Solend Hack
What happened
On August 19, 2021, an attacker exploited a missing account-relationship check in Solend's reserve-configuration instruction. After supplying an attacker-controlled lending-market account, they altered risk settings for several reserves, which made healthy borrower positions liquidatable. Solend stopped the attempt; five positions were wrongfully liquidated and later fully refunded.
process_update_reserve_config authenticated the supplied lending-market account but did not verify that it was the market recorded in the target reserve. An attacker could provide a separately created market under their control and satisfy the incomplete authorization path. The patch added an equality check rejecting a reserve whose bound market differs from the supplied market.
How it happened
- The attacker created a lending market they controlled, then invoked UpdateReserveConfig against Solend reserves while passing that market account.
- They lowered liquidation thresholds, raised liquidation bonuses, and set the minimum borrow rate to 250% for USDC, SOL, ETH, and BTC.
- Those changes could have enabled profitable wrongful liquidations; the team halted the incident before an attacker theft occurred.
Protocol details
Funds Recovery
Recovered
$16K
Net Loss
$0
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
