← EraLendreviewed 2026-11-02 · 12 claims checked
Fact-check findings
What an automated fact-checker found when it re-read EraLend against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
unverifiable
6 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #3[unverifiable][awaiting moderator]in section: The July 2023 Reentrancy Exploit
“Hacken subsequently traced stolen assets to multiple attacker-controlled addresses across Ethereum, Arbitrum, and Optimism blockchains.”
reviewerHacken traced stolen assets to addresses on Ethereum, Arbitrum and OptimismHacken's involvement is confirmed only for the profit estimate. I could not confirm the cross-chain tracing in sources I fetched. - #7[unverifiable][awaiting moderator]in section: Root Cause: Inherited Vulnerability from SyncSwap
“EraLend had marketed itself as more secure than competitors specifically because it avoided external oracles and external liquidity sources — making the oracle manipulation vulnerability particularly notable as a gap between security claims and implementation.”
reviewerEraLend marketed itself as more secure because it avoided external oracles and liquidity sourcesNot present in Rekt or CertiK. The interpretive 'gap between claims and implementation' is editorial and not backed by a fetched source. - #9[unverifiable][awaiting moderator]in section: Post-Exploit Response and Relaunch
“On August 8, 2023, EraLend separated the compromised contract into 'EraLend Classic'”
reviewerAug 8, 2023 separation into EraLend Classic, 100% fees to compensation, 10% bounty, SlowMistCited sources were blocked (cryptotimes 403, Medium unarchivable). URL date is consistent with 2023-08-08. Not scored. - #10[unverifiable][awaiting moderator]in section: Post-Exploit Response and Relaunch
“As of early 2026, EraLend's TVL stands at approximately $138,000 — a fraction of the estimated $18.5 million TVL the protocol held prior to the exploit.”
reviewerTVL approx $138,000 vs $18.5M prior$18.5M pre-hack confirmed by CoinDesk. Current $138K figure could not be read (DefiLlama blocked). Also, the page says 'early 2026' while today is November 2026, so the figure may be dated. - #11[unverifiable][awaiting moderator]in the timeline
“2023-05-20”
reviewerRebrand from Nexon Finance to EraLend on 2023-05-20Medium post not archived and not checked; timeline entries have empty source fields. Rebrand itself is plausible and mentioned in secondary coverage. - #12[unverifiable][awaiting moderator]in section: Current Status and TVL Decline
“The protocol has not published public communications since February 2024.”
reviewerNo public communications since February 2024Negative claim limited to Medium; X/Twitter activity unchecked.citederalend.medium.com/
confirmed
6 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in section: The July 2023 Reentrancy Exploit
“On July 25, 2023, EraLend suffered a read-only reentrancy attack resulting in losses of approximately $3.4 million, with approximately $2.66 million in net attacker profit after fees.”
reviewerEraLend lost about $3.4M to a read-only reentrancy exploit on July 25, 2023Figures match. CertiK's own post says approximately $2.7M total loss, so $3.4M is the headline figure rather than universal. - #2[confirmed][no action needed]in section: The July 2023 Reentrancy Exploit
“The attacker (EOA address 0xf1D076c9Be4533086f967e14EE6aFf204D5ECE7a on zkSync mainnet)”
reviewerAttacker EOA addressAddress matches Rekt. - #4[confirmed][no action needed]in section: The July 2023 Reentrancy Exploit
“This was the second major exploit recorded on the zkSync network, following the Merlin DEX $1.8 million rugpull in April 2023.”
reviewerSecond major zkSync exploit after Merlin DEX $1.8M rugpull in April 2023Consistent with Rekt's leaderboard framing. - #5[confirmed][no action needed]in section: Root Cause: Inherited Vulnerability from SyncSwap
“EraLend's vulnerable smart contract code was inherited from SyncSwap, a DEX on zkSync.”
reviewerVulnerable code inherited from SyncSwap with an inline comment about reservesSupported by Rekt. - #6[confirmed][no action needed]in section: Root Cause: Inherited Vulnerability from SyncSwap
“CertiK's post-incident analysis confirmed: 'The attacker is able to burn tokens and then callback before _updateReserves is called. This causes the oracle to calculate the price based on incorrect reserves.'”
reviewerCertiK quote about burn and callback before _updateReservesQuote present in the CertiK analysis. - #8[confirmed][no action needed]in section: Pre-Hack Audit Gaps
“was audited by PeckShield in March 2023, approximately four months before the exploit.”
reviewerPeckShield audit in March 2023 assumed a trusted price oracleSupported. The 'effectively sidestepped' characterization is mild interpretation.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.