Decentralized cash lender zkLend suffered a breach the place menace actors exploited a wise contract flaw to steal 3,600 Ethereum, price $9.5 million on the time.
zkLend is a decentralized money-market protocol constructed on Starknet, a Layer 2 scaling resolution for Ethereum. It permits customers to deposit, borrow, and lend varied property.
The assault occurred yesterday afternoon, with zkLend warning on X they have been struggling a cybersecurity incident.
In line with the EthSecurity Telegram channel, the menace actors exploited a rounding error bug in zkLend’s sensible contract mint() perform.
“The attacker manipulated the “lending_accumulator” to be very giant at 4.069297906051644020, then took benefit of the rounding error throughout ztoken mint() and withdraw() to repeatedly deposit 4.069297906051644021 wstETH getting 2 wei then withdraw 4.069297906051644020*1.5 -1 = 6.103946859077466029 wstETH to expend simply 1 wei,” reads a put up to the EthSecurity channel.
Starkware, who developed the Starknet community, confirmed that the vulnerability was not a part of Starknet know-how however quite an application-specific bug.
In line with Cyvers, the menace actors tried to launder the crypto by means of the RailGun privateness protocol however was blocked resulting from protocol insurance policies.
zkLend has now issued a message to the hacker stating that in the event that they return 90% of the stolen Ethereum, which is 3,300 ETH, they’ll maintain the opposite 10% and won’t face any legal responsibility for the assault.
“We perceive that you’re accountable for right this moment’s assault on zkLend. You might maintain 10% of the funds as a whitehat bounty, and ship again the remaining 90%, or 3,300 ETH to be precise, to this Ethereum tackle: 0xCf31e1b97790afD681723fA1398c5eAd9f69B98C,” reads an on-chain message to the hacker.
“Upon receiving the switch, we comply with launch from any and all legal responsibility relating to the assault.”
“We’re working with safety companies and legislation enforcement at this stage. If we don’t hear from you by 00:00 UTC, 14th Feb 2025, we are going to proceed with the subsequent steps to trace and prosecute you.”
The crypto thieves have till February 13, at 7:00 PM EST, to return 90% of the stolen funds, after which zkLend will pursue authorized motion.
There has not been any response from the hacker, which is often the case in these conditions. No menace actors have been attributed to the assault.
