Merlin DEX Liquidity Pool Drained - Revision history

Azoundria at 22:36, 15 May 2024

2024-05-15T22:36:26Z

← Older revision		Revision as of 16:36, 15 May 2024
Line 1:		Line 1:
	{{Imported Case Study 2\|source=https://www.quadrigainitiative.com/casestudy/merlindexliquiditypooldrained.php}}[[File:Merlindex.jpg\|thumb\|Merlin DEX]]Merlin is a decentralized exchange (DEX) based on ZkSync and designed to support both volatile and stable exchanges with minimal fees and fast speed. The platform introduces dynamic directional fees that allow for various fees to be set for each pool and different fees based on the swap direction. Earnings from the protocol will be partially redistributed to stMAGE users and used to maintain a continuous buying pressure on MAGE. However, despite passing its second audit by Certik, Merlin suffered a rug pull during its Liquidity Generation Event, resulting in the loss of $1.8 million. The incident was caused by max approvals granted to the Feeto address upon deployment of the pools, which allowed the individuals in control to drain the pool of all assets and bridge them to ETH. Merlin's post-mortem places the blame on the back-end development team, and the rugged funds were bridged back to Ethereum, swapped for ETH, and transferred to other addresses.		{{Imported Case Study 2\|source=https://www.quadrigainitiative.com/casestudy/merlindexliquiditypooldrained.php}}[[File:Merlindex.jpg\|thumb\|Merlin DEX]]Merlin is a decentralized exchange (DEX) based on ZkSync and designed to support both volatile and stable exchanges with minimal fees and fast speed. The platform introduces dynamic directional fees that allow for various fees to be set for each pool and different fees based on the swap direction. Earnings from the protocol will be partially redistributed to stMAGE users and used to maintain a continuous buying pressure on MAGE. However, despite passing its second audit by Certik, Merlin suffered a rug pull during its Liquidity Generation Event, resulting in the loss of $1.8 million. The incident was caused by max approvals granted to the Feeto address upon deployment of the pools, which allowed the individuals in control to drain the pool of all assets and bridge them to ETH. Merlin's post-mortem places the blame on the back-end development team, and the rugged funds were bridged back to Ethereum, swapped for ETH, and transferred to other addresses.

			<ref name="unnamed-12515" />

	== About Merlin DEX ==		== About Merlin DEX ==
Line 217:		Line 219:
	<ref name="beosinalerttwitter-10746">[https://twitter.com/BeosinAlert/status/1651124285409460224 BeosinAlert - "@TheMerlinDEX Merlin Dex on ZkSync rugged with $1.8M." - Twitter] (May 3, 2023)</ref>		<ref name="beosinalerttwitter-10746">[https://twitter.com/BeosinAlert/status/1651124285409460224 BeosinAlert - "@TheMerlinDEX Merlin Dex on ZkSync rugged with $1.8M." - Twitter] (May 3, 2023)</ref>
	<ref name="wasgiventhatdaytwitter-10747">[https://twitter.com/wasgiventhatday/status/1651039576860000257 wasgiventhatday - "@circle 0xb72200739d557ce12b41876772e1e434af896644 has rugged @TheMerlinDEX of $147k . Can you please freeze his USDC on main net?" - Twitter] (May 3, 2023)</ref>		<ref name="wasgiventhatdaytwitter-10747">[https://twitter.com/wasgiventhatday/status/1651039576860000257 wasgiventhatday - "@circle 0xb72200739d557ce12b41876772e1e434af896644 has rugged @TheMerlinDEX of $147k . Can you please freeze his USDC on main net?" - Twitter] (May 3, 2023)</ref>
			<ref name="unnamed-12515">[https://medium.com/@nelsonblue41/introduction-to-merlin-d489a40cf4d6 https://medium.com/@nelsonblue41/introduction-to-merlin-d489a40cf4d6] (Nov 30, 2023)</ref>
	</references>		</references>

Azoundria: Another 30 minutes complete.

2023-05-16T20:32:27Z

Another 30 minutes complete.

