Zentra Finance
Hack or exploit on Sep 9, 2026 · Rounding Error
What happened
Zentra’s Aave V3-based lending implementation contained a boundary-condition accounting flaw in repayWithATokens. The attacker borrowed assets and requested repayment of the outstanding debt plus exactly one base unit. The debt-token path’s ceil-rounding cleared the debt in full, while the aToken burn path’s rounding safeguard reduced the required burn to the caller’s available aToken balance. Because the attacker held no corresponding aTokens, the burn was reduced to zero. The Pool therefore recorded the debt as repaid without receiving equivalent value, allowing the attacker to withdraw the original flash-funded collateral while retaining the borrowed reserve assets. The sequence was repeated against ctUSD and USDC.e
Details
- Date
- Sep 9, 2026
- Kind
- Hack or exploit
- Method
- Rounding Error
- How in
- Smart contract bug
- Target
- DeFi protocol
- Chains
- Citrea
Reported by
Related incidents
Thetanuts Finance 2026 · Hack or exploit · $105K
Set Protocol 2026 · Hack or exploit · $22K
Coffer 2026 · Hack or exploit · $1
SwanBluechip, "Zentra Finance hack, Sep 9, 2026: $140K lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/hte62641a13a/ (data as of 2026-11-01).