Zenterest Hack Analysis

lunaray
4 min readAug 21, 2024

--

Background

Recently, we have monitored an on-chain attack targeting Ethereum, https://etherscan.io/tx/0xfe8bc757d87e97a5471378c90d390df47e1b29bb9fca918b94acd8ecfaadc5, specifically the DeFi project “Zenterest” within the “Mantra DAO” project. This project, a Compound Fork, provided lending and borrowing functionalities, but it has since been closed.

Attack and Event Analysis

Firstly, the attacker utilized “Uniswap V3” to perform a “flash” loan, borrowing “85.0085 WHITE”.

Subsequently, the attacker transferred their own “2,000 MPH” to Zenterest and “minted” “751,165,762,743 / 1e18 zenMPH”, equivalent to the “MPH Token’s underlying Token” (valued at “21,200 MPH”).

In the “Compound” protocol, the “mintTokenAmount” is calculated as “mintAmount” divided by the exchange rate (the value of the underlying Token).

mintTokens = actualMintAmount / exchangeRate

The exchange rate is calculated as:

exchangeRate = (totalCash + totalBorrows - totalReserves) / totalSupply

Where “totalCash” is “2,130,237,755,166,997,669,234”, “totalBorrows” is “377,279,871,321,643,951,514,656”, “totalReserves” is “336,296,661,332,642,353,710,274”, and “totalSupply” is “1,527,610,653,739”. Hence, “exchangeRate” is “28,222,798,550.562313”.

exchangeRate = (2,130,237,755,166,997,669,234 + 377,279,871,321,643,951,514,656 - 336,296,661,332,642,353,710,274) / 1,527,610,653,739 = 28,222,798,550.562313

Therefore, “mintToken” amounts to “751,165,762,743”.

mintToken = 21,200,000,000,000,000,000,000 / 28,222,798,550.562313 = 751,165,762,743.8796

Next, the attacker transferred the “85 WHITE” obtained from the Uniswap flash loan to Zenterest. Here, the attacker aimed to manipulate the “zenWHITE” “borrowRate” to prevent a high “borrowRate,” which could lead to a failed attack.

Subsequently, the attacker utilized “cToken” to borrow the entire balance of “zenWHITE.”

The vulnerability lies in the “ZenterestPriceFeed” price oracle.

We can observe the code for “ZenterestPriceFeed” as follows:

Its price is updated using “updatePrice” and “updatePriceBatch.”

We can see that the prices in this oracle have not been updated for 570 days, rendering all prices outdated. We found the most recent transaction that updated the price of “MPH Token” as follows:

The most recent transaction updating the price of “MPH Token” is:
https://etherscan.io/tx/0x8938ec223516e0f09d904ee6187032f2038f3f768d754eb19b4f19450e7d185d

The data structure for the price update parameters is as follows:

Therefore, the price obtained for “MPH Token” through the “Zenterest Price Oracle” is “0x35b52f953f951 = 944,836,858,607,953”, while the current actual price is “0.4677 USD”.

Simultaneously, we can observe that the obtained price for “WHITE Token” is “66,570,137,662,599,764”, while the current actual price is “4200 USD”.

The attacker invested “23200 MPH” and borrowed “89.91 WHITE”. Based on the price obtained from the “Zenterest Price Oracle,” the calculation is as follows:

MPH Token Value: 23200 * 944,836,858,607,953 = 21,920,215,119,704,509,600
WHITE Token Value: 5,991,312,389,633,978,760
MPH Token Value >> WHITE Token Value

Therefore, the attacker was able to borrow “89.91 WHITE,” repay the “85 WHITE” and “0.0085 WHITE” interest obtained from Uniswap, and ultimately profit “4.9 WHITE,” valued at “21000 USD”.

Conclusion

The cause of this vulnerability is that the project is no longer in use, yet “cToken” was not paused, and the price oracle’s prices were not updated. This led to a distortion in the prices of the underlying assets, which the attacker exploited through borrowing to make a profit, ultimately resulting in the attacker depleting the project’s “WHITE” tokens using a minimal amount of MPH.

--

--

lunaray

Lunaray takes a leading position in smart contract auditing and consulting service for blockchain security.