Blockchain security firm CertiK has reported that lending app Era Lend on zkSync has been exploited for $3.4 million worth of crypto using a "read-only reentrancy attack". The attacker used a vulnerability in the "callback and _updateReserves function" to manipulate a contract into reporting old values that had not yet been updated. Other projects based on Syncswap may also be vulnerable to the exploit. The Era Lend team has acknowledged the attack and paused the protocol's zkSync contracts to prevent further exploits.