An improper liquidity index computation in the Starlay USDC lending pool on Acala EVM allowed attackers to withdraw far more than their deposits. The rounding issue in the index calculation enabled the exploit.

A critical security incident within the Starlay protocol’s USDC lending pool on the Acala EVM platform. An exploit was identified and executed due to abnormal behavior in the liquidity index calculation mechanism, which allowed an attacker to withdraw an amount far exceeding their original deposit after borrowing LDOT.