Decoding Shezmu’s $4.9 Million Exploit

Shezmu token is a cutting-edge digital asset designed to empower the decentralized finance (DeFi) ecosystem by providing a seamless and secure means of transaction processing. Built on the Ethereum blockchain, this innovative token leverages the power of smart contracts to facilitate fast, low-cost, and transparent transactions. At the heart of Shezmu's architecture lies its proprietary consensus algorithm, which ensures the integrity and security of the network.

Attack Contract address: 0xEd4B3d468DEd53a322A8B8280B6f35aAE8bC499C

Shezmu Attacker address (created attack contract): 0xA3a64255484aD65158AF0F9d96B5577F79901a1D 

Attack Contract Creation tx: 0x39328ea4377a8887d3f6ce91b2f4c6b19a851e2fc5163e2f83bbc2fc136d0c71

1. The hacker identified a critical flaw in Shezmu’s vault, allowing anyone to mint collateral freely.
   
   
    
2. The attacker developed a custom smart contract designed to exploit this vulnerability.
    
3. Using the custom contract, the hacker minted a large amount of ShezUSD without the required collateral.
    

4. With the minted ShezUSD, the hacker borrowed a significant portion of the protocol's resources, effectively draining $4.9 million.
   
   

    

The root cause of the Shezmu exploit was a critical vulnerability in their vault system that allowed unauthorized minting of collateral. This flaw enabled the attacker to mint ShezUSD freely, bypassing the necessary checks or collateral requirements.

The vulnerability likely stemmed from a contract upgrade implemented on September 3, which may have introduced the bug or failed to address an existing issue.

The attacker minted ShezUSD using the vulnerability and borrowed funds from the protocol, draining $4.9 million worth of assets. Here is the fund flow.

Here is what Shezmu responded to the exploit:

One of the ShezUSD vaults has been compromised. Please avoid using the dApp for now. We're investigating the cause of the exploit and will offer a bounty while reaching out to the appropriate authorities. A detailed post-mortem will follow soon.

1. Engage reputable audit firms like QuiilAudits to conduct comprehensive security audits, especially after contract upgrades, to identify vulnerabilities such as unauthorized collateral minting.
    
2. Implement strict access control mechanisms to ensure only authorized users can mint or manage collateral.

Choosing a reputable audit firm like QuillAudits ensures that your protocol undergoes rigorous scrutiny from experienced security professionals. QuillAudits specializes in uncovering critical vulnerabilities and providing actionable remediation strategies. Our expertise helps safeguard your project from attacks, ensuring that security issues are addressed proactively.