aToken burn safeguard clamps to zero, repayWithATokens clears debt without burning
מה ידוע על המתקפה?
הסיווג ושיטת התקיפה משקפים את דיווחי המקורות. תיאורים מפורטים מוצגים בשפת המקור; לקריאת התחקיר המלא ניתן לפתוח את הקישור המצורף.
DefiLlamaתיאור המקור באנגלית
Zentra’s Aave V3-based lending implementation contained a boundary-condition accounting flaw in repayWithATokens. The attacker borrowed assets and requested repayment of the outstanding debt plus exactly one base unit. The debt-token path’s ceil-rounding cleared the debt in full, while the aToken burn path’s rounding safeguard reduced the required burn to the caller’s available aToken balance. Because the attacker held no corresponding aTokens, the burn was reduced to zero. The Pool therefore recorded the debt as repaid without receiving equivalent value, allowing the attacker to withdraw the original flash-funded collateral while retaining the borrowed reserve assets. The sequence was repeated against ctUSD and USDC.e
SlowMistתיאור המקור באנגלית
On September 9, 2026, an attacker used a single transaction on Citrea mainnet and ~200,000 USDC.e of flash liquidity as temporary collateral to drain 140,000 ctUSD and 30 USDC.e from Zentra’s lending pool. The root cause was an accounting edge case in repayWithATokens: the debt path could complete while the matching aToken burn was reduced to zero. The operations multisig paused all markets about 17 minutes later; no second exploit occurred.
aToken burn safeguard clamps to zero, repayWithATokens clears debt without burning
מה ידוע על המתקפה?
הסיווג ושיטת התקיפה משקפים את דיווחי המקורות. תיאורים מפורטים מוצגים בשפת המקור; לקריאת התחקיר המלא ניתן לפתוח את הקישור המצורף.
DefiLlamaתיאור המקור באנגלית
Zentra’s Aave V3-based lending implementation contained a boundary-condition accounting flaw in repayWithATokens. The attacker borrowed assets and requested repayment of the outstanding debt plus exactly one base unit. The debt-token path’s ceil-rounding cleared the debt in full, while the aToken burn path’s rounding safeguard reduced the required burn to the caller’s available aToken balance. Because the attacker held no corresponding aTokens, the burn was reduced to zero. The Pool therefore recorded the debt as repaid without receiving equivalent value, allowing the attacker to withdraw the original flash-funded collateral while retaining the borrowed reserve assets. The sequence was repeated against ctUSD and USDC.e
SlowMistתיאור המקור באנגלית
On September 9, 2026, an attacker used a single transaction on Citrea mainnet and ~200,000 USDC.e of flash liquidity as temporary collateral to drain 140,000 ctUSD and 30 USDC.e from Zentra’s lending pool. The root cause was an accounting edge case in repayWithATokens: the debt path could complete while the matching aToken burn was reduced to zero. The operations multisig paused all markets about 17 minutes later; no second exploit occurred.
