Blockchain security firm CertiK is launching a compensation plan with Ethereum layer-2 scaling platform zkSync Era to cover the $2 million lost during a public sale of decentralized exchange Merlinโs MAGE tokens.
In a statement to Cointelegraph on April 26, CertiK reiterated it is investigating the exit scam and has also enlisted the remaining Merlin team to initiate the compensation plan. It said:
โInitial investigations indicate that the rogue developers are based in Europe, and CertiK will collaborate with law enforcement authorities to track them down if direct negotiation is unsuccessful.โ
The blockchain security company is urging the rogue developer to return 80% of the stolen funds, conceding 20% as a white hat bounty.
The firm also pointed out that private key privileges are โcommitted to assisting impacted usersโ despite them being outside the scope of a smart contract audit.
Merlin lost about $850,000 worth of USD Coin (USDC) and some more relatively illiquid tokens on April 26 during its three-day MAGE tokens public sale without any hard cap. Blockchain data suggests that an exploiter with control over the liquidity pool was able to easily siphon the funds.
We did some research on Merlin smart contracts and we identified the malicious code responsible for the draining of funds.
These two lines of code in the initialize function are essentially granting approval for the feeTo address to transfer an unlimited (type(uint256).max)โฆ pic.twitter.com/mIksh4HkhB
โ eZKalibur โ (@zkaliburDEX) April 26, 2023
CertiK, which audited Merlinโs code, responded with its initial findings pointing to a โpotential private key management issue.โ
Weโre actively investigating the @TheMerlinDEX incident. Initial findings point to a potential private key management issue rather than an exploit as the root-cause.
While audits cannot prevent private key issues, we always highlight best practices to projects.
Should any foulโฆ
โ CertiK (@CertiK) April 26, 2023
Crypto Twitter questioned the CertiK audit, implying that there might be a rug pull.
Verichains founder Thanh Nguyen alluded to a โbackdoorโ present in Merlinโs code, saying it is a โclear security risk as there is no use case that requires its approval.โ
3/4 However, in the Merlin code, there is a โbackdoorโ code (L87-88) that allows the feeTo of MerlinFactory to transfer all assets in the pair, in addition to the fee in the swap function. This backdoor is a clear security risk as there is no use case that requires its approval. pic.twitter.com/HAnwZT27ZS
โ Thanh Nguyen (@redragonvn) April 26, 2023
โWhile audits can identify potential risks and vulnerabilities, they cannot prevent malicious activities on the part of rogue developers such as rug pulls,โ CertiK in a statement to Cointelegraph. โWe encourage users to look for projects with a โKYC Badgeโ as an added layer of security, signifying that the project has voluntarily gone through a KYC vetting process.โ
Related: Ordinals Finance has conducted a $1M rug pull: CertiK
The firm explained that doing so can help reduce and mitigate the risk of insider threats such as rug pulls.
CertiK said it would continue providing updates on its compensation plan and ongoing investigation.