← Older revision		Revision as of 14:32, 16 May 2023
Line 5:		Line 5:

	Merlin had just recently passed its second audit by Certik<ref name=":1">[https://twitter.com/TheMerlinDEX/status/1650526832716836866 <nowiki>Merlin DEX - "We are pleased to inform that @CertiK has completed our audit of all of our contracts[. T]he entire report and audit score are available at [CertiK]." - Twitter</nowiki>] (May 9, 2023)</ref> and was in the middle of a 3-day “Liquidity Generation Event” as part of its token (MAGE) launch<ref name="rektnews-10738" />.		Merlin had just recently passed its second audit by Certik<ref name=":1">[https://twitter.com/TheMerlinDEX/status/1650526832716836866 <nowiki>Merlin DEX - "We are pleased to inform that @CertiK has completed our audit of all of our contracts[. T]he entire report and audit score are available at [CertiK]." - Twitter</nowiki>] (May 9, 2023)</ref> and was in the middle of a 3-day “Liquidity Generation Event” as part of its token (MAGE) launch<ref name="rektnews-10738" />.

			== About Merlin DEX Developers ==
			The reported backend development team of Merlin DEX consisted of three different developers, which were reportedly all individuals from Serbia.

			=== pos-ninja ===
			pos-ninja reports himself as a "BlockChain Engineer" and "Certified Blockchain Developer". As of the last time his profile was online, he had made "1,366 contributions in the last year"<ref>[https://web.archive.org/web/20230426175350/https://github.com/pos-ninja pos-ninja Profile - Github Archive April 26th, 2023 11:53:50 AM MDT] (May 16, 2023)</ref>. It appears that at some point prior to May 14th, his Github profile was deleted<ref>[https://web.archive.org/web/20230514061654/https://github.com/pos-ninja pos-ninja Page Not Found - Github Archive May 14th, 2023 12:16:54 AM MDT] (May 16, 2023)</ref>.

			=== OneDev0411 ===
			OneDev0411 describes himself as a "Full Stack Web Engineer"<ref>https://github.com/OneDev0411 (May 16, 2023)</ref>. He put together an impressive 7,116 contributions through Github in 2022<ref>https://web.archive.org/web/20230516203033/https://github.com/OneDev0411?tab=overview&from=2022-12-01&to=2022-12-31 (May 16, 2023)</ref>.

			=== DotNetStar82 ===
			DotNetStar82 describes himself as "A Full-stack .Net & Blockchain Developer". He is "ready to start your project anytime" with an extensive list of skills advertised on his Github<ref>https://github.com/dotnetstar82 (May 16, 2023)</ref>.<blockquote>
			=== About Me ===

			* Like to make a development document with developing content to use that in the future.
			* Delivering perfect results at any time.
			* Keeping good communication and work on the client's time zone.
			* Ability for working with any team and prefer to share much knowledge with many developers.
			* Looking for an opportunity to build a long-term relationship with great clients all over the world.
			</blockquote>

	== The Reality ==		== The Reality ==
Line 54:		Line 74:
	\|April 26th, 2023 11:47:00 AM MDT		\|April 26th, 2023 11:47:00 AM MDT
	\|MerlinDEX Releases Post-Mortem		\|MerlinDEX Releases Post-Mortem
	\|The Merlin DEX provides a post-mortem of the exploit on Twitter<ref name="themerlindextwitter-10744" />. They also announce that they have contacted the Serbian authorities<ref name=":0">[https://twitter.com/TheMerlinDEX/status/1651281825816248348 MerlinDEX - We have also notified relevant authorities in Serbia (Region of back-end Team) and work alongside on-chain analysts to monitor the movement of the stolen funds." - Twitter] (May 8, 2023)</ref>. TBD more details.		\|The Merlin DEX provides a post-mortem of the exploit on Twitter<ref name="themerlindextwitter-10744" />. They also announce that they have contacted the Serbian authorities<ref name=":0">[https://twitter.com/TheMerlinDEX/status/1651281825816248348 MerlinDEX - We have also notified relevant authorities in Serbia (Region of back-end Team) and work alongside on-chain analysts to monitor the movement of the stolen funds." - Twitter] (May 8, 2023)</ref>. TBD more details.<ref name=":5">[https://twitter.com/TheMerlinDEX/status/1651281831436615693 TheMerlinDEX - "We are deeply saddened by the actions of the technical team, whom we put a high degree of trust in. Merlin will continue to support our community and resolve the issue." - Twitter] (May 16, 2023)</ref>
	\|-		\|-
	\|April 27th, 2023 1:13:00 PM MDT		\|April 27th, 2023 1:13:00 PM MDT
Line 163:		Line 183:

	== Total Amount Recovered ==		== Total Amount Recovered ==
	~~"The rugged~~ funds were bridged back to Ethereum, swapped for ETH and transferred to other addresses."		It doesn't appear that any funds were recovered. It was reported that the funds were bridged back to Ethereum, swapped for ETH, and transferred to other addresses<ref name="rektnews-10738" />.

