Skip to main content
AVOID.NET

Zentra Finance ctUSD Aave-Fork Exploit

avoid.net/zentra-finance-ctusd-aave-fork-exploit→26/100·72% conf.
[AI-DRAFTED · AWAITING FACT-CHECK]

Last changed 2026-10-28 · Fact-check review — Fact-check review (verdict: revise): the reviewer checked the page's claims against its sources; the judge moved the trust score from 30 to 26. Version history →

Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →

anchored·5Ru1qN…pKM6
Submit evidence

Summary

Zentra Finance is a decentralized money market protocol deployed on Citrea, a Bitcoin ZK rollup, built as a fork of Aave V3 Core. On September 9, 2026, an attacker exploited a boundary condition in Zentra's custom aToken burn logic to drain approximately $143,000 in ctUSD without burning any collateral tokens. As of the date of this investigation, Zentra's lending markets remain suspended, no confirmed fund recovery has been reported, and the September 14 white-hat deadline passed without a publicly confirmed response from the attacker.

Connected Entities

1 entity

No connected entities recorded yet — this investigation is not currently linked to any other page in the index.

Have evidence about Zentra Finance ctUSD Aave-Fork Exploit?

Timeline(5 events)

9 September 2026

Exploit occurs at 12:59:37 UTC. Attacker uses flash loan and boundary condition in aToken burn logic to drain approximately 140,000 ctUSD and ~10 USDC.e from Zentra Finance's ctUSD reserve on Citrea (block 12,428,145; tx 0x9ac5df7e...074aa1). Estimated total losses: ~$143,000.

DeFiHackLabs PR #1265; CryptoTimes

9 September 2026

Zentra Finance suspends all lending markets. Citrea suspends cross-chain services as a precautionary measure pending investigation.

CryptoTimes; Phemex News

10 September 2026

Citrea restores cross-chain services for ctUSD, USDC, USDT, WBTC, and CTR after confirming the root cause was isolated to Zentra's contracts. Citrea confirms its core protocol and bridge contracts were unaffected. Some solver-based routes continue to be gradually resumed.

Phemex News; PANews; KuCoin

11 September 2026

Zentra Finance publishes post-mortem, traces stolen funds to a specific wallet, publishes recovery address (0x0A66f2D0c603A6E9C23b64Ea29525B7E6F5609B8), and opens Blockscan Chat communication. Protocol offers bounty and immunity from legal action in exchange for fund return.

Crypto Economy; CryptoTimes

14 September 2026

White-hat deadline of 12:00 UTC passes. Zentra Finance had stated it would pursue on-chain forensic tracking, technical coordination, and legal action if the attacker did not respond. No public confirmation of a response from the attacker has appeared in available sources as of September 22, 2026.

CryptoTimes; Crypto Economy
Provenance & Audit Trail
Recorded on Solana ✓Verify on-chain9 Wayback Archives

Decision Log

  • #3review revise-4Recorded on Solana ✓10/28/2026, 12:48:38 AM
    slot 462279321 · hash G1PeFGx1f1aeAXZMoPVZhFwSJEbW5E6RNZREGcz5Tm3U
  • #2reviewRecorded on Solana ✓10/28/2026, 12:48:38 AM
    slot 462279314 · hash 7pyxhgQhxDb86vPEijGb3xvRmMGXoGQrtBwL4QwXN5gy
  • #1publishRecorded on Solana ✓9/22/2026, 5:10:23 PM
    slot 449442292 · hash 9gaSauRxzgkhFqEueA1GTwGL5B3yrujMsqa7svYn4kpi

This investigation is cryptographically anchored to the Solana blockchain (3 decisions). 9 of 10 cited source URLs have an Internet Archive snapshot.

Fact-checked 2026-10-2811 claims checked2 corrections pending0 applied⛓ anchoredSee findings →
full audit log →version history →

model: claude-sonnet-4-6

generated: 9/22/2026, 5:09:26 PM

last updated: 10/28/2026, 12:48:38 AM

8 views

avoid.net — verified advice for a post-truth world