ZoomerCoin Exploit — Spot-Priced Upfront Staking Reward Drained via AMM Price Manipulation

Source & credit. Exploit reproduction, trace data, and analysis adapted from DeFiHackLabs by SunWeb3Sec — an open registry of reproduced on-chain exploits. Standalone Foundry PoC and full write-up: 2024-02-Zoomer_exp in the evm-hack-registry mirror. Upstream DeFiHackLabs PoC: src/test/…/Zoomer_exp.sol.

Vulnerability classes: vuln/oracle/spot-price · vuln/oracle/price-manipulation

Reproduction: the PoC compiles & runs in an isolated Foundry project at this project folder (the umbrella DeFiHackLabs repo contains many unrelated PoCs that do not compile together, so this one was extracted). Full verbose trace: output.txt. Verified ZOOMER token source: ZoomerCoin.sol. Caveat: the vulnerable contract here is the ZOOMER staking/deposit contract at 0x9700204D…, whose verified source was not available for download — its logic below is reconstructed directly from the on-chain -vvvvv trace (storage writes, reserve reads, ETH payouts). The downloaded source is the ZOOMER ERC-20 token, which is used but not itself buggy.

Key info#

TL;DR#

The ZOOMER staking contract at 0x9700204D… exposes a deposit function (selector 0x72c4cff6(address token, uint256 amount)) that, at the moment of deposit, values the deposited ZOOMER using the instantaneous Uniswap V2 spot reserves and immediately pays the depositor an ETH "reward" worth ~95% of that valuation. The valuation it stores is exactly:

ethQuote = amount * reserveWETH / reserveZOOMER / 2
ethPaid  = ethQuote * 0.95

(Confirmed from the trace: the contract reads getReserves() right before pricing, then stores ethQuote = 3,785,511,883,118,999,207 wei and pays out 3,596,236,288,963,049,246 wei — exactly spot/2 and quote × 0.95.)

Because the price comes from the live pool, an attacker can pump it. The attack, repeated 5 times inside a single Balancer WETH flash-loan, is:

1. Pump — buy ~3.699 billion ZOOMER for 199.9 ETH, raising the spot price ~21.5×.
2. Deposit — call 0x72c4cff6(ZOOMER, 30,265,400e18). The contract prices that slice at the pumped spot price (~3.785 ETH) and instantly pays back ~3.596 ETH.
3. Dump — sell the remaining ~3.669 billion ZOOMER back into the pool, recovering ~199.285 ETH.
4. Net ≈ +3 ETH per round (the ~3.596 ETH reward minus the ~0.6 ETH AMM round-trip loss).

After four profitable rounds the contract's ETH balance is exhausted; the 5th deposit reverts with "Insufficient ETH balance". Total walked off with: ~14.39 ETH.

Background — the two contracts involved#

ZoomerCoin (ZOOMER) — the token#

ZoomerCoin.sol is an ordinary "meme" ERC-20 with a Uniswap-V2 tax mechanism. At the fork block its sell tax is effectively 0 (_buyCount has long since exceeded _reduceSellTaxAt = 369, and _finalSellTax = 0), so for this exploit ZOOMER behaves as a plain, freely-tradeable token. The token itself is not the source of the bug — it is merely the asset the attacker pumps and dumps. Total supply is 69,000,000,000 ZOOMER (ZoomerCoin.sol:172), which is why pool reserves are measured in billions of tokens.

The staking contract at 0x9700204D… — the victim#

This is a separate ZOOMER deposit/staking contract (verified source not published; behavior below is read off the trace). Its deposit entry point is selector 0x72c4cff6, which takes (address token, uint256 amount). On each call it:

1. transferFrom(msg.sender, self, amount) — pulls the deposited ZOOMER (output.txt:1653).
2. Reads factory.getPair(token, WETH) → pair.getReserves() → pair.token0() (output.txt:1661-1666) — i.e. it prices the token from the live pool.
3. Writes a deposit record to storage (output.txt:1670-1676): token, amount = 30,265,400e18, ethQuote = 3.7855 ETH, depositTs, and an unlockTs = depositTs + 10 days.
4. Pays the depositor ethQuote × 0.95 ≈ 3.596 ETH immediately (Money::fallback{value: 3596236288963049246} at output.txt:1667).