	~~There do not appear to have been any funds recovered in this case~~.

	~~What funds were recovered? What funds were reimbursed for those affected users?~~

	== Ongoing Developments ==		== Ongoing Developments ==
	"Merlin’s ~~own~~ post-mortem places the blame ~~squarely~~ on the back-end development team. The thread includes links to developers’ ~~github~~ profiles and states that Serbian authorities have been contacted."		Merlin’s post-mortem places the blame on the back-end development team. The thread includes links to developers’ Github profiles and states that Serbian authorities have been contacted. It's reported that the withdrawn funds were bridged back to Ethereum, swapped for ETH and transferred to other addresses<ref name="rektnews-10738" />.

	"~~The rugged funds were bridged back~~ to ~~Ethereum, swapped for ETH~~ and ~~transferred to other addresses~~."		Merlin released a statement describing how they plan to move forward<ref name=":5" />.<blockquote>We are deeply saddened by the actions of the technical team, whom we put a high degree of trust in. Merlin will continue to support our community and resolve the issue.</blockquote>

	~~TBD check if the funds have moved since.~~
	~~== General Prevention Policies ==~~
	~~Reliance on a single firm for auditing, and audit being done before the multi-sig was actually set up.~~
	== Individual Prevention Policies ==		== Individual Prevention Policies ==
	{{Prevention:~~Individuals~~:~~Placeholder~~}}		{{Prevention:Individual:Avoid Using Smart Contracts}}

	{{Prevention:Individuals:End}}		{{Prevention:Individuals:End}}

	== Platform Prevention Policies ==		== Platform Prevention Policies ==
	{{Prevention:Platforms:~~Placeholder~~}}		{{Prevention:Platforms:Regular Audit Procedures}}

	{{Prevention:Platforms:End}}		{{Prevention:Platforms:End}}

	== Regulatory Prevention Policies ==		== Regulatory Prevention Policies ==
	{{Prevention:Regulators:~~Placeholder~~}}		{{Prevention:Regulators:Platform Security Assessments}}

	{{Prevention:Regulators:End}}		{{Prevention:Regulators:End}}

Azoundria: 30 more minutes completed.

2023-05-09T19:01:30Z

30 more minutes completed.

