{"investigation":{"slug":"zircon-gamma","entity_name":"Zircon Gamma","trust_score":32,"severity_base":null,"score_modifier":0,"confidence":0.72,"status":"published","content_type":"investigation","summary":"Zircon Gamma was a Moonriver-deployed automated market maker (AMM) built by Zircon Labs that pioneered single-sided liquidity provision via its Pylon risk-tranching mechanism. On March 18, 2023, an attacker exploited a vulnerability in the protocol's modified Uniswap V2 core across both its Moonriver and BNB Chain deployments, draining approximately $350,000 in user funds. Following the exploit, the ZRG token lost essentially all market value, development activity ceased by mid-2023, and the promised relaunch and debt-repayment plan have not been publicly demonstrated as fulfilled.","sections":[{"content":"Zircon Gamma was the canary (mainnet-beta) deployment of the Zircon Finance protocol, launched on Moonriver in September 2022 before an intended migration to Moonbeam. Its central innovation was the Pylon system, a risk-tranching layer built on top of a Uniswap V2 core that split each liquidity pool into two vaults: a 'Float' (junior) tranche with full exposure to the volatile asset and an 'Anchor' (senior) tranche denominated in the stable asset. This architecture allowed users to provide liquidity using only a single token, mitigating impermanent loss through a mechanism the team called Async LPing, whereby the protocol recorded each depositor's entry value in USD and directed future gains from the retained volatile asset toward Float liquidity providers. The protocol introduced the burnOneSide function to facilitate single-sided withdrawals, simulating a two-sided removal followed by an internal swap — a modification that introduced the critical vulnerability exploited in March 2023.","heading":"Protocol Overview and Mechanism","sources":[{"url":"https://blog.zircon.finance/p/zircon-gamma-is-live-on-moonriver","name":"Zircon Gamma Is Live on Moonriver Mainnet — Zircon Finance Blog","type":"official","credibility":2},{"url":"https://blog.zircon.finance/p/meet-zircon-gamma-on-moonriver-the","name":"Meet Zircon Gamma on Moonriver, the Zircon Canary Deployment — Zircon Finance Blog","type":"official","credibility":2},{"url":"https://cointelegraph.com/news/zircon-finance-launches-mainnet-to-mitigate-impermanent-loss-on-moonriver","name":"Zircon Finance launches mainnet to mitigate impermanent loss on Moonriver — CoinTelegraph","type":"news_article","credibility":2},{"url":"https://docs.zircon.finance/","name":"Zircon Docs — Pylon and Single-Sided Liquidity","type":"official","credibility":2}],"severity":"medium"},{"content":"On March 18, 2023, an attacker using address 0xfe7a244CF06e9296c3233f47b315A720bad542f7 exploited the burnOneSide function across every pool on both Moonriver and BNB Chain deployments simultaneously. The vulnerability stemmed from a mismatch between two accounting variables: the exploit used the live token balance of the pool contract rather than its internal reserves value. Since reserves are updated only at the end of each transaction while balance reflects real-time holdings, the attacker could donate a precisely crafted ETH amount to force the pool's effective ETH value to approach near-zero (1 wei), making the remaining MOVR appear extraordinarily valuable in the simulated swap calculation. This caused the contract to release nearly the entire MOVR balance of the pool as if it were the output of a routine single-sided withdrawal, with the attacker using a Solarbeam flash loan to fund the donation and repaying it while retaining the drained liquidity. The team's post-mortem acknowledged that this vulnerability existed in code first committed in February 2022 and that, despite a Chain Troopers audit, neither the auditors nor the team caught the flaw because they were overconfident in the safety of the Uniswap V2 base layer relative to the more novel Pylon contracts.","heading":"March 2023 Exploit: Technical Details","sources":[{"url":"https://blog.zircon.finance/p/zircon-hack-post-mortem","name":"Zircon Hack Post-Mortem — Zircon Finance Blog","type":"official","credibility":2},{"url":"https://forum.moonbeam.network/t/zircon-finance-hack/675","name":"Zircon Finance Hack — Moonbeam Community