SlowMist Cosine: zkLend Attacked Due to a Contract safeMath Library Vulnerability, Attacker May Be Associated with the EraLend Hack Incident

BlockBeats News, February 13th, According to SlowMist founder Ye Xian's monitoring, the Starknet on-chain lending protocol zkLend was hacked on February 12th, with a loss of over 9.5 million US dollars. The reason for the attack was that the safeMath library used by its market contract adopted direct division in division calculations, leading to a rounding vulnerability in the actual amount of zToken to be destroyed during withdrawal calculation, which the attacker exploited for profit.

On-chain data shows that the attacker's address has been active for 235 days and has interacted with multiple platforms such as Binance. Currently, the hacker has transferred the stolen funds across chains, with most of it going to the Ethereum network. Ye Xian stated that by tracking their Starknet-related addresses, it was discovered that this attacker has links to the July 25, 2023, EraLend hack.