@@ Line 2: / Line 2: @@
 == About Merlin DEX ==
-Merlin is a community-focused decentralized exchange (DEX) built on zkSync, a protocol for scalable and secure Ethereum transactions. The platform is designed to offer unique liquidity features, including an innovative yield strategy based on non-fungible staked positions that enhances capital efficiency. Merlin will use two tokens: MAGE, a liquid emission token, and stMAGE, an escrowed governance token that cannot be transferred, to incentivize participants in the ecosystem. Earnings from the protocol will be partially redistributed to stMAGE users in the form of yield and used to maintain a continuous buying pressure on MAGE. stMAGE will be allocated to special contracts known as Plugins, providing additional functionality to the protocol. The platform will have a dynamic automated market maker (AMM) capable of supporting both volatile and stable exchanges with various fees set for each pool and different fees based on the swap direction. Merlin aims to become a liquidity beacon in the zkSync ecosystem by surpassing existing DEX offerings and supporting new protocols launching on zkSync<ref name="mage-10739" /><ref name="merlindexmedium-10740" />.
+Merlin is a community-focused decentralized exchange (DEX) built on zkSync, a protocol for scalable and secure Ethereum transactions. The platform is designed to offer unique liquidity features, including an innovative yield strategy based on non-fungible staked positions that enhances capital efficiency. Merlin proposed to use two tokens: MAGE, a liquid emission token, and stMAGE, an escrowed governance token that cannot be transferred, to incentivize participants in the ecosystem. Earnings from the protocol would be partially redistributed to stMAGE users in the form of yield and used to maintain a continuous buying pressure on MAGE. stMAGE will be allocated to special contracts known as Plugins, providing additional functionality to the protocol. The platform promised a dynamic automated market maker (AMM) capable of supporting both volatile and stable exchanges with various fees set for each pool and different fees based on the swap direction. Merlin stated a goal of becoming a liquidity beacon in the zkSync ecosystem by surpassing existing DEX offerings and supporting new protocols launching on zkSync<ref name="mage-10739" /><ref name="merlindexmedium-10740" />.
-"Merlin had passed its second audit by Certik just two days before the attack."
+Merlin had just recently passed its second audit by Certik<ref name=":1">[https://twitter.com/TheMerlinDEX/status/1650526832716836866 <nowiki>Merlin DEX - "We are pleased to inform that @CertiK has completed our audit of all of our contracts[. T]he entire report and audit score are available at [CertiK]." - Twitter</nowiki>] (May 9, 2023)</ref> and was in the middle of a 3-day “Liquidity Generation Event” as part of its token (MAGE) launch<ref name="rektnews-10738" />.
 == The Reality ==
-Merlin's audit contained the following warning:<blockquote>"We advise the client to carefully manage the privileged account's private key to avoid any potential risks of being hacked. In general, we strongly recommend centralized privileges or roles in the protocol be improved via a decentralized mechanism or smart-contract-based accounts with enhanced security practices, e.g., multisignature wallets."</blockquote>However, this issue was marked as ‘Resolved’ by Certik, who stated that the Merlin team had promised to use a multisig. Enough users apparently didn’t read the audit fully, or simply didn’t care about the implications of trusting the project.
+Merlin's audit contained the following warning:<blockquote>"We advise the client to carefully manage the privileged account's private key to avoid any potential risks of being hacked. In general, we strongly recommend centralized privileges or roles in the protocol be improved via a decentralized mechanism or smart-contract-based accounts with enhanced security practices, e.g., multisignature wallets."</blockquote>However, this issue was marked as ‘Resolved’ by Certik, who stated that the Merlin team had promised to use a multisig. This information was only available inside the audit report itself, and many users likely didn't understand the implications of trusting the project.
 == What Happened ==
 The Merlin DEX drained their liquidity pool where users were depositing as part of the MAGE token sale<ref name="rektnews-10738" />.
@@ Line 17: / Line 15: @@
 !Event
 !Description
 |-
 |April 25th, 2023 5:58:00 PM MDT
@@ Line 45: / Line 59: @@
 |Rekt Publishes Article
 |The situation is published on Rekt<ref>[https://twitter.com/RektHQ/status/1651665786107224065 RektHQ - "$1.8M gone in a puff of smoke as @TheMerlinDEX pulled a classic DeFi magic trick. This is the first rekt we've covered on zksync, but far from the first to be audited by Certik..." - Twitter] (May 8, 2023)</ref>. TBD more description<ref name="rektnews-10738" />.
 |}
 == Technical Details ==
-"The rug mechanism was a straightforward case of draining the liquidity pools into which users were depositing as part of the MAGE token sale."<ref name="rektnews-10738" />
+This is not an advanced type of attack. The liquidity pool where users were depositing funds as part of the MAGE token sale was directly drained<ref name="rektnews-10738" />.
-"This was made possible via max approvals granted to the Feeto address upon deployment of the pools. The individual/s in control of the Feeto address could then drain the pool of all assets, which were then bridged to ETH."
+The individual(s) in control of the Feeto address could then drain the pool of all assets, which were then bridged to ETH<ref name="rektnews-10738" />.
 "Merlin’s own post-mortem places the blame squarely on the back-end development team. The thread includes links to developers’ github profiles and states that Serbian authorities have been contacted."

Azoundria: Another 30 minutes.

2023-05-08T22:57:04Z

Another 30 minutes.

Show changes

Azoundria: Initial 30 minutes. Still a lot to go.

2023-05-03T17:07:27Z

Initial 30 minutes. Still a lot to go.

← Older revision		Revision as of 11:07, 3 May 2023
Line 4:		Line 4:
	[[File:Merlindex.jpg\|thumb\|Merlin DEX]]Merlin is a decentralized exchange (DEX) based on ZkSync and designed to support both volatile and stable exchanges with minimal fees and fast speed. The platform introduces dynamic directional fees that allow for various fees to be set for each pool and different fees based on the swap direction. Earnings from the protocol will be partially redistributed to stMAGE users and used to maintain a continuous buying pressure on MAGE. However, despite passing its second audit by Certik, Merlin suffered a rug pull during its Liquidity Generation Event, resulting in the loss of $1.8 million. The incident was caused by max approvals granted to the Feeto address upon deployment of the pools, which allowed the individuals in control to drain the pool of all assets and bridge them to ETH. Merlin's post-mortem places the blame on the back-end development team, and the rugged funds were bridged back to Ethereum, swapped for ETH, and transferred to other addresses.		[[File:Merlindex.jpg\|thumb\|Merlin DEX]]Merlin is a decentralized exchange (DEX) based on ZkSync and designed to support both volatile and stable exchanges with minimal fees and fast speed. The platform introduces dynamic directional fees that allow for various fees to be set for each pool and different fees based on the swap direction. Earnings from the protocol will be partially redistributed to stMAGE users and used to maintain a continuous buying pressure on MAGE. However, despite passing its second audit by Certik, Merlin suffered a rug pull during its Liquidity Generation Event, resulting in the loss of $1.8 million. The incident was caused by max approvals granted to the Feeto address upon deployment of the pools, which allowed the individuals in control to drain the pool of all assets and bridge them to ETH. Merlin's post-mortem places the blame on the back-end development team, and the rugged funds were bridged back to Ethereum, swapped for ETH, and transferred to other addresses.

