Ethereum

Defi

Discord

Read

zkSync

<p class="is-style-lead">CertiK, a leading blockchain security firm, has issued an urgent Skynet Alert after receiving multiple reports of the defi platform Era Lend falling victim to an exploitation on zkSync.&nbsp;</p> 
<p>Losses are currently estimated to be around $3.4 million.</p> 
<h2 class="wp-block-heading" id="another-hacking">Another hacking</h2> 
<p>CertiK, a blockchain security technology company that frequently tweets about vulnerabilities, hacks and exploits in the space,&nbsp;<a href="https://skynet.certik.com/alerts/security/c501f496-5302-4c6a-b3a4-5b12b9a78915" target="_blank" rel="noopener noreferrer nofollow">identifies the attack</a>&nbsp;as a “read-only reentrancy attack,” strategically targeting the platform’s multi-step processes, allowing the malicious actor to drain the funds while leaving little to no trace.</p> 
<p>By definition, a “read-only reentrancy attack” is a method used by hackers to disrupt the natural flow of transactions within a smart contract. The attacker interrupts a series of operations and then manipulates the contract to continue executing malicious actions without updating its state.</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"> 
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true"> 
   <p lang="en" dir="ltr"><a href="https://twitter.com/hashtag/CertiKSkynetAlert?src=hash&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">#CertiKSkynetAlert</a>🚨<br><br>We are seeing reports that <a href="https://twitter.com/Era_Lend?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">@Era_Lend</a> has been exploited on zkSync<br><br>Total losses appear to be $3.4 million in a read only reentrancy attack<br><br>See more below 👇<a href="https://t.co/h8xrjccE5i" target="_blank" rel="noopener noreferrer nofollow">https://t.co/h8xrjccE5i</a></p>— CertiK Alert (@CertiKAlert) <a href="https://twitter.com/CertiKAlert/status/1683828335497867264?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">July 25, 2023</a> 
  </blockquote> 
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div> 
</figure> 
<p>The report goes on to highlight that the attacker drained funds using two separate transactions from the account 0xf1D076c9Be4533086f967e14EE6aFf204D5ECE7a, in which they found a vulnerability in the callback and _updateReserves function that allowed them to manipulate a contract into reporting old values that had not yet been updated.</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"> 
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true"> 
   <p lang="en" dir="ltr">update from team ht <a href="https://twitter.com/pcaversaccio?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">@pcaversaccio</a> <a href="https://t.co/TJDSVt1sYs" target="_blank" rel="noopener noreferrer nofollow">pic.twitter.com/TJDSVt1sYs</a></p>— Spreek (@spreekaway) <a href="https://twitter.com/spreekaway/status/1683822677155254273?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">July 25, 2023</a> 
  </blockquote> 
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div> 
</figure> 
<p>The Era Lend team promptly recognized the attack and took immediate action to safeguard their protocol’s zkSync contracts.</p> 
<p>The platform then went on to release a&nbsp;<a href="https://discord.com/channels/936926364391604245/936938589055500368/1133380816387452958" target="_blank" rel="noopener noreferrer nofollow">statement</a>&nbsp;on Discord that shared that only the USDC pool was compromised and, as a precautionary measure, users should refrain from depositing this asset for the time being.</p> 
<p>Since Era Lend is a fork in the Syncswap project, which aims to bring easy-to-use decentralized finance (defi) and scales Ethereum (<a href="https://crypto.news/price/ethereum/" rel="noopener noreferrer nofollow">ETH</a>) to the masses, Certik also suggests that other projects using Syncswap could be targets of the exploit.</p> 
<p> Read more: <a href="https://crypto.news/matter-labs-hires-activision-blizzard-executive-to-bolster-zksync-gaming/" rel="noopener noreferrer nofollow"> Matter Labs hires Activision Blizzard executive to bolster zkSync gaming </a> </p>

Defi platform Era Lend exploited on zkSync, losses $3.4m in assets

Table of Contents

crypto.news

Other articles published on Jul 26, 2023

Shiba Inu: Fake ShibaSwap Exposed, SHIB Community Alerted

Ethereum’s Bullish Retest Could Spur Growth for Altcoins Like Oshi

SUI Price Prediction: Did Divergence Fail In SUI Price Action?

Dogecoin (DOGE) Outperforms Cryptocurrency Market

Crypto Payment Platform Loses $31 Million in Security Breach

Bitcoin Cash Price Prediction: Where Is BCH Price Headed?

Join our free newsletter for daily crypto updates!