Azoundria: Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/anzenfinancesmartcontractdecimalvulnerability.php}} {{Unattributed Sources}} Anzen Finance Logo/HomepageAnzen Finance offers a stablecoin which is backed by real-world assets. The protocol was launched on Ethereum, Base, and Blast. A decimal issue in the Blast version of the smart contract was able to be exploited and the exploiter profited 500k USDC thro..."

2024-09-25T20:31:29Z

Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/anzenfinancesmartcontractdecimalvulnerability.php}} {{Unattributed Sources}} thumb|Anzen Finance Logo/HomepageAnzen Finance offers a stablecoin which is backed by real-world assets. The protocol was launched on Ethereum, Base, and Blast. A decimal issue in the Blast version of the smart contract was able to be exploited and the exploiter profited 500k USDC thro..."

New page

{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/anzenfinancesmartcontractdecimalvulnerability.php}}
{{Unattributed Sources}}

[[File:Anzenfinance.jpg|thumb|Anzen Finance Logo/Homepage]]Anzen Finance offers a stablecoin which is backed by real-world assets. The protocol was launched on Ethereum, Base, and Blast. A decimal issue in the Blast version of the smart contract was able to be exploited and the exploiter profited 500k USDC through the exploit. An agreement was reached where 450k was returned in exchange for the remaining 50k being treated as a bug bounty. The protocol continued operating with minimal disruption to the price and without releasing a full post-mortem explaining the exact issue which occurred.<ref name="anzenfinancetwitter-14910" /><ref name="basescan-14911" /><ref name="basescan-14912" /><ref name="yieldsandmoretwitter-14913" /><ref name="anzenfinance-14914" /><ref name="anzenfinancedocs-14915" /><ref name="hawkinsight-14916" /><ref name="yieldsandmoretwitter-14917" />

== About Anzen Finance ==
"USDz: RWA-backed Stablecoin Backed by institutional grade real world assets"

"USDz is backed by a diversified portfolio of private credit assets. These assets have special traits that protect the investor, like collateral (real assets that can be sold to cover investors' funds) and covenants (rules that tell the borrower what they can or can't do)."

"USDz is fully composable, ensuring seamless integration and functionality across the entire crypto ecosystem. Easily participate in DeFi protocols, trade on decentralized exchanges, and use it for payments, benefiting from its stability and widespread acceptance."

"Staking is available across the largest DeFi platforms, offering attractive opportunities to earn rewards. This allows holders to optimize their portfolio and benefit from the security of a stablecoin with less volatility than speculative tokens."

"Anzen is a decentralized platform providing access to USDz, which is a digital token backed by a diversified portfolio of private credit assets.

Anzen carefully secures these cash-flowing assets alongside qualified KYC-compliant investors through rigorous underwriting. These assets are typically associated with reliable revenue streams and are expected to maintain their value even during periods of cryptocurrency market volatility.

By staking USDz tokens to obtain sUSDz, DeFi users have the chance to earn sustainable rewards and diversify their portfolios. This allows USDz holders to shield themselves from the price fluctuations and volatility of unbacked crypto tokens."

"Operations related to the issuance and redemption of USDz are recorded transparently on the blockchain. This allows users to verify the solvency of USDz at any time, providing clear visibility into the health of its reserves."

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - Anzen Finance Smart Contract Decimal Vulnerability
!Date
!Event
!Description
|-
|July 30th, 2024 9:44:27 AM MDT
|Attack Against Contract
|The reported time of the attack, based on Anzen Finance.
|-
|July 30th, 2024 10:43:15 AM MDT
|Attacker Gets USDC Funds
|The attacker is able to obtain their funds as USDC.
|-
|July 30th, 2024 12:01:35 PM MDT
|Funds Returned By Hacker
|450k worth of the funds are returned by the attacker. The remaining 50k are considered to be a bounty.
|}

== Technical Details ==
The issue was related to decimals and only affected the Blast chain. Details have not been provided.

== Total Amount Lost ==
$500k USD was lost.

The total amount lost has been estimated at $500,000 USD.

== Immediate Reactions ==
"Anzen Finance, the issuer of RWA stablecoins, announced on the X platform that on July 30, due to an error in the Blast vault contract, a white hat hacker exploited the vault to steal 500,000 USDz. The white hat returned $450,000 in a timely manner and received a $50,000 bounty as a reward."

"At Jul-30-2024 03:44:27 PM +UTC the Blast vault was exploited by a whitehat hacker for 500k USDz due to an error in our Blast vault contract. The funds have been returned. The contract error will be corrected prior to refreshing the vault limit on Blast. All other vaults are safe to use.

Upon seeing the transactions on Blast, Anzen immediately purchased 500k USDz to mitigate any sell pressure. The price impact was negligble.

Thanks to the community, we contacted the whitehat hacker who returned the funds promptly. They received a 50k bounty for spotting the error in our Blast vault contract. This is the transaction in which they sent 450k USDC back into the treasury.

We are undergoing a rapid period of growth and would like to thank you for your patience and understanding. If there are any concerns, please reach out to the team through our support channels."

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

A bounty of $50,000 USD was paid for the discovery.

== Total Amount Recovered ==
The protocol immediately supplied liquidity to resolve the price discrepancy.

$450k was recovered from the exploiter.

The total amount recovered has been estimated at $450,000 USD.

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="anzenfinancetwitter-14910">[https://twitter.com/AnzenFinance/status/1818359128542319069 @AnzenFinance Twitter] (Accessed Aug 13, 2024)</ref>

<ref name="basescan-14911">[https://basescan.org/tx/0x31254097e80dd54ee88d6aa070e69d2b7c1b673ca227f0f1439b91acf3e8c4ed Base Transaction Hash (Txhash) Details | BaseScan] (Accessed Aug 13, 2024)</ref>

<ref name="basescan-14912">[https://basescan.org/tx/0x36f0bc69198ea1884ed9f985f5e15ba8440127b47600cf821fb1f49b0577cd3e Base Transaction Hash (Txhash) Details | BaseScan] (Accessed Aug 13, 2024)</ref>

<ref name="yieldsandmoretwitter-14913">[https://twitter.com/yieldsandmore/status/1818347395626701016 @yieldsandmore Twitter] (Accessed Aug 13, 2024)</ref>

<ref name="anzenfinance-14914">[https://anzen.finance/ Anzen] (Accessed Aug 13, 2024)</ref>

<ref name="anzenfinancedocs-14915">[https://docs.anzen.finance/ Introduction | Anzen Finance] (Accessed Aug 13, 2024)</ref>

<ref name="hawkinsight-14916">[https://www.hawkinsight.com/en/article/1g1tX3 Anzen Finance was hit by a $500,000 attack and the attacker has returned the funds after deducting the bounty_Hawk Insight] (Accessed Aug 13, 2024)</ref>

<ref name="yieldsandmoretwitter-14917">[https://twitter.com/yieldsandmore/status/1818477135985885655 @yieldsandmore Twitter] (Accessed Aug 13, 2024)</ref></references>

Anzen Finance Smart Contract Decimal Vulnerability - Revision history