In other words it hands out an upfront ETH "reward"/advance, denominated at the current spot value of the deposited tokens, before any lock-up matures — and it sources that spot value from a pool the caller fully controls within the same transaction.

The on-chain state observed at the fork block:

The vulnerable code#

The staking contract's source is not published, so the exact Solidity cannot be quoted. The trace, however, pins the pricing formula to the wei. Reconstructed, the deposit handler does the equivalent of:

// selector 0x72c4cff6 — reconstructed from the trace, NOT verified source
function deposit(address token, uint256 amount) external payable {
    IERC20(token).transferFrom(msg.sender, address(this), amount);   // pull tokens

    address pair = IUniswapV2Factory(factory).getPair(token, WETH);
    (uint112 r0, uint112 r1, ) = IUniswapV2Pair(pair).getReserves();  // ⚠️ LIVE spot reserves
    address t0 = IUniswapV2Pair(pair).token0();
    (uint256 rToken, uint256 rWeth) = t0 == token ? (r0, r1) : (r1, r0);

    uint256 ethQuote = amount * rWeth / rToken / 2;                   // ⚠️ spot valuation, /2
    orders[id] = Order(token, amount, ethQuote, block.timestamp,
                       block.timestamp + 10 days);                    // 10-day lock recorded

    uint256 reward = ethQuote * 95 / 100;                             // ⚠️ 95% paid UPFRONT
    payable(msg.sender).transfer(reward);                            // ← reverts if balance too low
}

The three combined design flaws are flagged above. The token contract supplies the price surface that makes them exploitable, but the token code itself is standard (ZoomerCoin.sol:255-303).

Root cause — why it was possible#

A Uniswap V2 pair's getReserves() is the current balance ratio. It can be moved arbitrarily, within a single transaction and for free (you get the tokens back when you sell), by anyone with capital — or, as here, with a flash loan. Any contract that prices an asset off getReserves() and then pays out value based on that price in the same transaction is trivially manipulable.

The staking contract violates that principle in the most direct way:

1. Spot-price oracle. The deposit valuation reads pair.getReserves() at call time. The caller can pump the price first (buy a huge amount of ZOOMER) so the contract over-values the slice it deposits. Observed manipulation: 21.5× (price moved from 1.16e-8 to 2.50e-7 WETH/ZOOMER).
2. Upfront, under-collateralized reward. It pays ~95% of the (inflated) valuation immediately in ETH, despite recording a 10-day lock on the deposit. The depositor gets real ETH now in exchange for tokens whose honest value is a tiny fraction of the payout. The attacker never needs to wait for, or honour, the lock — they already have the ETH and can abandon the deposit.
3. No anti-manipulation guard. No TWAP, no min-liquidity / max-price-move check, no per-block limit, no comparison against an independent oracle. A 21.5× single-transaction price move is accepted at face value.
4. Fixed deposit slice, looped. The attacker deposits the same hardcoded 30,265,400e18 ZOOMER each round. The reward per round (~3.596 ETH) is fixed by the pumped price; the attack simply repeats until the contract's ETH runs out (round 5 reverts with "Insufficient ETH balance", output.txt:2165).

The economics per round (numbers from the trace):

The slice deposited (30.26 M ZOOMER) is a rounding error against the 3.699 B bought, so cornering it out of the pump position costs essentially nothing — the entire reward is profit minus the ~0.6 ETH AMM round-trip fee.

Preconditions#

• The staking contract holds enough ETH to pay rewards (it held ~14.4 ETH → exactly 4 payouts).
• A ZOOMER/WETH Uniswap V2 pair exists and is the price source the contract queries (it is).
• ZOOMER is freely buyable/sellable with ~0 tax at the fork block (true — sell tax is 0).
• Working capital to pump the pool. Peak outlay per round is 199.9 ETH; it is fully recovered intra-transaction, so the whole thing is flash-loanable. The PoC borrows 200 WETH from Balancer (Zoomer_exp.sol:30-34) and reuses it across all 5 rounds.

Attack walkthrough (with on-chain numbers from the trace)#

The pair's token0 = ZOOMER, token1 = WETH, so reserve0 = ZOOMER, reserve1 = WETH. Each of the 5 rounds spins up a fresh Money helper contract (Zoomer_exp.sol:44-46) funded with 200 ETH; the helper buys ZOOMER, deposits a slice to the staking contract, returns the remainder, and the top-level contract dumps it.

