Zentra Finance

Zentra’s Aave V3-based lending implementation contained a boundary-condition accounting flaw in repayWithATokens. The attacker borrowed assets and requested repayment of the outstanding debt plus exactly one base unit.

The debt-token path’s ceil-rounding cleared the debt in full, while the aToken burn path’s rounding safeguard reduced the required burn to the caller’s available aToken balance. Because the attacker held no corresponding aTokens, the burn was reduced to zero.

The Pool therefore recorded the debt as repaid without receiving equivalent value, allowing the attacker to withdraw the original flash-funded collateral while retaining the borrowed reserve assets. e.