ZentraFinance exploit analysis

Zentra Finance's lending pool on Citrea Mainnet lost ~140,000 ctUSD and 30 USDC.e on 2026-09-09, around $143K in total (attack transaction, block 12428145). DeFiHackLabs reconstructs the drain on a Citrea fork at the parent block.

Zentra's lending core is a fork of Aave V3 Core v3.0.x. The loss came from a boundary in Zentra's OWN aToken accounting, not the March-2026 upstream Aave rounding bug. Pool.repayWithATokens lets the pool mark a debt fully repaid while the underlying aToken.burn happens on a smaller amount than required. When the caller holds ZERO aTokens, the burn silently reduces all the way to zero through a safeguard that clamps the amount to the caller's balance, clearing the debt while destroying nothing on the protocol's side. The bookkeeping therefore credits the caller with a repaid debt they never actually extinguished.

DeFiHackLabs records the loss as ~140,000 ctUSD plus 30 USDC.e, and the on-chain actors all read live from the fork: attacker EOA 0xA73d72d6A858Df742fe756dA5Cb61C2288A95C17, exploit contract 0x8d85840F4c05a5D7385498F2a75daa54c6507b4b.

The fix is to revert burn on underflow when the caller holds fewer aTokens than required, instead of clamping to zero.