Each round nudges the baseline reserves slightly (the 30.26 M ZOOMER kept by the staking contract never comes back to the pool, and AMM fees accrue), but the structure is identical: pump → skim a fixed reward → dump.

Why the reward is "free money"#

After the pump, the pool holds 1,018,444,399 ZOOMER / 254.768 WETH. The contract values the 30.26 M ZOOMER slice at 30,265,400 × 254.768 / 1,018,444,399 = 7.571 WETH, halves it to ethQuote = 3.7855 ETH, and pays 95% = 3.5962 ETH. The honest (pre-pump) value of that same slice was ~0.352 WETH — so the attacker is paid roughly 10× the tokens' real worth, and the deposited tokens themselves cost almost nothing because they are a sliver of the much larger pump position that is fully sold back.

Profit accounting (ETH)#

The 200 WETH flash loan is repaid in full (Zoomer_exp.sol:48); the AMM round-trips net out to roughly zero (each ~199.9 buy is matched by a ~199.3 sell, the difference being fees absorbed by the pool). The attacker's clean take is the ~14.39 ETH of staking-contract ETH.

Diagrams#

Sequence of one round (rounds 1–4 are identical; round 5 reverts at the deposit)#

Pricing flow inside the deposit handler#

Drain progression (staking contract ETH balance)#

Remediation#

1. Never price a payout off live spot reserves. Replace getReserves() with a manipulation- resistant source: a Uniswap V2 TWAP (cumulative-price) accumulated over a meaningful window, a Chainlink feed, or an off-chain signed price. Spot reserves in the same transaction as the payout are not an oracle.
2. Do not pay rewards upfront. If the deposit is genuinely locked for 10 days, the reward (if any) must be claimable only after the lock matures and only against the token's value at maturity / over the lock period — not advanced in ETH at deposit time. An instant ETH advance against a future, manipulable valuation is a free option for the depositor.
3. Bound single-transaction price moves. Reject deposits when the spot price deviates from a trusted reference (TWAP/oracle) by more than a small tolerance, or when pool liquidity is below a floor. A 21.5× move in one transaction should be impossible to act on.
4. Cap and rate-limit rewards. Per-address and per-block limits on reward ETH, plus a global budget, would have bounded the loss to a single round instead of draining the contract.
5. Require the depositor to bear price risk. Settle the deposit in tokens (return the same tokens at unlock) rather than converting to an ETH claim at deposit-time spot — this removes the incentive to manipulate the price at the moment of deposit entirely.

How to reproduce#

The PoC was extracted into a standalone Foundry project (the umbrella DeFiHackLabs repo has many unrelated PoCs that fail to compile under a single whole-project forge build):

_shared/run_poc.sh 2024-02-Zoomer_exp --mt testExploit -vvvvv

• RPC: an Ethereum mainnet archive endpoint is required (fork block 19,291,249, Feb 2024). Most free public RPCs prune state this old and fail with header not found / missing trie node; use an archive provider.
• Result: [PASS] testExploit(). The trace shows four Money::fallback{value: ~3.596e18} payouts from the staking contract and a final ← [Revert] Insufficient ETH balance once it is drained.

Expected tail (from output.txt):

    ├─ emit log_named_decimal_uint(key: "[Begin] Attacker ETH after exploit", val: 79228161529072816349105401162 [7.922e28], decimals: 18)
    └─ ← [Stop]

Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 25.13s
Ran 1 test suite: 1 tests passed, 0 failed, 0 skipped (1 total tests)

Note: the [Begin]/[Begin] after logs print address(this).balance, a vm.deal-inflated number that does not reflect the WETH-denominated profit. The real take is the ~14.39 ETH of ETH paid out by the staking contract across the four successful rounds (see the four Money::fallback{value: ~3.596e18} entries), consistent with the reported ~14 ETH loss.

Reference: ChainAegis — https://x.com/ChainAegis/status/1761246415488225668 (ZOOMER staking, Ethereum, ~14 ETH).

Sources & further analysis#

Reproductions & code

• Standalone PoC + full trace: 2024-02-Zoomer_exp (evm-hack-registry mirror).
• Upstream DeFiHackLabs PoC: Zoomer_exp.sol.
• Attack transaction: view on explorer.

Alerts & third-party analyses

• Original alert / thread: post on X.
• DeFiHackLabs incident explorer: search "ZoomerCoin Exploit".
• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.