On July 25, 2023, EraLend on zkSync suffered a read-only reentrancy attack in code borrowed from SyncSwap, where an attacker repeatedly called a vulnerable function to manipulate asset prices via the internal oracle, draining $3.4M. Only USDC deposits were affected.

On July 25th, according to reports from several users, Eralend, the lending protocol on Zksync, was attacked by lightning loans, and it is currently unable to borrow, but it can be proposed temporarily. On July 26, EraLend released the progress of the attack. EraLend stated that the attacker manipulated the price of the oracle machine, resulting in the USDC mining pool being used for about 2.76 million US dollars. All other pools remain safe and unaffected. The attackers used multiple bridges to spread the exploited funds across multiple wallets on various chains.