	This is a global/international case not involving a specific country.<ref name="rektnews-10738" /><ref name="mage-10739~~" /><ref name="merlindexmedium-10740~~" /><ref name="zksyncexplorer-10741" /><ref name="zksyncexplorer-10742" /><ref name="zksyncexplorer-10743" /><ref name="themerlindextwitter-10744" /><ref name="peckshieldalerttwitter-10745" /><ref name="beosinalerttwitter-10746~~" /><ref name="wasgiventhatdaytwitter-10747~~" />		This is a global/international case not involving a specific country.<ref name="rektnews-10738" /><ref name="mage-10739" /><ref name="zksyncexplorer-10741" /><ref name="zksyncexplorer-10742" /><ref name="zksyncexplorer-10743" /><ref name="themerlindextwitter-10744" /><ref name="peckshieldalerttwitter-10745" /><ref name="beosinalerttwitter-10746" />

	== About Merlin DEX ==		== About Merlin DEX ==
	"Merlin is ~~an immutable, permissionless,~~ community-focused DEX ~~based~~ on ~~ZkSync~~."		Merlin is a community-focused decentralized exchange (DEX) built on zkSync, a protocol for scalable and secure Ethereum transactions. The platform is designed to offer unique liquidity features, including an innovative yield strategy based on non-fungible staked positions that enhances capital efficiency. Merlin will use two tokens: MAGE, a liquid emission token, and stMAGE, an escrowed governance token that cannot be transferred, to incentivize participants in the ecosystem. Earnings from the protocol will be partially redistributed to stMAGE users in the form of yield and used to maintain a continuous buying pressure on MAGE. stMAGE will be allocated to special contracts known as Plugins, providing additional functionality to the protocol. The platform will have a dynamic automated market maker (AMM) capable of supporting both volatile and stable exchanges with various fees set for each pool and different fees based on the swap direction. Merlin aims to become a liquidity beacon in the zkSync ecosystem by surpassing existing DEX offerings and supporting new protocols launching on zkSync<ref name="merlindexmedium-10740" />.

	~~"Merlin~~ is based on a ~~dual AMM capable of supporting both volatile (UniV2)~~ and ~~stable (Curve-like) exchanges while minimizing fees and maximizing speed and dependability."~~

	~~"In addition~~, ~~we’re introducing dynamic directional fees for our trading pairs: this allows for various fees to~~ be ~~set for each pool~~, ~~as well as different fees based on the swap direction (buying/selling)."~~

	~~"These innovative AMM features enable us to offer pool configurations that are significantly more specialized and tailored~~ to the ~~particular trading pairs~~."

	"Earnings from the protocol~~, initially derived primarily from swap fees,~~ will be partially redistributed to stMAGE users in the form of ~~real~~ yield and used to maintain a continuous buying pressure on MAGE."

	"Merlin had passed its second audit by Certik just two days before the attack."		"Merlin had passed its second audit by Certik just two days before the attack."

	"We advise the client to carefully manage the privileged account's private key to avoid any potential risks of being hacked. In general, we strongly recommend centralized privileges or roles in the protocol be improved via a decentralized mechanism or smart-contract-based accounts with enhanced security practices, e.g., multisignature wallets."

	"However, this issue was marked as ‘Resolved’ by Certik, who stated that the Merlin team had promised to use a multisig. Enough users apparently didn’t read the audit fully, or simply didn’t care about the implications of trusting the project."

	"$1.8M disappeared in a puff of smoke as Merlin pulled the classic DeFi magic trick."		"$1.8M disappeared in a puff of smoke as Merlin pulled the classic DeFi magic trick."
Line 57:		Line 46:

	== The Reality ==		== The Reality ==
			Merlin's audit contained the following warning:<blockquote>"We advise the client to carefully manage the privileged account's private key to avoid any potential risks of being hacked. In general, we strongly recommend centralized privileges or roles in the protocol be improved via a decentralized mechanism or smart-contract-based accounts with enhanced security practices, e.g., multisignature wallets."</blockquote>However, this issue was marked as ‘Resolved’ by Certik, who stated that the Merlin team had promised to use a multisig. Enough users apparently didn’t read the audit fully, or simply didn’t care about the implications of trusting the project.