Forum","type":"community_report","credibility":2},{"url":"https://github.com/Zircon-Finance/zircon-protocol-2/blob/master/audit/chaintroopers/Zircon_Protocol2_SecAssessment_report_v1.1.pdf","name":"Chain Troopers Audit Report (GitHub)","type":"research","credibility":2}],"severity":"critical"},{"content":"The team estimated total user liability from the exploit at approximately $350,000, measured in USD values at the time of the attack. On Moonriver alone, approximately 6,450 MOVR tokens were drained from liquidity pools. The ZRG governance and utility token lost virtually all market value following the incident; the team's own post-mortem stated that the 'value of ZRG was completely wiped out.' DeFi analytics data on DefiLlama shows the protocol's total value locked (TVL) dropping to near zero after the exploit date. The team announced it would sunset the original ZRG token rather than attempt recovery, opting instead to take a snapshot of pre-hack wallet and Float LP balances and issue a replacement token to affected non-ZRG liquidity providers on a proportional USD-value basis. The remainder of the liability was pledged to be repaid through a continuous stream from future protocol revenue, with exact percentages to be determined by a future DAO — a commitment that has not been publicly documented as fulfilled.","heading":"Financial Impact and ZRG Token Collapse","sources":[{"url":"https://blog.zircon.finance/p/zircon-hack-post-mortem","name":"Zircon Hack Post-Mortem — Zircon Finance Blog","type":"official","credibility":2},{"url":"https://defillama.com/protocol/zircon-gamma","name":"Zircon Gamma TVL and Volume — DefiLlama","type":"on_chain","credibility":2},{"url":"https://blog.zircon.finance/p/zrg-airdrop","name":"ZRG Airdrop: Who Gets it and How? — Zircon Finance Blog","type":"official","credibility":2},{"url":"https://dexscreener.com/moonriver/0x5ac1f0b2ee43048beb1bc76a85763cfb3d23ce0b","name":"Zircon Gamma Token (ZRG) Price Data — DEX Screener","type":"on_chain","credibility":2}],"severity":"critical"},{"content":"The exploit revealed material weaknesses in Zircon's security governance. The burnOneSide function had been committed to the codebase in February 2022 with minimal subsequent modification, and it was included in scope for the Chain Troopers security assessment — yet the critical balance-versus-reserves discrepancy went undetected. The team's post-mortem attributed this to misplaced confidence in the Uniswap V2 base, noting that review efforts were concentrated on the novel Pylon architecture rather than the amended core. Following the hack, the team disclosed that it had not performed fuzz testing on the burnOneSide code path. Community members in the Moonbeam forum noted that the Moonbeam Foundation had awarded Zircon Finance a grant of 15,000 MOVR from its Moonriver ecosystem program and had promoted the protocol on its official social channels, leading some affected users to argue that institutional endorsement influenced their decision to deposit funds. The Moonbeam Foundation responded that social media announcements constitute informational content only and do not constitute endorsement or investment advice. A separate 1 million GLMR grant proposal for a Moonbeam deployment was submitted post-hack, in which the team committed a majority of any received funds to additional audits, a Code4rena contest, and a bug bounty program before further liquidity mining.","heading":"Audit Failure and Security Governance Concerns","sources":[{"url":"https://blog.zircon.finance/p/zircon-hack-post-mortem","name":"Zircon Hack Post-Mortem — Zircon Finance Blog","type":"official","credibility":2},{"url":"https://forum.moonbeam.network/t/zircon-finance-hack/675","name":"Zircon Finance Hack — Moonbeam Community Forum","type":"community_report","credibility":2},{"url":"https://forum.moonbeam.network/t/zircon-finance-ecosystem-grant-draft-proposal/542","name":"Zircon Finance Ecosystem Grant Draft Proposal — Moonbeam Forum","type":"official","credibility":2},{"url":"https://moonbeam.foundation/grants/recipients/","name":"Past Grant Recipients — Moonbeam Foundation","type":"official","credibility":1}],"severity":"high"},{"content":"The founding team of Zircon Labs included publicly identified individuals: Andrey Shevchenko (Co-Founder and CEO, formerly at CoinTelegraph), David Vittori (Co-Founder and CTO), and additional staff spanning frontend development, marketing, and legal. Team