{"investigation":{"slug":"eralend","entity_name":"EraLend","trust_score":28,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"EraLend (formerly Nexon Finance) is a decentralized lending protocol on zkSync Era that suffered a $3.4 million read-only reentrancy exploit on July 25, 2023, draining its USDC pool due to a vulnerability in inherited SyncSwap oracle code. The protocol's pre-hack audit by PeckShield explicitly assumed a trusted price oracle, leaving the vulnerable oracle mechanism unexamined. EraLend relaunched post-hack with a fee-based compensation plan but has seen its TVL decline sharply to approximately $138,000 as of 2025-2026.","sections":[{"content":"On July 25, 2023, EraLend suffered a read-only reentrancy attack resulting in losses of approximately $3.4 million, with approximately $2.66 million in net attacker profit after fees. The attacker (EOA address 0xf1D076c9Be4533086f967e14EE6aFf204D5ECE7a on zkSync mainnet) exploited a vulnerability in EraLend's price oracle mechanism, which relied on SyncSwap LP token data. By burning tokens and invoking a callback before the _updateReserves function executed, the attacker caused the protocol's oracle to calculate asset prices based on stale, manipulated reserve values. This allowed repeated draining of funds within a single transaction. Only the USDC pool was compromised; all other asset pools were reported unaffected. Hacken subsequently traced stolen assets to multiple attacker-controlled addresses across Ethereum, Arbitrum, and Optimism blockchains. This was the second major exploit recorded on the zkSync network, following the Merlin DEX $1.8 million rugpull in April 2023.","heading":"The July 2023 Reentrancy Exploit","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-eralend-hack-july-2023","name":"halborn.com","type":"other","credibility":3},{"url":"https://www.certik.com/resources/blog/eralend-incident-analysis","name":"certik.com","type":"other","credibility":3},{"url":"https://rekt.news/eralend-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2023/07/25/zksyncs-largest-lender-struck-by-34m-exploit","name":"coindesk.com","type":"other","credibility":3}],"severity":"critical"},{"content":"EraLend's vulnerable smart contract code was inherited from SyncSwap, a DEX on zkSync. The vulnerable function included an inline comment explicitly noting that reserve values were updated after the callback, creating the read-only reentrancy window. This architectural flaw was not introduced by EraLend developers but was retained without modification. CertiK's post-incident analysis confirmed: 'The attacker is able to burn tokens and then callback before _updateReserves is called. This causes the oracle to calculate the price based on incorrect reserves.' BlockSec publicly warned other protocols using similar SyncSwap code patterns that they may share this exposure. EraLend had marketed itself as more secure than competitors specifically because it avoided external oracles and external liquidity sources — making the oracle manipulation vulnerability particularly notable as a gap between security claims and implementation.","heading":"Root Cause: Inherited Vulnerability from SyncSwap","sources":[{"url":"https://www.certik.com/resources/blog/eralend-incident-analysis","name":"certik.com","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-eralend-hack-july-2023","name":"halborn.com","type":"other","credibility":3},{"url":"https://rekt.news/eralend-rekt","name":"rekt.news","type":"other","credibility":3}],"severity":"high"},{"content":"EraLend (then operating under the name Nexon Finance) was audited by PeckShield in March 2023, approximately four months before the exploit. REKT News and other security analysts noted that the PeckShield audit 'assumes a trusted price oracle,' meaning the auditors effectively sidestepped examination of the oracle mechanism that was later exploited. This is a recognized limitation in DeFi auditing: treating oracle trust as an assumption rather than a security property to be verified. No audit is reported to have identified the SyncSwap callback reentrancy as a risk before the attack occurred.","heading":"Pre-Hack Audit Gaps","sources":[{"url":"https://rekt.news/eralend-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-eralend-hack-july-2023","name":"halborn.com","type":"other","credibility":3}],"severity":"high"},{"content":"Following the exploit, EraLend suspended all borrowing operations and advised users to refrain from depositing USDC. The protocol onboarded SlowMist as a security consultant for asset tracing and security enhancements. On August 8, 2023, EraLend separated the compromised contract into 'EraLend Classic' (with lending and borrowing disabled; withdrawals and repayments remained operational) and deployed a new version of the protocol excluding the SyncSwap LP pool. The team committed to redirecting 100% of protocol fees toward compensating exploit victims and offered a 10% reward for information leading to identification of the attacker or recovery of stolen funds. A February 2024 Medium post announced a partnership with Pyth Network, suggesting continued development activity into 2024. As of early 2026, EraLend's TVL stands at approximately $138,000 — a fraction of the estimated $18.5 million TVL the protocol held prior to the exploit.","heading":"Post-Exploit Response and Relaunch","sources":[{"url":"https://eralend.medium.com/charting-the-path-forward-eralends-response-and-blueprint-following-the-security-incident-aa8ae4961b4c","name":"eralend.medium.com","type":"other","credibility":3},{"url":"https://www.cryptotimes.io/2023/08/08/eralend-separates-exploited-contract-relaunches/","name":"cryptotimes.io","type":"other","credibility":3},{"url":"https://www.binance.com/en/square/post/868073","name":"binance.