SlowMist: The core reason for the attack on zkLend is that the market contract uses the safeMath library

Odaily reported that the lending project zkLend on the Starknet chain was attacked today, resulting in the theft of over $9 million. Slowmist released an analysis on the X platform, stating that the core reason for this attack was the use of the safeMath library in the market contract. When performing division calculations, the use of direct division led to a rounding-down vulnerability in calculating the actual number of zTokens to be destroyed during withdrawal operations. The attacker may have exploited this vulnerability to illegally obtain profits. Slowmist reminds users to closely monitor the status of their assets on zkLend and temporarily suspend any related deposit activities to avoid potential losses.