QUADRIGA INITIATIVE
CRYPTO WATCHDOG & FRAUD RECOVERY PLATFORM
A COMMUNITY-BASED, NOT-FOR-PROFIT
$330 000 USD
JUNE 2021
GLOBAL
MERLIN LABS
DESCRIPTION OF EVENTS
"Merlin Lab is the highest APY auto-compounding yield aggregator on BSC." Merlin is a way to "Auto-compound & Earn BTCB, ETH, BNB & extra MERL." "Merlin Lab’s vision is to create a suite of complementary DeFi products that will operate in a harmonious ecosystem."
"User security has always been Merlin Lab’s top priority." "It has been always a top priority and it is for the simple reason that without security the platform can't be run." "Our development team has implemented routine checks of our smart contracts and codes to continuously bring improved security standards into the Merlin ecosystem." "Merlin Labs was audited by Hacken on May 15th." "According to the assessment, the Customer's smart contracts are well-secured." "Our team performed an analysis of code functionality, manual audit, and automated checks with Mythril and Slither."
"On June 29, 2021 Merlin profit inflation vulnerability was exploited which resulted in the loss of $330K."
"The third time’s a charm for Merlin Finance. Why do people keep going back?"
"A total of $330k was stolen, bringing their TVL (total value lost) to $1,560,000, and putting them on par with Value DeFi as one of the few protocols to be so unsafe that they have three positions onto the rekt leaderboard."
"Thank you for your patience. It has been identified that this was an economic exploit."
"The Merlin Dev team had deployed the Alpaca single asset vaults onto the Mainnet for testing this morning. This vault was not supposed to be publicly available or ready to launch to the public."
"Via the smart contract, a hacker deposited 0.1WBNB into the vault and then manually transferred 1000BNB into the contract to trick the contract into thinking it has received 1000BNB in rewards, which resulted in the minter producing MERL rewards."
"Merlin's reward system gave users Merlin tokens for every $ in performance fees they brought in. It was rewarding 35 MERL (~$500 at the time) for every BNB (worth ~$300). When calculating the profit of the strategy, it converted the received BNB to WBNB. The increase in WBNB balance was then seen as the profit. By sending BNB to the contract directly, it is also converted to WBNB and considered "profit". By depositing BNB in the contract, the attacker could harvest and all that BNB would be assumed to be rewardable profit. Straight to ETH, then Tornado and it’s gone."
"Merlin is officially closed."
The newly deployed (and not yet intended to be public) Merlin Labs smart contract allowed the attacker to profit a higher value in MERL by sending a smaller amount of BNB. This was obviously a good deal, and the attacker took full advantage of it before mixing their funds on Tornado.
As a result, Merlin Labs closed, and it appears that anyone who lost funds in this or previous exploits is out of luck.
HOW COULD THIS HAVE BEEN PREVENTED?
It is impossible to prove that smart contracts are completely secure, and they should be treated in a similar manner to hot wallets. The majority of funds should be stored in multi-signature wallets with offline keys.
Smart contract hot wallets can improve security through third party security auditing, or providing a bug bounty. Keep funds in the hot wallet minimal and expect losses. Smart contract insurance, setting up a self insurance treasury, or an industry insurance fund may also be possible, which could allow for greater live liquidity.
No Title (Jul 24)
@peckshield Twitter (Jul 24)
Rekt - Merlin Labs - R3KT (Jul 24)
Reddit - Dive into anything (Jul 24)
Merlinlab flash loans and Upgraded Security Strategy (Jul 24)
Reddit - Dive into anything (Jul 24)
VIking Swap Audit - Hacken (Jun 13)
blocksec-incidents/2021.md at main · openblocksec/blocksec-incidents · GitHub (Aug 11)
Address 0x2bADa393e53D0373788d15fD98CB5Fb1441645BD | BscScan (Aug 29)
v (Feb 8)
Rekt - Merlin Labs - R3KT (Feb 8)
https://www.blockthreat.io/p/blockthreat-week-26-2021 (Feb 8)
