$330 000 USD

JUNE 2021




"Merlin Lab is the highest APY auto-compounding yield aggregator on BSC." Merlin is a way to "Auto-compound & Earn BTCB, ETH, BNB & extra MERL." "Merlin Lab’s vision is to create a suite of complementary DeFi products that will operate in a harmonious ecosystem."


"User security has always been Merlin Lab’s top priority." "It has been always a top priority and it is for the simple reason that without security the platform can't be run." "Our development team has implemented routine checks of our smart contracts and codes to continuously bring improved security standards into the Merlin ecosystem." "Merlin Labs was audited by Hacken on May 15th." "According to the assessment, the Customer's smart contracts are well-secured." "Our team performed an analysis of code functionality, manual audit, and automated checks with Mythril and Slither."


"On June 29, 2021 Merlin profit inflation vulnerability was exploited which resulted in the loss of $330K."


"The third time’s a charm for Merlin Finance. Why do people keep going back?"


"A total of $330k was stolen, bringing their TVL (total value lost) to $1,560,000, and putting them on par with Value DeFi as one of the few protocols to be so unsafe that they have three positions onto the rekt leaderboard."


"Thank you for your patience. It has been identified that this was an economic exploit."


"The Merlin Dev team had deployed the Alpaca single asset vaults onto the Mainnet for testing this morning. This vault was not supposed to be publicly available or ready to launch to the public."


"Via the smart contract, a hacker deposited 0.1WBNB into the vault and then manually transferred 1000BNB into the contract to trick the contract into thinking it has received 1000BNB in rewards, which resulted in the minter producing MERL rewards."


"Merlin's reward system gave users Merlin tokens for every $ in performance fees they brought in. It was rewarding 35 MERL (~$500 at the time) for every BNB (worth ~$300). When calculating the profit of the strategy, it converted the received BNB to WBNB. The increase in WBNB balance was then seen as the profit. By sending BNB to the contract directly, it is also converted to WBNB and considered "profit". By depositing BNB in the contract, the attacker could harvest and all that BNB would be assumed to be rewardable profit. Straight to ETH, then Tornado and it’s gone."


"Merlin is officially closed."

The newly deployed (and not yet intended to be public) Merlin Labs smart contract allowed the attacker to profit a higher value in MERL by sending a smaller amount of BNB. This was obviously a good deal, and the attacker took full advantage of it before mixing their funds on Tornado.


As a result, Merlin Labs closed, and it appears that anyone who lost funds in this or previous exploits is out of luck.


It is impossible to prove that smart contracts are completely secure, and they should be treated in a similar manner to hot wallets. The majority of funds should be stored in multi-signature wallets with offline keys.


Smart contract hot wallets can improve security through third party security auditing, or providing a bug bounty. Keep funds in the hot wallet minimal and expect losses. Smart contract insurance, setting up a self insurance treasury, or an industry insurance fund may also be possible, which could allow for greater live liquidity.


Check Our Framework For Safe Secure Exchange Platforms

Sources And Further Reading

 For questions or enquiries, email info@quadrigainitiative.com.

Get Social

  • email
  • reddit
  • telegram
  • Twitter

© 2021 Quadriga Initiative. Your use of this site/service accepts the Terms of Use and Privacy Policy. This site is not associated with Ernst & Young, Miller Thompson, or the Official Committee of Affected Users. Hosted in Canada by HosterBox.