zkLend lost $9.57M on February 11, 2025 on Starknet via an integer division rounding vulnerability. Attacker exploited truncated rounding in withdrawal calculations with precise wstETH deposits to inflate their raw_balance to 1724, draining all tokens from other pools. Attacker returned ~$3.2M after negotiation but lost remaining to a Tornado Cash scam.

The leading lending platform on the Starknet chain, zkLend, has suffered an attack. The core reason for this breach lies in the fact that the value of the accumulator in an empty market can be manipulated and amplified using a unique mechanism in flash loans. Additionally, the market contract's use of the SafeMath library performs division using direct division, allowing the attacker to exploit the amplified accumulator to trigger a rounding-down vulnerability for profit.