EraLend was a lending and borrowing protocol built for zkSync Era. It accepted crypto assets as deposits and collateral, then let users borrow within protocol-set limits. On July 25, 2023, it suffered a read-only reentrancy exploit; security analysts estimated losses at about $3.4 million. Current evidence does not support treating old claims of a successful restart as its present operating status.
How a Money Market Works
In an over-collateralized money market, suppliers place assets in lending pools and borrowers pledge collateral before borrowing. Borrow limits depend on collateral value and risk parameters. Falling collateral value or growing debt can make a position eligible for liquidation. This design depends on accurate price data and careful contract accounting.
The 2023 Exploit
Incident analyses describe an attack involving SyncSwap pool pricing and EraLend’s collateral valuation. During a transaction callback, the pool could be observed in a temporary state; the distorted valuation let the attacker borrow more than the collateral justified. “Read-only” describes how inconsistent state was read, not a harmless attack. The incident showed how one protocol’s accounting can depend on another contract’s moment-to-moment state.
What the Incident Shows
The reported weakness concerned how the lending protocol read and used pool values, not a defect attributed to zkSync itself. Protocols that accept LP tokens as collateral need robust oracles, safe callback handling, and clear accounting invariants. Audits reduce risk but cannot establish that a system is risk-free.
EraLend’s public homepage currently provides no usable product documentation, so this entry treats it as historical and does not claim that markets are live or users were fully compensated.
Social Media Sentiment
A small r/ethtrader thread from July 2023 discussed the reported exploit and its read-only reentrancy label. It records reactions to one incident; it is not evidence of broader or current sentiment.
Last updated: 2026-10
Related Terms
See Also
- Why Smart Contract Audits Fail: What Post-Mortems Reveal About the Limits of Security Reviews
- What the Celsius Collapse Actually Tells Us About Crypto Lending Risk
- Are Layer 2 Networks Actually Decentralized?
Sources
- The Block: EraLend exploit report — The July 25, 2023 report summarizes the estimated loss and read-only reentrancy incident.
- Beosin: EraLend incident analysis — This security analysis describes the transactions, target contract, and reported collateral-pricing weakness.
- r/ethtrader discussion, July 2023 — This public thread discussed the exploit report when it appeared; it is a small, dated sample.