Today, Eraland, a famous lending protocol using zkSync technology, has caused a huge financial loss of $3.4 Million. According to the reports from Spreekaway, an incident response and security firm, there are concerns that the platform has been used by bad actors. The Eraland team, however, has quickly addressed the issue and assured the public that the company is actively dealing with the attack and presently have it under control. The firm has taken all the necessary steps to stop all loan operations until it determines the full extent of the harm. BlockSec has also confirmed the EraLend exploit.
We are assisting @Era_Lend to this issue, and the root cause has been identified. The total loss is ~$3.4M.
Specifically, this is a read-only re-entrancy attack.
Another attack tx is:https://t.co/H4A2suVLai
Attacker address:
0xf1D076c9Be4533086f967e14EE6aFf204D5ECE7a https://t.co/InhCCW7QAy— BlockSec (@BlockSecTeam) July 25, 2023
Devastating Cyber Attack Hits EraLend DeFi Platform via Read-Only Reentrancy Exploit
The popular decentralized finance (DeFi) platform, EraLend has fallen victim to a devastating cyber attack. The attack, which experts have identified as exploiting a read-only reentrancy vulnerability, has allowed the attacker to carry out a series of repeated calls to a specific function within a single transaction, resulting in the unauthorized withdrawal of a considerable amount of funds.
The hacker has expertly exploited the weakness by utilizing a flawed price oracle that EraLend has previously relied upon. The attacker was able to cause alarmingly more harm by using the reentrancy exploit to drain additional resources from the protocol.
Trending Now: Crypto Exchange Bitget Rebrands to Discover New Possibilities
Typically, functions like “read-only” are safe since they perform view actions without changing the state of the contract. These functions could use information from outside sources, such as third-party pools, to determine token balances. In this tragic instance, SyncSwap, another decentralized exchange, served as the third party.
EraLend Confirms Cyber Attack on Discord, Assures Users of Safety for Non-USDC Assets
In a recent statement on Discord, EraLend confirmed that its platform experiences a cyber attack. The firm has reassured its users that the threat has been eliminated and the attackers can no longer carry out any malicious deeds. The attack specially targeted the USDC pool, but the company emphasized that the security of other assets on the platform remains unaffected. This means that users’ funds in currencies other than USDC are safe.