members participated in at least one on-camera Moonbeam ecosystem feature and are not anonymous. The team published a detailed post-mortem within days of the March 2023 exploit, which is considered a positive transparency signal relative to projects that disappear after incidents. However, GitHub repository activity indicates that substantive commits to the zircon-protocol-2 repository ceased by April 2023 and the zircon-interface repository by July 2023, suggesting development was effectively discontinued within months of the hack. The promised relaunch of the protocol under a revised tokenomics model, including a new token with standard team and DAO allocations, has not been publicly documented as completed. No formal regulatory action, criminal referral, or court filing against the team has been identified. The characterization of the incident as a rug pull has not been substantiated by on-chain evidence of insider fund extraction prior to or concurrent with the exploit; the available record is consistent with an unaudited code vulnerability rather than intentional fraud.","heading":"Team, Transparency, and Post-Incident Conduct","sources":[{"url":"https://www.youtube.com/watch?v=cLgxieLrLDU","name":"Moonbeam Universe: Meet the Zircon Finance Team — YouTube","type":"other","credibility":2},{"url":"https://www.linkedin.com/in/shvandrew/","name":"Andrey Shevchenko — LinkedIn","type":"other","credibility":2},{"url":"https://github.com/Zircon-Finance","name":"Zircon Finance GitHub Organization","type":"official","credibility":2},{"url":"https://blog.zircon.finance/p/zircon-hack-post-mortem","name":"Zircon Hack Post-Mortem — Zircon Finance Blog","type":"official","credibility":2}],"severity":"medium"},{"content":"As of mid-2026, Zircon Finance displays multiple indicators of an effectively abandoned protocol. GitHub commit history shows no substantive development activity after July 2023. The ZRG token trades at a fraction of a cent on Moonriver with negligible liquidity. The DefiLlama TVL chart for Zircon Gamma shows TVL at effectively zero following the March 2023 exploit. The Moonbeam-targeted Zircon V2 relaunch discussed in team AMAs and the post-hack grant proposal has not been publicly announced as live. The team's Substack and social media accounts have not published material updates since 2023. Users who held ZRG or provided liquidity in Pylon pools at the time of the hack and did not receive compensation through the interim redistribution face an unresolved claim against promised future protocol revenue from an entity that has shown no evidence of generating such revenue. The protocol's on-chain contracts remain paused and are not generating fees.","heading":"Protocol Status and Abandonment Risk","sources":[{"url":"https://defillama.com/protocol/zircon-gamma","name":"Zircon Gamma TVL and Volume — DefiLlama","type":"on_chain","credibility":2},{"url":"https://github.com/Zircon-Finance","name":"Zircon Finance GitHub Organization","type":"official","credibility":2},{"url":"https://blog.zircon.finance/","name":"Zircon Finance Blog (Substack)","type":"official","credibility":2},{"url":"https://blog.zircon.finance/p/ama-summary-zircon-v2-nfts-and-more","name":"AMA Summary: Zircon V2, NFTs and More — Zircon Finance","type":"official","credibility":2}],"severity":"high"},{"content":"Zircon Gamma has been flagged in the AVOID.NET intake system as an entity reported by ZachXBT, the pseudonymous on-chain investigator known for tracing stolen funds and exposing DeFi incidents. However, a systematic search of ZachXBT's published Mirror.xyz investigations, X/Twitter thread archive, and third-party coverage of ZachXBT investigations did not surface a dedicated thread or report specifically naming Zircon Gamma or Zircon Finance. ZachXBT is known to flag entities in informal posts, replies, and community discussions that may not be indexed by major search engines. The March 2023 exploit was reported by the team itself and discussed on the Moonbeam community forum, making it plausible that ZachXBT commented on the incident within social media discussions without publishing a formal investigation. This claim is assessed as low confidence based on available open-source evidence. Users should treat the ZachXBT flag as a signal warranting further independent verification rather than as a confirmed published