11 Feb 2025, from 12:44 UTC
zkLend: Empty wstETH Market Accumulator Manipulation on Starknet
zkLend: on 11 Feb 2025 an empty wstETH market was inflated via flash-loan donations, then floor-division withdrawals created excess collateral. ~$9.57M drained; markets suspended.
- Event date
- Incident typeSmart-contract exploit
- Bug classAccounting
- Published
Loss, as sourced
Around $9,572,151 at exploit time, per zkLend aggregates: 2,213.64 ETH, 1,553,069 USDC, 7,426,030 STRK, 518,226 USDT.
Traceability
Primary sources
In brief
Root cause: Per zkLend: (1) 1-wei first deposit into empty market; (2) flash-loan overpay treated as revenue inflating accumulator to ~4.07e18; (3) withdrawal raw-amount floor division burns too little — combined, attacker grows raw balance while recovering deposits, then borrows against inflated collateral.
Timeline, as sourced: Per zkLend (UTC, 11 Feb): 12:44 first contact; 15:01 first inflated borrow; 16:37 bridging out; 19:14 team alerted; 19:37 borrowing suspended; 20:09 all operations suspended.
Account, as sourced
Claimed (zkLend) (post-mortem (opens in a new tab)): kSTRK liquid staking unaffected. Audited by Nethermind (2022/2023) with no criticals found.
Initial tracing links exploiter to prior empty-market style incidents (Eralend, OnyxDAO, others).
Summaries of public sources as of the published date; except where marked (on-chain), not independently verified by NullMeridian. Figures are the sources’ own and are attributed; where sources disagree, each is given. Sources may since have changed. Not legal, financial or investment advice.
Permalinkhttps://andromeda.observer/e/zklend-empty-market-accumulator-2025