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/eralend","name":"defillama.com","type":"other","credibility":3}],"severity":"medium"},{"content":"EraLend launched as Nexon Finance in early 2023, going live on zkSync Era mainnet in April 2023 after a public testnet phase in February 2023. The project rebranded to EraLend in May 2023, approximately two months before the hack. At its peak, EraLend was the largest lending protocol on zkSync Era by TVL, with approximately $18.5 million in deposits. The team has operated pseudonymously with no publicly identified individual founders, which is common in DeFi but limits accountability. The project describes itself as 'community-built.'","heading":"Project History and Rebranding","sources":[{"url":"https://eralend.medium.com/nexon-finance-is-now-eralend-1aa9caeac537","name":"eralend.medium.com","type":"other","credibility":3},{"url":"https://beincrypto.com/eralend-crypto-lending-protocol-security-breach/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://rekt.news/eralend-rekt","name":"rekt.news","type":"other","credibility":3}],"severity":"low"},{"content":"As of early 2026, EraLend remains nominally operational on zkSync Era with a TVL of approximately $138,000 and active loans totaling approximately $274,000, suggesting some borrowers remain. DappRadar placed EraLend at rank #282 in DeFi as of February 2025. The protocol has not published public communications since February 2024. The sustained TVL decline — from $18.5 million pre-hack to under $140,000 — indicates the exploit caused lasting reputational and capital damage. It is not known whether full victim compensation was achieved through the fee-redirection mechanism.","heading":"Current Status and TVL Decline","sources":[{"url":"https://defillama.com/protocol/eralend","name":"defillama.com","type":"other","credibility":3},{"url":"https://dappradar.com/dapp/eralend","name":"dappradar.com","type":"other","credibility":3},{"url":"https://eralend.medium.com/","name":"eralend.medium.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2023-02-09","event":"Nexon Finance public testnet launches on zkSync","source":""},{"date":"2023-03","event":"PeckShield audits Nexon Finance; audit assumes a trusted price oracle, leaving oracle mechanism unexamined","source":"","date_original":"2023-03-01"},{"date":"2023-04","event":"Nexon Finance goes live on zkSync Era mainnet","source":"","date_original":"2023-04-01"},{"date":"2023-05-20","event":"Nexon Finance rebrands to EraLend","source":""},{"date":"2023-07-25","event":"EraLend exploited via read-only reentrancy attack; approximately $3.4M stolen from USDC pool by attacker 0xf1D076c9Be4533086f967e14EE6aFf204D5ECE7a","source":""},{"date":"2023-07-26","event":"EraLend confirms attack, suspends borrowing, advises against USDC deposits; SlowMist engaged for asset tracing","source":""},{"date":"2023-08-08","event":"EraLend separates exploited contract into 'EraLend Classic' and relaunches new protocol without SyncSwap LP pool; 10% recovery reward offered","source":""},{"date":"2024-02-07","event":"EraLend announces partnership with Pyth Network — last known public communication","source":""}],"sources_used":[{"url":"https://www.halborn.com/blog/post/explained-the-eralend-hack-july-2023","name":"halborn.com","type":"other","archive_url":"http://web.archive.org/web/20260415064850/https://www.halborn.com/blog/post/explained-the-eralend-hack-july-2023","credibility":3,"archive_timestamp":"2026-04-15T06:48:50+00:00"},{"url":"https://www.certik.com/resources/blog/eralend-incident-analysis","name":"certik.com","type":"other","archive_url":"http://web.archive.org/web/20251017003438/https://www.certik.com/resources/blog/eralend-incident-analysis","credibility":3,"archive_timestamp":"2025-10-17T00:34:38+00:00"},{"url":"https://rekt.news/eralend-rekt","name":"rekt.news","type":"other","archive_url":"http://web.archive.org/web/20260313114042/https://rekt.news/eralend-rekt","credibility":3,"archive_timestamp":"2026-03-13T11:40:42+00:00"},{"url":"https://www.coindesk.com/business/2023/07/25/zksyncs-largest-lender-struck-by-34m-exploit","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20251117034125/https://www.coindesk.com/business/2023/07/25/zksyncs-largest-lender-struck-by-34m-exploit","credibility":3,"archive_timestamp":"2025-11-17T03:41:25+00:00"},{"url":"https://eralend.medium.com/charting-the-path-forward-eralends-response-and-blueprint-following-the-security-incident-aa8ae4961b4c","name":"eralend.medium.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.cryptotimes.io/2023/08/08/eralend-separates-exploited-contract-relaunches/","name":"cryptotimes.io","type":"other","archive_url":"https://web.archive.org/web/20260829150934/https://www.cryptotimes.io/2023/08/08/eralend-separates-exploited-contract-relaunches/","credibility":3,"archive_timestamp":"2026-08-29T15:09:34+00:00"},{"url":"https://www.binance.com/en/square/post/868073","name":"binance.com","type":"other","archive_url":"https://web.archive.org/web/20260830044535/https://www.binance.com/en/square/post/868073","credibility":3,"archive_timestamp":"2026-08-30T04:45:35+00:00"},{"url":"https://defillama.com/protocol/eralend","name":"defillama.com","type":"other","archive_url":"http://web.archive.org/web/20250907055153/https://defillama.com/protocol/eralend","credibility":3,"archive_timestamp":"2025-09-07T05:51:53+00:00"},{"url":"https://eralend.medium.com/nexon-finance-is-now-eralend-1aa9caeac537","name":"eralend.medium.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://beincrypto.com/eralend-crypto-lending-protocol-security-breach/","name":"beincrypto.com","type":"other","archive_url":"http://web.archive.org/web/20260122074440/https://beincrypto.com/eralend-crypto-lending-protocol-security-breach/","credibility":3,"archive_timestamp":"2026-01-22T07:44:40+00:00"},{"url":"https://dappradar.com/dapp/eralend","name":"dappradar.com","type":"other","archive_url":"https://web.archive.org/web/20260829132820/https://dappradar.com/dapp/eralend","credibility":3,"archive_timestamp":"2026-08-29T13:28:20+00:00"},{"url":"https://eralend.medium.com/","name":"eralend.medium.com","type":"other","archive_url":"http://web.archive.org/web/20250912085016/https://eralend.medium.com/","credibility":3,"archive_timestamp":"2025-09-12T08:50:16+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:40.054931+00:00","updated_at":"2026-08-30T05:14:10.670954+00:00"}}