	This sections is included if a case involved deception or information that was unknown at the time. Examples include:		This sections is included if a case involved deception or information that was unknown at the time. Examples include:

Line 74:		Line 66:
	\|April 25th, 2023 5:58:00 PM MDT		\|April 25th, 2023 5:58:00 PM MDT
	\|Liquidity Pool Draining		\|Liquidity Pool Draining
	\|One of the transactions involved in draining the liquidity pool.		\|One of the transactions involved in draining the liquidity pool<ref name="zksyncexplorer-10741" /><ref name="zksyncexplorer-10743" />.
			\|-
			\|April 25th, 2023 7:44:00 PM MDT
			\|Exploit Warning on Twitter
			\|An alarm that the liquidity pool had been drained was initially posted on Twitter by Twitter user wasgiventhatday.<ref name="wasgiventhatdaytwitter-10747" />
	\|}		\|}

Line 87:		Line 83:
	== Immediate Reactions ==		== Immediate Reactions ==
	How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?		How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

			=== Initial Warning On Twitter ===
			Twitter user wasgiventhatday originally posted on Twitter to warn about the exploit<ref name="wasgiventhatdaytwitter-10747" />.<blockquote>@circle 0xb72200739d557ce12b41876772e1e434af896644 has rugged @TheMerlinDEX of $147k . Can you please freeze his USDC on main net?</blockquote>

	== Ultimate Outcome ==		== Ultimate Outcome ==
Line 116:		Line 115:

	== References ==		== References ==
	<references><ref name="rektnews-10738">[https://rekt.news/merlin-dex-rekt/ Rekt - Merlin DEX - REKT] (May 3, 2023)</ref>		<references>
			<ref name="rektnews-10738">[https://rekt.news/merlin-dex-rekt/ Rekt - Merlin DEX - REKT] (May 3, 2023)</ref>
	<ref name="mage-10739">[http://mage.exchange/ Mage.Exchange \| MerlinDEX] (May 3, 2023)</ref>		<ref name="mage-10739">[http://mage.exchange/ Mage.Exchange \| MerlinDEX] (May 3, 2023)</ref>
			<ref name="merlindexmedium-10740">[https://merlindex.medium.com/merlin-a-zksync-dex-liquidity-lodger-fa71657c081d Merlin A Zksync Dex Liquidity Lodger - Merlin DEX Medium] (May 3, 2023)</ref>
	<ref name="merlindexmedium-10740">[https://merlindex.medium.com/merlin-a-zksync-dex-liquidity-lodger-fa71657c081d Merlin A Zksync Dex Liquidity Lodger] (May 3, 2023)</ref>		<ref name="zksyncexplorer-10741">[https://explorer.zksync.io/address/0x2744d62a1e9ab975f4d77fe52e16206464ea79b7 Attacker's Address - zkSync Era Block Explorer] (May 3, 2023)</ref>
			<ref name="zksyncexplorer-10742">[https://explorer.zksync.io/tx/0x1707b898638cd5a897ab793d0fadc3c608e4e78ff184fbfdb4f80ec874692355 Transaction - zkSync Era Block Explorer] (May 3, 2023)</ref>
	<ref name="zksyncexplorer-10741">[https://explorer.zksync.io/address/0x2744d62a1e9ab975f4d77fe52e16206464ea79b7 zkSync Era Block Explorer] (May 3, 2023)</ref>		<ref name="zksyncexplorer-10743">[https://explorer.zksync.io/tx/0x60e652f7d956a76982aeb8caa2f6e9bf73b854ffc3d7f539d4942c326f97eef4 Transaction Draining USDC Liquidity - zkSync Era Block Explorer] (May 3, 2023)</ref>

	<ref name="zksyncexplorer-10742">[https://explorer.zksync.io/tx/0x1707b898638cd5a897ab793d0fadc3c608e4e78ff184fbfdb4f80ec874692355 zkSync Era Block Explorer] (May 3, 2023)</ref>

	<ref name="zksyncexplorer-10743">[https://explorer.zksync.io/tx/0x60e652f7d956a76982aeb8caa2f6e9bf73b854ffc3d7f539d4942c326f97eef4 zkSync Era Block Explorer] (May 3, 2023)</ref>

