← Zentra Finance ctUSD Aave-Fork Exploitreviewed 2026-10-28 · 11 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Zentra Finance ctUSD Aave-Fork Exploit against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
2 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #1[disputed][awaiting moderator]in section: Protocol Response and White-Hat Deadline
“On September 11, 2026, Zentra Finance published a post-mortem identifying the exploit mechanism and tracing the extracted funds to a specific wallet.”
reviewerZentra published a post-mortem on September 11 identifying the exploit mechanismThe cited article states no attack-vector details had been published. The mechanism on the page comes from DeFiHackLabs, not a Zentra post-mortem.Proposed correction (not yet applied)On September 11, 2026, Zentra Finance reported that it had identified the wallet that received the extracted funds. - #2[disputed][awaiting moderator]in the timeline
“Zentra Finance publishes post-mortem, traces stolen funds to a specific wallet, publishes recovery address (0x0A66f2D0c603A6E9C23b64Ea29525B7E6F5609B8), and opens Blockscan Chat communication.”
reviewerTimeline: Zentra published a post-mortem on 2026-09-11Same error as the section text. Wallet identification, recovery address and bounty are supported. I did not verify the Blockscan Chat detail.Proposed correction (not yet applied)Zentra Finance reports it has identified the wallet that received the stolen funds, publishes recovery address (0x0A66f2D0c603A6E9C23b64Ea29525B7E6F5609B8), and opens Blockscan Chat communication.
unverifiable
1 claimNo source the reviewer could reach confirms or contradicts the claim.
- #7[unverifiable][awaiting moderator]in section: Security Audit and Fork Risk
“One search result indicated the vulnerability was introduced during a code refactoring in June 2023 and reportedly bypassed an external security audit, though the auditing firm's identity and findings have not been independently confirmed in primary-source audit reports found during this investigation.”
reviewerBug introduced in June 2023 refactor and bypassed an external auditThe cited PR does not mention it. The page hedges, but an unattributed 'one search result' claim about a named project is weak and should be removed or sourced.
partially supported
2 claimsThe cited evidence supports part of the claim but not all of it.
- #8[partially supported][awaiting moderator]in section: Protocol Response and White-Hat Deadline
“As of the current date (September 22, 2026), no public announcement confirming a response from the attacker or recovery of funds has appeared in available sources. The lending markets remain suspended, and no reopening date has been announced.”
reviewerLending markets remain suspended and no recovery reported as of the investigation dateLatest source I found is Sept 12 and I found no reopening report, so the claim is not contradicted. The Sept 22 dating is now about 5 weeks old. - #10[partially supported][awaiting moderator]in section: Citrea Network Response
“On September 10, Citrea restored cross-chain functionality for ctUSD, USDC, USDT, WBTC, and CTR following a comprehensive review.”
reviewerCitrea restored cross-chain services for listed assets on Sept 10 after suspending Sept 9Sept 10 restoration is supported. The Sept 9 suspension date and the 'comprehensive review' wording are not in the fetched sources.
confirmed
6 claimsThe cited evidence supports the claim as written.
- #3[confirmed][no action needed]in section: The Exploit: Technical Mechanism
“On September 9, 2026 at 12:59:37 UTC, an attacker exploited a boundary condition in Zentra's deployed aToken implementation, draining approximately 139,999.999999 ctUSD and 9.999999 USDC.e (net of flash loan fees), with total losses estimated at approximately $143,000.”
reviewerExploit at 12:59:37 UTC Sept 9, 2026, about $143,000 lostDefiLlama lists $140,030 as the loss, a minor variance consistent with the ctUSD-only figure. - #4[confirmed][no action needed]in section: The Exploit: Technical Mechanism
“The exploit transaction hash is 0x9ac5df7e93988cd977e4b1b0564f559ec3096db2fe1abdd97e45c348e3074aa1, confirmed at block 12,428,145 on Citrea.”
reviewerTx hash and block 12,428,145Block and abbreviated hash match. - #5[confirmed][no action needed]in section: The Exploit: Technical Mechanism
“Critically, Pool.repayWithATokens — which is declared public with no role checks or access modifiers — still records the full debt as repaid, even though no tokens were actually burned.”
reviewerMechanism: _burnScaled clamp to zero, repayWithATokens permissionless, attack flowThe PR's statement is that repayWithATokens is permissionless. The 'no role checks or access modifiers' wording is a reasonable restatement. The page does attribute this to the PoC contributor. - #6[confirmed][no action needed]in section: The Exploit: Technical Mechanism
“The DeFiHackLabs contributor explicitly noted that this is NOT the publicly-disclosed March 2026 upstream Aave V3 rounding vulnerability — it is a separate boundary condition introduced in Zentra's own deployed aToken implementation.”
reviewerNot the March 2026 upstream Aave V3 rounding vulnerabilityCorrectly attributed. - #9[confirmed][no action needed]in section: Protocol Response and White-Hat Deadline
“A deadline of September 14, 2026 at 12:00 UTC was set for the responsible party to respond.”
reviewerDeadline Sept 14, 2026 12:00 UTC, negotiable bounty, no legal proceedings if funds returnedSupported. - #11[confirmed][no action needed]in section: Scope of Impact: Zentra and the ctUSD Earn Vault
“Citrea stated it would 'separately disclose the impact of the incident on ecosystem projects such as ctUSD Earn Vault and depositors.'”
reviewerCitrea will separately disclose impact on ctUSD Earn Vault; no disclosure yetThe statement is supported. The sources do not say the vault 'was also affected' in dollar terms, but the page does not claim that either.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.