Starknet's zkLend Hacked: $9.5M Loss, Link to EraLend Attack

On February 12th, the Starknet on-chain lending protocol zkLend was hacked, resulting in a loss of over 9.5 million US dollars. The attack exploited a vulnerability in the safeMath library used by the protocol's market contract, which adopted direct division in division calculations, leading to a rounding vulnerability in the actual amount of zToken to be destroyed during withdrawal calculation.

The attacker's address has been active for 235 days and has interacted with multiple platforms such as Binance. The hacker has transferred the stolen funds across chains, with most of it going to the Ethereum network. SlowMist founder Ye Xian stated that by tracking the attacker's Starknet-related addresses, it was discovered that this attacker has links to the July 25, 2023, EraLend hack.

The vulnerability in the safeMath library allowed the attacker to manipulate the withdrawal calculation, leading to an excessive amount of zTokens being destroyed. This resulted in a loss of over 9.5 million US dollars for the protocol. The attacker then transferred the stolen funds across chains, with most of it going to the Ethereum network.

The fact that the attacker has links to the EraLend hack suggests that this may not be an isolated incident. It is possible that the attacker is part of a larger group that is targeting on-chain lending protocols. This highlights the importance of security measures and the need for thorough audits of smart contracts before deployment.

The hack also raises questions about the security of the safeMath library and the need for more robust security measures in the development of smart contracts. The use of direct division in division calculations can lead to rounding vulnerabilities, which can be exploited by attackers. Developers should be aware of these potential vulnerabilities and take steps to mitigate them.

In response to the hack, zkLend has stated that it is working to address the vulnerability and recover the stolen funds. The protocol has also stated that it is cooperating with law enforcement agencies to investigate the incident. It is unclear at this time whether the attacker will be caught and brought to justice.

The hack of zkLend is a reminder of the risks associated with on-chain lending protocols and the need for robust security measures. As the use of these protocols continues to grow, it is important for developers to take steps to mitigate potential vulnerabilities and ensure the security of user funds.