What happened
On August 19, 2021, an attacker exploited a missing account-relationship check in Solend's reserve-configuration instruction. After supplying an attacker-controlled lending-market account, they altered risk settings for several reserves, which made healthy borrower positions liquidatable. Solend stopped the attempt; five positions were wrongfully liquidated and later fully refunded.
process_update_reserve_config authenticated the supplied lending-market account but did not verify that it was the market recorded in the target reserve. An attacker could provide a separately created market under their control and satisfy the incomplete authorization path. The patch added an equality check rejecting a reserve whose bound market differs from the supplied market.
Case & protocol details
Attack Timeline
The attacker created a lending market they controlled, then invoked UpdateReserveConfig against Solend reserves while passing that market account. They lowered liquidation thresholds, raised liquidation bonuses, and set the minimum borrow rate to 250% for USDC, SOL, ETH, and BTC. Those changes could have enabled profitable wrongful liquidations; the team halted the incident before an attacker theft occurred.
Funds Recovery
Recovered
$16K
Net Loss
$0
Evidence & learning
Attack pattern
Compare incidents →Sources and on-chain records
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.