investigation.","heading":"ZachXBT Flagging — Source Assessment","sources":[{"url":"https://zachxbt.mirror.xyz/","name":"ZachXBT Mirror.xyz Investigation Archive","type":"other","credibility":1},{"url":"https://x.com/zachxbt","name":"ZachXBT X/Twitter Profile","type":"social_media","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2022-02","event":"burnOneSide function first committed to Zircon protocol codebase, introducing the vulnerability later exploited in March 2023.","source":"Zircon Hack Post-Mortem","source_url":"https://blog.zircon.finance/p/zircon-hack-post-mortem","date_original":"2022-02-01"},{"date":"2022-09","event":"Zircon Gamma (canary deployment) launched on Moonriver mainnet with the ZRG token and the Pylon single-sided liquidity system.","source":"Zircon Gamma Is Live on Moonriver Mainnet — Zircon Finance Blog","source_url":"https://blog.zircon.finance/p/zircon-gamma-is-live-on-moonriver","date_original":"2022-09-01"},{"date":"2022-09-10","event":"CoinTelegraph reported on Zircon Finance mainnet launch as a novel impermanent loss mitigation DEX on Moonriver.","source":"CoinTelegraph","source_url":"https://cointelegraph.com/news/zircon-finance-launches-mainnet-to-mitigate-impermanent-loss-on-moonriver"},{"date":"2022-10","event":"Moonbeam Foundation awarded Zircon Finance a Moonriver ecosystem grant of 15,000 MOVR to support liquidity bootstrapping.","source":"Past Grant Recipients — Moonbeam Foundation","source_url":"https://moonbeam.foundation/grants/recipients/","date_original":"2022-10-01"},{"date":"2023-03-18","event":"Attacker (0xfe7a244CF06e9296c3233f47b315A720bad542f7) exploited the burnOneSide vulnerability on Moonriver and BNB Chain, draining approximately $350,000 in user funds across all pools. The team paused Pylon contracts but the attack bypassed the Pylon entirely.","source":"Zircon Hack Post-Mortem — Zircon Finance Blog","source_url":"https://blog.zircon.finance/p/zircon-hack-post-mortem"},{"date":"2023-03-18","event":"Zircon Finance announced the hack on X/Twitter, stating the team was in preliminary stages of analyzing the attack.","source":"Zircon Finance on X/Twitter","source_url":"https://twitter.com/Zircon_Finance/status/1637093661321183233"},{"date":"2023-03-20","event":"Community thread opened on the Moonbeam Forum challenging the Foundation's due diligence in granting ecosystem funds and social promotions to Zircon Finance.","source":"Zircon Finance Hack — Moonbeam Community Forum","source_url":"https://forum.moonbeam.network/t/zircon-finance-hack/675"},{"date":"2023-04-03","event":"Last recorded substantive commit to the zircon-protocol-2 GitHub repository, indicating development on the core protocol ceased.","source":"Zircon Finance GitHub Organization","source_url":"https://github.com/Zircon-Finance/zircon-protocol-2"},{"date":"2023-07-28","event":"Last recorded commit to the zircon-interface GitHub repository, after which all public development activity went silent.","source":"Zircon Finance GitHub Organization","source_url":"https://github.com/Zircon-Finance/zircon-interface"},{"date":"2023-07","event":"Zircon Finance submitted a post-hack ecosystem grant draft proposal to Moonbeam Foundation requesting 1 million GLMR, committing to prioritize security spending over liquidity mining if funded.","source":"Zircon Finance Ecosystem Grant Draft Proposal — Moonbeam Forum","source_url":"https://forum.moonbeam.network/t/zircon-finance-ecosystem-grant-draft-proposal/542","date_original":"2023-07-01"}],"sources_used":[{"url":"https://blog.zircon.finance/p/zircon-hack-post-mortem","name":"Zircon Hack Post-Mortem — Zircon Finance Blog","type":"official","archive_url":null,"credibility":2,"archive_error":"error:no-job","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://forum.moonbeam.network/t/zircon-finance-hack/675","name":"Zircon Finance Hack — Moonbeam Community Forum","type":"community_report","archive_url":"http://web.archive.org/web/20260724171127/https://forum.moonbeam.network/t/zircon-finance-hack/675","credibility":2,"archive_timestamp":"2026-07-24T17:11:27+00:00"},{"url":"https://blog.zircon.finance/p/zircon-gamma-is-live-on-moonriver","name":"Zircon Gamma Is Live on Moonriver Mainnet — Zircon Finance Blog","type":"official","archive_url":null,"credibility":2,"archive_error":"error:no-job","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://blog.zircon.finance/p/meet-zircon-gamma-on-moonriver-the","name":"Meet