Hacker Withdraws $3.4M From Era Lend

Era Lend, a decentralized lending protocol running on zkSync Layer 2, was a victim of a reentrancy attack that resulted in a total loss of $3.4 million, according to security analysts at BlockSec.

The incident exposed what is known as a read-only reentrancy vulnerability that allowed for a hacker to make multiple calls to a function in a single transaction, stolen more funds than intended.

This was possible due to a faulty price oracle the protocol relied upon, which enabled the hacker to further drain assets from the platform.

Typically, it is believed view functions labeled as “read-only” are safe since they don’t change the contract’s state; they merely perform a view action such as calculating a token balance with a third-party pool’s supply.

This case, however, showed that these functions can be manipulated to siphon off considerable funds.

According to co-founder and CTO of BlockSec, Lei Wu:

“The attacker altered the LP’s price during the burn/mint actions of SyncSwap, using its reserves to determine the LP price [on Era Lend].”