After EraLend was hacked, the victims and I "digged the pool" to save ourselves

On the evening of July 25, EraLend, the lending protocol with the highest TVL on zkSync, was suddenly hacked.

According to the announcement issued by EraLend afterwards, the reason for this attack was that the hacker manipulated the price of the oracle machine and obtained about 2.76 million US dollars of funds from EraLend's USDC pool, while other fund pools were not affected.

After the incident, in order to curb further impact, EraLend has temporarily stopped the borrowing (Borrow) of all pools, as well as the deposit function of USDC pool and SyncSwap LP pool.

![After EraLend was hacked, the victims and I "digged the pool" to save ourselves] (https://img-cdn.gateio.im/resized-social/moments-7f230462a9-2a8e50aea5-dd1a6f-7649e1)

Since I am keen on plucking hair, I will always actively interact with new projects of major new ecology. Naturally, the more popular projects such as EraLend whose data scale is at the forefront of the ecology will not miss it.

Unfortunately, I happened to have 1,000 USDC stored in EraLend's USDC pool, so I was "lucky" to be a direct victim of this incident.

On July 26th, when I opened the main interface of EraLend and saw that the size of the USDC pool had almost returned to 0, and the withdrawal seemed hopeless, I could only sigh "It's really bad luck".

Out of the mentality of seeing where the situation is going, I opened the official Discord interface of EraLend, and after browsing the announcement channel with no progress, I opened the Chinese channel to see if there were any similar victims.

After entering this channel, I found that although some fellow sufferers were intermittently inquiring about the current situation, more of the bigwigs in the Chinese area were actively exchanging about another matter - "digging the pool".

Like enlightenment, I instantly realized that things seemed to be turning around!

The so-called "digging the pool" refers to actively watching the specific scale changes of the USDC pool to see if there is any new capital inflow, and then trying to slowly withdraw your deposits from the pool by initiating one transaction after another. To "pick" back.

So why can the USDC pool, which has been wiped out by hackers and has suspended deposits, continue to have capital inflows?

The answer is that only USDC was damaged in EraLend’s hacking incident this time, and the ETH and SyncSwap LP pools were not affected. Out of concerns about the security of the project, some of them had assets in these two pools and borrowed them as collateral. If users who have withdrawn USDC want to get back their funds (ETH or SyncSwap LP tokens), they need to repay the USDC debt first. This makes the USDC pool continue to have debt funds flowing back, and it also gives victims the opportunity to "catch" their funds back.

Of course, since each debt repayment can only return an indefinite amount of USDC, and the number of victims staring at the pool hoping to return their blood is large, there will inevitably be fierce competition. In this case, the most powerful competitors are naturally the scientists who have deployed robots, but perhaps the L2 project itself has limited popularity (it is more likely that scientists who can see the code generally do not suffer such bloody luck), and many users are It means that manual "digging" can actually have a high chance of success.

When I entered the channel, there happened to be a few bigwigs who said how much money they had "spent", especially the ruthless person below who "spent" 1,000 USDC all night. Since the amount of funds happened to be the same, his statement gave It made me determined to do a big job.

So from 2 o'clock this afternoon, I also started to try to "dig out" the pool.

After trying to initiate a withdrawal request on the front end of EraLend several times but showing an error, I finally submitted the first transaction when the balance in the pool was around $4, but unfortunately it was not confirmed on the chain. After asking the bigwigs in the community, I learned that this is also a normal situation. After all, everyone is robbing these funds. Although there will be a certain amount of gas loss when the transaction fails, this part of the loss is nothing compared to getting back the funds. Nothing serious.

So I continued to try, and slowly found that about 1 out of every 2-3 withdrawal requests can avoid the error prompt to successfully initiate a transaction, and thereafter about every 2-3 transactions can be successfully confirmed (also appear In the case of n consecutive failures, this is just the overall probability), and then complete the withdrawal of sporadic funds.

As for the amount you can get for each successful withdrawal, it is basically only 1-3 US dollars in most cases.

![After EraLend was hacked, the victims and I "digged the pool" to save ourselves] (https://img-cdn.gateio.im/resized-social/moments-7f230462a9-20029c9c7e-dd1a6f-7649e1)

However, if you happen to meet a "living Bodhisattva" with a large amount of repayment, you may also have the opportunity to "cash out" a large sum. In my own case, the highest "cash out" was 301 USDC at one time, which is a big deal. Speeded up my overall progress.

![After EraLend was hacked, the victims and I "digged the pool" to save ourselves] (https://img-cdn.gateio.im/resized-social/moments-7f230462a9-a5e427c2cc-dd1a6f-7649e1)

This kind of completely random result feedback wonderfully gave me a different kind of stimulation. Of course, I am not the only one who thinks this way. Some people joked in the community, "I even think it's very fun. Take out a big Noh half an hour".

More users are joking and cheering each other up, saying with a smile that "this is better than food delivery."

All in all, as more people continue to "cash" their funds back, there doesn't seem to be much repression in the community over the hack.

Finally, at around 5:00 p.m., I "pick up" the last transaction of about 4 dollars, and successfully got back the 1,000 USDC that I thought I would never get back again. The whole process took about 3 disappearances.

On the whole, I probably used less than a hundred transactions (including the failed ones). Considering that EraLend’s successful withdrawal transactions will have a certain gas return, the gas consumption of each transaction is about 0.4 US dollars. That is to say, the whole consumption cost about 40 US dollars, which is completely cost-effective.

As of the publication, there are still many users who are continuing to "cash out" and try to get back their funds stored in EraLend, but it is foreseeable that as more users participate and the debt scale continues to shrink (that is, the USDC pool The total amount of funds that can be returned continues to decrease), the later the time, the lower the possibility of "drawing out" the funds.

It is difficult for you to judge whether this matter is right or wrong. From the perspective of the operation of the agreement, some victims fled first by "digging the pool", transferring the risk of bad debts caused by the hacking incident to the agreement itself and other users who have not fled. However, judging from the current situation of EraLend, As the TVL continues to shrink (mainly because users of the other two pools will continue to withdraw funds), the agreement is even facing the potential for insolvency. Catastrophe may be imminent. At this time, the victims have an opportunity to recover their losses, so they will naturally not miss it.

Anyway, I ran first as a respect.