Zircon Gamma on Moonriver — Zircon Finance Blog","type":"official","archive_url":null,"credibility":2,"archive_error":"error:no-job","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cointelegraph.com/news/zircon-finance-launches-mainnet-to-mitigate-impermanent-loss-on-moonriver","name":"CoinTelegraph — Zircon Finance launches mainnet to mitigate impermanent loss on Moonriver","type":"news_article","archive_url":"http://web.archive.org/web/20250818160945/https://cointelegraph.com/news/zircon-finance-launches-mainnet-to-mitigate-impermanent-loss-on-moonriver","credibility":2,"archive_timestamp":"2025-08-18T16:09:45+00:00"},{"url":"https://defillama.com/protocol/zircon-gamma","name":"Zircon Gamma TVL and Volume — DefiLlama","type":"on_chain","archive_url":"http://web.archive.org/web/20250907080516/https://defillama.com/protocol/zircon-gamma","credibility":2,"archive_timestamp":"2025-09-07T08:05:16+00:00"},{"url":"https://blog.zircon.finance/p/zrg-airdrop","name":"ZRG Airdrop: Who Gets it and How? — Zircon Finance Blog","type":"official","archive_url":null,"credibility":2,"archive_error":"error:no-job","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://forum.moonbeam.network/t/zircon-finance-ecosystem-grant-draft-proposal/542","name":"Zircon Finance Ecosystem Grant Draft Proposal — Moonbeam Forum","type":"official","archive_url":"http://web.archive.org/web/20260725034216/https://forum.moonbeam.network/t/zircon-finance-ecosystem-grant-draft-proposal/542","credibility":2,"archive_timestamp":"2026-07-25T03:42:16+00:00"},{"url":"https://moonbeam.foundation/grants/recipients/","name":"Past Grant Recipients — Moonbeam Foundation","type":"official","archive_url":"https://web.archive.org/web/20260726065515/https://moonbeam.network/build/grants/","credibility":1,"archive_timestamp":"2026-07-26T06:55:15+00:00"},{"url":"https://github.com/Zircon-Finance/zircon-protocol-2/blob/master/audit/chaintroopers/Zircon_Protocol2_SecAssessment_report_v1.1.pdf","name":"Chain Troopers Audit Report — Zircon Protocol 2 GitHub","type":"research","archive_url":"http://web.archive.org/web/20260528021653/https://github.com/Zircon-Finance/zircon-protocol-2/blob/master/audit/chaintroopers/Zircon_Protocol2_SecAssessment_report_v1.1.pdf","credibility":2,"archive_timestamp":"2026-05-28T02:16:53+00:00"},{"url":"https://github.com/Zircon-Finance","name":"Zircon Finance GitHub Organization","type":"official","archive_url":"https://web.archive.org/web/20260725234130/https://github.com/Zircon-Finance","credibility":2,"archive_timestamp":"2026-07-25T23:41:30+00:00"},{"url":"https://docs.zircon.finance/","name":"Zircon Docs","type":"official","archive_url":null,"credibility":2,"archive_error":"error:no-job","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.youtube.com/watch?v=cLgxieLrLDU","name":"Moonbeam Universe: Meet the Zircon Finance Team — YouTube","type":"other","archive_url":"https://web.archive.org/web/20260724211654/https://www.youtube.com/watch?v=cLgxieLrLDU","credibility":2,"archive_timestamp":"2026-07-24T21:16:54+00:00"},{"url":"https://www.linkedin.com/in/shvandrew/","name":"Andrey Shevchenko — LinkedIn","type":"other","archive_url":null,"credibility":2,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://twitter.com/Zircon_Finance/status/1637093661321183233","name":"Zircon Finance on X/Twitter (hack announcement)","type":"social_media","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://zachxbt.mirror.xyz/","name":"ZachXBT Mirror.xyz Investigation Archive","type":"other","archive_url":"http://web.archive.org/web/20251025091919/https://zachxbt.mirror.xyz/","credibility":1,"archive_timestamp":"2025-10-25T09:19:19+00:00"},{"url":"https://dexscreener.com/moonriver/0x5ac1f0b2ee43048beb1bc76a85763cfb3d23ce0b","name":"Zircon Gamma Token (ZRG) on Moonriver — DEX Screener","type":"on_chain","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://blog.zircon.finance/p/ama-summary-zircon-v2-nfts-and-more","name":"AMA Summary: Zircon V2, NFTs and More — Zircon Finance","type":"official","archive_url":null,"credibility":2,"archive_error":"error:no-job","archive_status":"unarchivable","archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-5","created_at":"2026-05-04T02:54:43.371678+00:00","updated_at":"2026-08-29T01:35:04.294+00:00"}}