zkLend Precision Rounding

On February 12, 2025, the Starknet-based lending protocol zkLend was drained of approximately $9.5 million through a precision/rounding bug in its safeMath library. The attacker iterated a small rounding bias until it compounded into a fully synthetic balance large enough to drain every pool. zkLend never recovered and shut down operations in June 2025.

What happened

Starknet's Cairo language does not natively express floating-point arithmetic; protocols implement their own fixed-point math libraries. zkLend's safeMath performed direct division that rounded down on every operation. Used once, the rounding loss is invisible. Repeated thousands of times against the right state-update pattern, it became compoundable into a usable exploit.

The attack iterated a calculation that touched a raw_balance field used internally for accounting. Each iteration's rounding caused the field to drift upward by tiny increments. After enough iterations, the attacker's raw_balance had been artificially inflated to 1724 — far above any legitimate deposit.

The redemption function then converted the inflated raw_balance into a withdrawal claim against zkLend's pools. Every pool was drained by the redemption.

Aftermath

• zkLend offered the attacker a 10% bounty and release from liability if the remaining 3,300 ETH was returned within 48 hours. Deadline passed.
• The attacker bridged stolen funds to Ethereum and attempted to launder through Railgun — Railgun's protocol policies automatically returned the funds to the originating address, briefly trapping the attacker. They eventually moved the funds through Tornado Cash and other routes.
• zkLend never reopened lending operations. The protocol formally shut down in June 2025, four months after the exploit.

Why it matters

zkLend reinforced two lessons that recur in DeFi exploit history:

1. Fixed-point math libraries written from scratch for new VMs are a frontier vulnerability surface. The same class of bug appeared in Cetus on Sui later in 2025, and in KyberSwap on EVM in 2023. New chains tend to ship new math libraries that have not been hardened against the full attack surface of their EVM predecessors.

2. A single mid-size exploit can be terminal for a protocol. Where larger protocols absorb $10–20M losses through governance-mediated reimbursement and keep operating, mid-size protocols often cannot. The cost of a single bug is not just the loss — it is the protocol's continued existence.