiki/ZachXBT","name":"en.wikipedia.org","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021-07","event":"PolyYeld Finance on Polygon is exploited using the identical deflationary-token accounting flaw; YELD token crashes to zero. The vulnerability is publicly documented but no widespread industry remediation follows.","source":"","date_original":"2021-07-01"},{"date":"2021-09-12","event":"Zabu Finance is exploited on Avalanche via flash loan attack targeting SPORE pool's deflationary token accounting flaw. Attacker mints approximately 4.5 billion ZABU tokens and dumps them on Pangolin and Trader Joe DEXes, stealing approximately $3.2 million. ZABU price collapses ~99.5%.","source":""},{"date":"2021-09-13","event":"Zabu Finance team sets all farm rewards to zero and announces a snapshot-based v2 token recovery plan. PeckShield publicly states the bug 'happened many times before.' SlowMist and Knownsec publish technical analyses of the exploit.","source":""},{"date":"2021-09-13","event":"Zabu Finance burns approximately 93.12 million ZABU tokens (valued at ~$360,000 at time of burn) as part of recovery efforts.","source":""},{"date":"2022-08-22","event":"Zabu Finance website SSL certificate expires and is not renewed, indicating active development and maintenance has ceased.","source":""},{"date":"2026-05","event":"DefiLlama records Zabu Finance TVL at approximately $5,147. ZABU token is delisted from major exchanges. Protocol is effectively dormant.","source":"","date_original":"2026-05-01"}],"sources_used":[{"url":"https://www.coindesk.com/tech/2021/09/13/avalanche-based-zabu-finance-exploited-in-32m-hack","name":"Avalanche-Based Zabu Finance Exploited in $3.2M Hack — CoinDesk","type":"news_article","archive_url":"https://web.archive.org/web/20260724183725/https://www.coindesk.com/tech/2021/09/13/avalanche-based-zabu-finance-exploited-in-32m-hack","credibility":1,"archive_timestamp":"2026-07-24T18:37:25+00:00"},{"url":"https://slowmist.medium.com/brief-analysis-of-zabu-finance-being-hacked-44243919ea29","name":"Brief Analysis of Zabu Finance Being Hacked — SlowMist","type":"research","archive_url":"https://web.archive.org/web/20260724212909/https://slowmist.medium.com/brief-analysis-of-zabu-finance-being-hacked-44243919ea29","credibility":2,"archive_timestamp":"2026-07-24T21:29:09+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-zabu-finance-hack-september-2021","name":"Explained: The Zabu Finance Hack (September 2021) — Halborn","type":"research","archive_url":"http://web.archive.org/web/20251114004624/https://www.halborn.com/blog/post/explained-the-zabu-finance-hack-september-2021","credibility":2,"archive_timestamp":"2025-11-14T00:46:24+00:00"},{"url":"https://beincrypto.com/zabu-finance-exploited-on-avalanche-3-2m/","name":"Zabu Finance Exploited on Avalanche For $3.2M — BeInCrypto","type":"news_article","archive_url":"http://web.archive.org/web/20250908163541/https://beincrypto.com/zabu-finance-exploited-on-avalanche-3-2m/","credibility":2,"archive_timestamp":"2025-09-08T16:35:41+00:00"},{"url":"https://medium.com/@Knownsec_Blockchain_Lab/knowsec-blockchain-lab-zabu-finance-flash-loan-security-incident-analysis-5fe10e7f4849","name":"Knowsec Blockchain Lab Zabu Finance Flash Loan Analysis — Medium","type":"research","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.quadrigainitiative.com/hackfraudscam/zabufinancestakingcalculationbug.php","name":"Sep 2021 Zabu Finance Staking Calculation Bug — Quadriga Initiative","type":"community_report","archive_url":"https://web.archive.org/web/20260724184717/https://www.quadrigainitiative.com/hackfraudscam/zabufinancestakingcalculationbug.php","credibility":3,"archive_timestamp":"2026-07-24T18:47:17+00:00"},{"url":"https://ambcrypto.com/avalanche-based-zabu-finance-loses-3-2m-to-defi-exploit/","name":"Avalanche-based Zabu Finance loses $3.2M to DeFi exploit — AMBCrypto","type":"news_article","archive_url":"http://web.archive.org/web/20250913164700/https://ambcrypto.com/avalanche-based-zabu-finance-loses-3-2m-to-defi-exploit/","credibility":2,"archive_timestamp":"2025-09-13T16:47:00+00:00"},{"url":"https://defillama.com/protocol/zabu-finance","name":"Zabu Finance — DefiLlama Protocol Page","type":"on_chain","archive_url":"http://web.archive.org/web/20250906131111/https://defillama.com/protocol/zabu-finance","credibility":2,"archive_timestamp":"2025-09-06T13:11:11+00:00"},{"url":"https://www.quadrigainitiative.com/casestudy/polyyeldfinancexyeldexploit.php","name":"Jul 2021 PolyYeld Finance xYeld Exploit — Quadriga Initiative","type":"community_report","archive_url":"http://web.archive.org/web/20260122135449/https://quadrigainitiative.com/casestudy/polyyeldfinancexyeldexploit.php","credibility":3,"archive_timestamp":"2026-01-22T13:54:49+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":true,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:54.416163+00:00","updated_at":"2026-08-29T01:34:35.727+00:00"}}