#eralend

DeFi Platform EraLend on zkSync Loses $3.4 Million in Blockchain Exploit

(adsbygoogle = window.adsbygoogle || []).push();

Source: Adobe / _Danoz

Decentralized finance (DeFi) protocol EraLend has lost $3.4 million worth of crypto in a so-called re-entrancy attack.

The attack, which happened on Tuesday, exploited a vulnerability that allowed the hacker to make multiple calls to a function within one single transaction, enabling the person or group to withdraw more money than what should have been possible.

Only deposits in the form of the stablecoin USD Coin (USDC) appears to have been affected for now.

News of the hacking attack was first shared by an individual community member on Twitter, with the EraLend later responding and thanking the user for his “swift action in flagging this attack.”

“As we continue to work with multiple parties to resolve this, we hope that you […] will continue to keep a close eye on this ongoing investigation,” the team wrote.

The news was then reported on by the blockchain security firm BlockSec, which said it is assisting EraLend in the handling of a “read-only re-entrancy attack”:

Attack has been ‘contained’, team says

In a post on EraLend’s Discord server, the EraLend team said the attack has been “contained,” while assuring users that the attackers are “no longer able to continue their actions.”

“As a precautionary measure, we have temporarily suspended all borrowing operations to ensure the safety of funds,” the team wrote, adding that users are advised to avoid depositing USDC until further notice.

“We are actively investigating this matter and will provide timely updates to our community as more information becomes available,” the post said.

A lending and borrowing protocol that operates on the zkSync layer 2 network, EraLend claims to be among the most capital efficient solutions in the DeFi space with a smaller difference between lending and borrowing rates.

The protocol also claims to be a safer choice than competing protocols, saying on its website that it is less risky because it does not depend on oracles and external liquidity.

Conic Finance suffered same attack

A reentrancy attack is the same type of exploit as the DeFi protocol Conic Finance suffered over the weekend.

In Conic Finance’s case, hackers drained $3.2 million worth of Ether (ETH) from the protocol in two separate attacks that exploited an Omnipools vulnerability.

“In response to this and given today’s ETH exploit, we immediately enforced maximum safety measures and temporarily shutdown all Omnipools,” the Conic Finance team said at the time.

(adsbygoogle = window.adsbygoogle || []).push(); #DeFi #Platform #EraLend #zkSync #Loses #Million #Blockchain #Exploit

DeFi Hack Worth $3.4M Strikes EraLend, zkSync's Top Lender

(adsbygoogle = window.adsbygoogle || []).push();

Share this article

EraLend, a lending protocol on Ethereum’s scaling blockchain, zkSync, faced a substantial exploit that resulted in a loss of $3.4 million, according to an analysis by CertiK, a leading firm in blockchain security.

The incident was described as a read-only reentrancy attack, a complex strategy allowing the perpetrator to tamper with asset prices via repeated calls to a smart contract, effectively looting assets.

🔔 #EraLend Update: ZkSync attack resulted in $1.7M loss. Verify your assets for reimbursement here https://t.co/gAnpA0tpph Check even if no loss. #zkSyncEra pic.twitter.com/h249rQ2DLe

— zkSync ∎ (@_zksnyc) July 25, 2023

EraLend’s total capital locked on the platform took a considerable hit, dropping to $10.75 million from an earlier $18.5 million, as shown in data from DefiLlama.

The lending platform confirmed the security incident in an official statement on social media, noting that the threat was under control.

The tweet read: “We’ve experienced a security incident on our platform today. The threat has been contained. We’ve suspended all borrowing operations for now and advise against depositing USDC. We’re working with partners and cybersecurity firms to address this. More updates to follow.”

Conic Finance was also exploited last week, losing 1700 ETH due to a comparable exploit. The thief initiated a flash loan of 20,000 staked ETH, redirecting these funds to Conic’s price oracle, which set the stage for the exploit.

This vulnerability was subsequently leveraged, together with a manipulation of Conic’s price oracle that sources its data from a read-only smart contract provided by a third party.

Share this article

The information on or accessed through this website is obtained from independent sources we believe to be accurate and reliable, but Decentral Media, Inc. makes no representation or warranty as to the timeliness, completeness, or accuracy of any information on or accessed through this website. Decentral Media, Inc. is not an investment advisor. We do not give personalized investment advice or other financial advice. The information on this website is subject to change without notice. Some or all of the information on this website may become outdated, or it may be or become incomplete or inaccurate. We may, but are not obligated to, update any outdated, incomplete, or inaccurate information.

You should never make an investment decision on an ICO, IEO, or other investment based on the information on this website, and you should never interpret or otherwise rely on any of the information on this website as investment advice. We strongly recommend that you consult a licensed investment advisor or other qualified financial professional if you are seeking investment advice on an ICO, IEO, or other investment. We do not accept compensation in any form for analyzing or reporting on any ICO, IEO, cryptocurrency, currency, tokenized sales, securities, or commodities.

See full terms and conditions.

(adsbygoogle = window.adsbygoogle || []).push(); #DeFi #Hack #Worth #3.4M #Strikes #EraLend #zkSyncs #Top #Lender