Bounty

USDC

April

The security firm CertiK is planning to launch a compensation plan to return the funds stolen in the $2 million Merlin DEX exploit.&nbsp;
CertiK Working To Recover Stolen Funds
The blockchain security company has jumped in to help the Merlin decentralized exchange in its dire situation. The latter lost around $2 million during a public sale of its MAGE token, despite being audited by the smart-contract auditor, CertiK. To help recover a portion of the lost funds, CertiK is launching a compensation plan.&nbsp;
The security firm has revealed that it is investigating the scam and has even worked with some members of the Merlin team to launch the compensation program.&nbsp;
On April 26th, CertiK said,&nbsp;

&ldquo;Initial investigations indicate that the rogue developers are based in Europe, and CertiK will collaborate with law enforcement authorities to track them down if direct negotiation is unsuccessful.&rdquo;

USDC Stolen During Public Sale
The decentralized exchange was conducting a three-day public sale of its MAGE token when it was targeted by a rogue developer. The latter made away with around $850,000 of USD Coin and other relatively illiquid tokens. To sum it up, a total of $1.8 million worth of tokens were stolen in the attack. CertiK has dived into the blockchain data available on the attack and surmised that the culprit behind the attack must be someone who had control over the liquidity pool and could easily remove the funds.&nbsp;
CertiK&rsquo;s Audit Under Question
The root of the hack was uncovered by the eZKalibur team, which is a community-driven decentralized exchange. Their initial investigations helped them identify the malicious code responsible for the depletion of funds. Specifically, the initialize function contains two lines of code that grant approval to the feeTo address, allowing it to transfer an unlimited amount of token0 and token1 from the contract's address. This enables the feeTo address to call the transferFrom function and transfer tokens from the contract's address to itself.
The eZKalibur team had also questioned CertiK&rsquo;s auditing, which had given the Merlin DEX a high ranking before the attack happened.&nbsp;
CertiK&rsquo;s Plan Offers 20% Bounty
The CertiK team is trying to appeal to the rogue developer with a compensation plan, where they would get to keep a white hat bounty of 20% of the stolen funds after returning 80% to the exchange platform. According to CertiK's preliminary findings, the developers of the project are located in Europe, and the company is collaborating with law enforcement agencies to locate them.
The security firm also said,&nbsp;

&ldquo;Although we raised the private key privilege issues in the audit report, we want to assist impacted users. We are determined to track down those behind this rug pull.&rdquo;

Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.&nbsp;

CertiK Helping Merlin DEX With Compensation Plan

Crypto Daily™

Other articles published on Apr 27, 2023

Bitcoin Bounces Back 5% From False Alarm Panic Dump

Why the Bitcoin miner capitulation was in 2022

Crypto.com and Samsung to Offer Optimized Crypto Trading Experience on Z Fold Devices

Coinbase Still Willing to Work With SEC, But “Will Defend Itself Vigorously”

Circle’s Cross-Chain Transfer Protocol Hits Mainnet for USDC Transfers

Kiyosaki tells it how it is - banks, Bitcoin, freedom of speech

Join our free newsletter for daily crypto updates!