Keom.io lending protocol on Polygon ZKEVM exploited for $94k via logic error in token redemption allowing full market drain.
Security & Exploits ·
Keom.io, a lending protocol operating on Polygon ZKEVM, was exploited for approximately $94,000 due to a logic flaw in its token redemption function. The vulnerability in KToken.redeemFresh() at lines 992–993 allowed an attacker to circumvent balance checks by minting a minimal amount of cTokens, then draining the market's full cash reserves through redeemUnderlying() calls. The attacker's address and transaction have been documented on chain.
The flaw operates by capping redeemTokens to a user's cToken balance after computing totalSupplyNew using an uncapped value, but failing to recalculate the corresponding redeemAmount. This disconnect enabled the attacker to extract funds well beyond what their actual token holdings should have permitted, effectively draining liquidity from affected markets.
No statement from the Keom.io team or details on remediation steps have yet been disclosed. The full scope of affected markets and whether recovery mechanisms are in place remain unclear.