	<ref name="themerlindextwitter-10744">[https://twitter.com/TheMerlinDEX/status/1651281814395187200 @TheMerlinDEX Twitter] (May 3, 2023)</ref>		<ref name="themerlindextwitter-10744">[https://twitter.com/TheMerlinDEX/status/1651281814395187200 @TheMerlinDEX Twitter] (May 3, 2023)</ref>

	<ref name="peckshieldalerttwitter-10745">[https://twitter.com/PeckShieldAlert/status/1651076481240690689 @PeckShieldAlert Twitter] (May 3, 2023)</ref>		<ref name="peckshieldalerttwitter-10745">[https://twitter.com/PeckShieldAlert/status/1651076481240690689 @PeckShieldAlert Twitter] (May 3, 2023)</ref>

	<ref name="beosinalerttwitter-10746">[https://twitter.com/BeosinAlert/status/1651124285409460224 @BeosinAlert Twitter] (May 3, 2023)</ref>		<ref name="beosinalerttwitter-10746">[https://twitter.com/BeosinAlert/status/1651124285409460224 @BeosinAlert Twitter] (May 3, 2023)</ref>
			<ref name="wasgiventhatdaytwitter-10747">[https://twitter.com/wasgiventhatday/status/1651039576860000257 wasgiventhatday - "@circle 0xb72200739d557ce12b41876772e1e434af896644 has rugged @TheMerlinDEX of $147k . Can you please freeze his USDC on main net?" - Twitter] (May 3, 2023)</ref>
	<ref name="wasgiventhatdaytwitter-10747">[https://twitter.com/wasgiventhatday/status/1651039576860000257 @~~wasgiventhatday~~ Twitter] (May 3, 2023)</ref></references>		</references>

Azoundria: Created page with "{{Imported Case Study 2|source=https://www.quadrigainitiative.com/casestudy/merlindexliquiditypooldrained.php}} {{Unattributed Sources}} Merlin DEXMerlin is a decentralized exchange (DEX) based on ZkSync and designed to support both volatile and stable exchanges with minimal fees and fast speed. The platform introduces dynamic directional fees that allow for various fees to be set for each pool and different fees based on the swap direction...."

2023-05-03T17:00:56Z

Created page with "{{Imported Case Study 2|source=https://www.quadrigainitiative.com/casestudy/merlindexliquiditypooldrained.php}} {{Unattributed Sources}} thumb|Merlin DEXMerlin is a decentralized exchange (DEX) based on ZkSync and designed to support both volatile and stable exchanges with minimal fees and fast speed. The platform introduces dynamic directional fees that allow for various fees to be set for each pool and different fees based on the swap direction...."

New page

{{Imported Case Study 2|source=https://www.quadrigainitiative.com/casestudy/merlindexliquiditypooldrained.php}}
{{Unattributed Sources}}

[[File:Merlindex.jpg|thumb|Merlin DEX]]Merlin is a decentralized exchange (DEX) based on ZkSync and designed to support both volatile and stable exchanges with minimal fees and fast speed. The platform introduces dynamic directional fees that allow for various fees to be set for each pool and different fees based on the swap direction. Earnings from the protocol will be partially redistributed to stMAGE users and used to maintain a continuous buying pressure on MAGE. However, despite passing its second audit by Certik, Merlin suffered a rug pull during its Liquidity Generation Event, resulting in the loss of $1.8 million. The incident was caused by max approvals granted to the Feeto address upon deployment of the pools, which allowed the individuals in control to drain the pool of all assets and bridge them to ETH. Merlin's post-mortem places the blame on the back-end development team, and the rugged funds were bridged back to Ethereum, swapped for ETH, and transferred to other addresses.

This is a global/international case not involving a specific country.<ref name="rektnews-10738" /><ref name="mage-10739" /><ref name="merlindexmedium-10740" /><ref name="zksyncexplorer-10741" /><ref name="zksyncexplorer-10742" /><ref name="zksyncexplorer-10743" /><ref name="themerlindextwitter-10744" /><ref name="peckshieldalerttwitter-10745" /><ref name="beosinalerttwitter-10746" /><ref name="wasgiventhatdaytwitter-10747" />

== About Merlin DEX ==
"Merlin is an immutable, permissionless, community-focused DEX based on ZkSync."

"Merlin is based on a dual AMM capable of supporting both volatile (UniV2) and stable (Curve-like) exchanges while minimizing fees and maximizing speed and dependability."

