safemath

ChainCatcher news reports that according to Yu Xian, the founder of Slow Mist, the lending protocol zkLend on the Starknet chain was hacked on February 12, resulting in losses exceeding $9.5 million. The reason for the attack lies in the safeMath library used by its market contract, which employs direct division for calculations. This led to a rounding error in the actual number of zTokens that needed to be burned during withdrawals, which the attacker exploited for profit.On-chain data shows that the attacker's address has an active history of 235 days and has interaction records with multiple platforms, including Binance. The hacker has since transferred the stolen funds across chains, with most of it moved to the Ethereum network. Yu Xian stated that by tracking the associated Starknet addresses, it was discovered that this attacker is linked to the hacking incident of EraLend on July 25, 2023.

ChainCatcher message, regarding today's zkLend theft of over 9 million dollars, SlowMist released an analysis stating that the core reason for this attack lies in the safeMath library used in the market contract. During division calculations, direct division was used, resulting in a rounding vulnerability when calculating the actual amount of zToken that needs to be burned during withdrawals. Attackers may exploit this vulnerability to gain illegal benefits.Users are advised to closely monitor their asset status on zkLend and temporarily halt any deposit actions related to zkLend to avoid potential losses.