Incident Overview
An attacker attempted to exploit the Solend smart contract. They subverted an insecure auth check on the UpdateReserveConfig() function to make accounts with borrows liquidatable and set the borrow APY to 250% for all markets. The attempt to steal funds was detected and stopped by the Solend team in time such that no funds were stolen. A handful of users (5) were liquidated by Solend's liquidator, but those users were refunded out of the liquidator's undue earnings (~16K USD).
The attacker's address:
https://explorer.solana.com/address/5ELHytHM4cvKUPCWX8HPwkwtw3J866Wtexdpo8PPxp2u
The attacker submitted a total of 10 txs: 9 of them to So1endDq2YkqhipRh3WViPa8hdiSpxWy6z3Z6tMCpAo (the Solend program address) and one of them to Port7uDYB3wk6GJAw4KT1WpTeMtSu9bTcChBHkX2LfR (the Port program address).
The attacker's wallet was funded by 2ojv9BAiHUrvsm9gxDe7fJSzbNZSJcxZvf8dqmWGHG8S which appears to be an exchange wallet.
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Solend, these are the critical security checks that could have prevented this incident (August 2021).
- Verify all logic paths related to Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialFunds Recovery
Recovered
$16K
Net Loss
0
Sources & References
Learn to Prevent the Next Solend
The Solend hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.