"In addition, we’re introducing dynamic directional fees for our trading pairs: this allows for various fees to be set for each pool, as well as different fees based on the swap direction (buying/selling)."

"These innovative AMM features enable us to offer pool configurations that are significantly more specialized and tailored to the particular trading pairs."

"Earnings from the protocol, initially derived primarily from swap fees, will be partially redistributed to stMAGE users in the form of real yield and used to maintain a continuous buying pressure on MAGE."

"Merlin had passed its second audit by Certik just two days before the attack."

"We advise the client to carefully manage the privileged account's private key to avoid any potential risks of being hacked. In general, we strongly recommend centralized privileges or roles in the protocol be improved via a decentralized mechanism or smart-contract-based accounts with enhanced security practices, e.g., multisignature wallets."

"However, this issue was marked as ‘Resolved’ by Certik, who stated that the Merlin team had promised to use a multisig. Enough users apparently didn’t read the audit fully, or simply didn’t care about the implications of trusting the project."

"$1.8M disappeared in a puff of smoke as Merlin pulled the classic DeFi magic trick."

"Merlin, a DEX native to the recently-launched zksync L2, was in the middle of a 3-day “Liquidity Generation Event” as part of its token (MAGE) launch."

"The alarm was initially raised by a community member before Peckshield spread the message. Merlin then acknowledged the incident, advising users to revoke permissions as a precaution."

"The rug mechanism was a straightforward case of draining the liquidity pools into which users were depositing as part of the MAGE token sale."

"This was made possible via max approvals granted to the Feeto address upon deployment of the pools. The individual/s in control of the Feeto address could then drain the pool of all assets, which were then bridged to ETH."

"Merlin’s own post-mortem places the blame squarely on the back-end development team. The thread includes links to developers’ github profiles and states that Serbian authorities have been contacted."

"The rugged funds were bridged back to Ethereum, swapped for ETH and transferred to other addresses."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:
* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - Merlin DEX Liquidity Pool Drained
!Date
!Event
!Description
|-
|April 25th, 2023 5:58:00 PM MDT
|Liquidity Pool Draining
|One of the transactions involved in draining the liquidity pool.
|}

== Technical Details ==
This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

== Total Amount Lost ==
The total amount lost has been estimated at $1,800,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?
== General Prevention Policies ==
Reliance on a single firm for auditing, and audit being done before the multi-sig was actually set up.
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="rektnews-10738">[https://rekt.news/merlin-dex-rekt/ Rekt - Merlin DEX - REKT] (May 3, 2023)</ref>

<ref name="mage-10739">[http://mage.exchange/ Mage.Exchange | MerlinDEX] (May 3, 2023)</ref>

<ref name="merlindexmedium-10740">[https://merlindex.medium.com/merlin-a-zksync-dex-liquidity-lodger-fa71657c081d Merlin A Zksync Dex Liquidity Lodger] (May 3, 2023)</ref>

<ref name="zksyncexplorer-10741">[https://explorer.zksync.io/address/0x2744d62a1e9ab975f4d77fe52e16206464ea79b7 zkSync Era Block Explorer] (May 3, 2023)</ref>

<ref name="zksyncexplorer-10742">[https://explorer.zksync.io/tx/0x1707b898638cd5a897ab793d0fadc3c608e4e78ff184fbfdb4f80ec874692355 zkSync Era Block Explorer] (May 3, 2023)</ref>

<ref name="zksyncexplorer-10743">[https://explorer.zksync.io/tx/0x60e652f7d956a76982aeb8caa2f6e9bf73b854ffc3d7f539d4942c326f97eef4 zkSync Era Block Explorer] (May 3, 2023)</ref>

<ref name="themerlindextwitter-10744">[https://twitter.com/TheMerlinDEX/status/1651281814395187200 @TheMerlinDEX Twitter] (May 3, 2023)</ref>

<ref name="peckshieldalerttwitter-10745">[https://twitter.com/PeckShieldAlert/status/1651076481240690689 @PeckShieldAlert Twitter] (May 3, 2023)</ref>

<ref name="beosinalerttwitter-10746">[https://twitter.com/BeosinAlert/status/1651124285409460224 @BeosinAlert Twitter] (May 3, 2023)</ref>

<ref name="wasgiventhatdaytwitter-10747">[https://twitter.com/wasgiventhatday/status/1651039576860000257 @wasgiventhatday Twitter] (May 3, 2023)</ref></references>