Zentra Finance Hack

Reported loss $140K
Citrea
Rounding Error

What happened

On September 9, 2026, an attacker drained about 140,000 ctUSD and 30 USDC.e from Zentra Finance, a native money market on Citrea built as a fork of Aave V3 Core. Zentra estimated the loss at about $143,000. The bug was in Zentra's own aToken burn code. A safety clamp that capped the burn at the caller's balance let repayWithATokens mark a debt as fully repaid while burning nothing when the caller held no aTokens.

In a single transaction (0x9ac5df7e...3074aa1), the attacker borrowed against flash-loaned collateral, cleared the debt for free, and withdrew the collateral. It then swapped the ctUSD for about 139,940 USDC.e and sent the funds to a bridge. Zentra's operations multisig paused all four reserves, revenue distribution and superstaking at 13:16:27 UTC, about 17 minutes after the exploit. Citrea temporarily paused cross-chain routes as a precaution, then restored them after saying its own protocol and bridge contracts were not in the exploit path.

Zentra asked the holder of the funds to return them and offered a negotiable bounty, with a September 14, 2026 deadline. Lending markets stayed suspended.

How it happened

  1. The attacker flash-borrowed 200,000 USDC.e from an Algebra DEX pool and supplied it to Zentra as collateral.
  2. It borrowed 140,000 ctUSD against that collateral.
  3. It called repayWithATokens(ctUSD, debt + 1) while holding zero zctUSD aTokens. The Pool burned the full variable debt. The aToken's _burnScaled clamped the burn to the caller's scaled balance, which was zero, so nothing was burned and the call did not revert.
  4. With its debt at zero, the attacker withdrew the full 200,000 USDC.e collateral. It repeated the trick on a small scale to take 30 USDC.e.
  5. It repaid the flash loan plus its 20 USDC.e fee, kept about 140,000 ctUSD, swapped it for USDC.e and bridged it out.

Protocol details

Classification Token & Share Accounting
Protocol Type Lending
Implementation language Solidity
Protocol links Website @ZentraFinance

Evidence

Same attack technique

Browse all hacks →
Ethereum Balancer V1 $234K lost Ethereum WiseLending $260K lost BNB Chain AES $62K lost BNB Chain Wiener DOGE $30K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes