Decentralized cash lender zkLend suffered a breach the place menace actors exploited a sensible contract flaw to steal 3,600 Ethereum, price $9.5 million on the time.
zkLend is a decentralized money-market protocol constructed on Starknet, a Layer 2 scaling resolution for Ethereum. It allows customers to deposit, borrow, and lend numerous belongings.
The assault befell yesterday afternoon, with zkLend warning on X they have been struggling a cybersecurity incident.
Based on the EthSecurity Telegram channel, the menace actors exploited a rounding error bug in zkLend’s good contract mint() operate.
“The attacker manipulated the “lending_accumulator” to be very massive at 4.069297906051644020, then took benefit of the rounding error throughout ztoken mint() and withdraw() to repeatedly deposit 4.069297906051644021 wstETH getting 2 wei then withdraw 4.069297906051644020*1.5 -1 = 6.103946859077466029 wstETH to expend simply 1 wei,” reads a publish to the EthSecurity channel.
Starkware, who developed the Starknet community, confirmed that the vulnerability was not a part of Starknet expertise however quite an application-specific bug.
Based on Cyvers, the menace actors tried to launder the crypto by way of the RailGun privateness protocol however was blocked resulting from protocol insurance policies.
zkLend has now issued a message to the hacker stating that in the event that they return 90% of the stolen Ethereum, which is 3,300 ETH, they’ll maintain the opposite 10% and won’t face any legal responsibility for the assault.
“We perceive that you’re accountable for immediately’s assault on zkLend. You might maintain 10% of the funds as a whitehat bounty, and ship again the remaining 90%, or 3,300 ETH to be actual, to this Ethereum handle: 0xCf31e1b97790afD681723fA1398c5eAd9f69B98C,” reads an on-chain message to the hacker.
“Upon receiving the switch, we comply with launch from any and all legal responsibility concerning the assault.”
“We’re working with safety corporations and legislation enforcement at this stage. If we don’t hear from you by 00:00 UTC, 14th Feb 2025, we are going to proceed with the subsequent steps to trace and prosecute you.”
The crypto thieves have till February 13, at 7:00 PM EST, to return 90% of the stolen funds, after which zkLend will pursue authorized motion.
There has not been any response from the hacker, which is normally the case in these conditions. No menace actors have been attributed to the assault.
