On April 26, according to Beosin EagleEye security situation awareness platform, Merlin Dex was attacked and the funds of USDC-WETH liquidity pool had been drained. The attacker made a profit of about $1.8M. Beosin security team analyzed the security incident immediately and the details are as follows.<h3 id="information-related-to-this-incident">Information related to this incident</h3>Take one of the attack transactions for example to analyze:The transaction hash:0xf21bedfb0e40bc4e98fd89d6b2bdaf82f0c452039452ca71f2cac9d8fea29ab2The addresses of the attacker:0xc0D6987d10430292A3ca994dd7A31E461eb281820x2744d62a1e9ab975f4d77fe52e16206464ea79b7The attacked smart contract:0x82cf66e9a45Df1CD3837cF623F7E73C1Ae6DFf1e (USDC-WETH Pool)<h3 id="the-attack-process">The attack process</h3>1. The pool creator/the attacker (0xc0D6987d10430292A3ca994dd7A31E461eb28182) created MerlinSwapFactory contract (0x63E6fdAdb86Ea26f917496bEEEAEa4efb319229F) and during the initialization the Feeto address had been set to 0xc0D6987d10430292A3ca994dd7A31E461eb28182, the attacker address.<img src="https://wdcdn.qpic.cn/MTY4ODg1NjUzMDQ2MzM5NQ_89069_ugUwi_4nyCh7C7qh_1682649278?w&#61;638&amp;h&#61;253&amp;type&#61;image/png" />2. The attacker deployed USDC-WETH pool (0x82cf66e9a45Df1CD3837cF623F7E73C1Ae6DFf1e) by MerlinSwapFactory contract. Here we can see that USDC and WETH of the pool were approved max amount for the Feeto address during the initialization. It is obvious that there is a centrialization risk in the contract.<img src="https://wdcdn.qpic.cn/MTY4ODg1NjUzMDQ2MzM5NQ_990526_wGA0Ii89LJVg1tNt_1682649803?w&#61;927&amp;h&#61;316&amp;type&#61;image/png" />3. Because of max amount approval of USDC and WETH for Feeto address, the attacker transferred all the tokens in the pool.<img src="https://wdcdn.qpic.cn/MTY4ODg1NjUzMDQ2MzM5NQ_232647_QxNkwwg1ALaoOs0V_1682652192?w&#61;1022&amp;h&#61;212&amp;type&#61;image/png" />4. It is worth noting that the owner and Feeto address of the factory contract were changed to another address before the rug pull. However, the change was unnecessary to make the rug pull. We guess that it was a step the attacker took to confuse people.<img src="https://wdcdn.qpic.cn/MTY4ODg1NjUzMDQ2MzM5NQ_771176_gFx4aS2JiDvMlimD_1682652477?w&#61;1080&amp;h&#61;316&amp;type&#61;image/png" /><img src="https://wdcdn.qpic.cn/MTY4ODg1NjUzMDQ2MzM5NQ_663995_0p2YUZ4COgzLq0do_1682652495?w&#61;1080&amp;h&#61;278&amp;type&#61;image/png" />The funds in the USDC-WETH liquidity pool were drained and the attacker made a profit of about $1.8M.<h3 id="vulnerability-analysis">Vulnerability Analysis</h3>This attack took advantage of the centralization issue of the pair contract. During the initialization, the Feeto address in the factory contract was approved to control all the funds in the USDC-WETH pool, which caused that all the funds in the contract can be drained by the Feeto address.<h3 id="funds-tracing">Funds Tracing</h3>The attacker called the transferFrom function to transfer 811K <a href="https://twitter.com/search?q&#61;%24USDC&amp;src&#61;cashtag_click" rel="noopener noreferrer nofollow">$USDC</a> from the pool to 0x2744d62a1e9ab975f4d77fe52e16206464ea79b7.0xcE4ee0E01bb729C1c5d6D2327BB0F036fA2cE7E2 extracted 435.2 <a href="https://twitter.com/search?q&#61;%24ETH&amp;src&#61;cashtag_click" rel="noopener noreferrer nofollow">$ETH</a> from the token1 contract (WETH) and used Anyswap to bridge the funds to 0xa7D481944730a88B862eB57248Cb1B2C8aa358Ad and 0x0b8a3ef6307049aa0ff215720ab1fc885007393d on the Ethereum mainnet, making a total profit of about $1.8 million.Up till now, the Beosin KYT AML analysis platform found that the stolen funds are still stored on 0xa7D481944730a88B862eB57248Cb1B2C8aa358Ad and 0x0b8a3ef6307049aa0ff215720ab1fc885007393d. We will continue to monitor and track the stolen funds.<img src="https://wdcdn.qpic.cn/MTY4ODg1NjUzMDQ2MzM5NQ_190004_MeQgDgeO0cag4quX_1682654587?w&#61;1080&amp;h&#61;808&amp;type&#61;image/png" /><img src="https://wdcdn.qpic.cn/MTY4ODg1NjUzMDQ2MzM5NQ_164136_HInF5cvwS70NBS0H_1682654592?w&#61;1080&amp;h&#61;679&amp;type&#61;image/png" /><img src="https://wdcdn.qpic.cn/MTY4ODg1NjUzMDQ2MzM5NQ_689864_-_oWRZmO3gtBred7_1682654596?w&#61;1080&amp;h&#61;299&amp;type&#61;image/png" /><h3 id="conclusion">Conclusion</h3>From the analysis of Merlin rug pull, we suggest that Web3 projects should use multisig wallets or DAO governance to manage addresses which have control of community treasury and users should watch out the risks of a new project before aping in.Beosin is a leading global blockchain security company co-founded by several professors from world-renowned universities and there are 40&#43; PhDs in the team. It has offices in Singapore, Korea, Japan, and other 10&#43; countries. With the mission of &#34;Securing Blockchain Ecosystem&#34;, Beosin provides &#34;All-in-one&#34; blockchain security solution covering Smart Contract Audit, Risk Monitoring &amp; Alert, KYT/AML, and Crypto Tracing. Beosin has already audited more than 3000 smart contracts and protected more than $500 billion funds of our clients. You are welcome to contact us.

A rug pull of $1.8M, an analysis of zkSync dex Merlin security incident

Table of Contents

Beosin

Other articles published on Apr 29, 2023

Tapio Finance Falls Victim to Discord Server Breach

Ethereum Ranks #8 Among Top Developed Blockchains

SEC fines Coinme and charges defendants in UpToken case

Why This New Listing Could Push Dogecoin Price Above $0.1

Profi Group Leaders Vladko Romanyshyn and Andrzej Frankowsky On AI and Trading

Bitcoin traders brace for sell-off as Binance sees significant influx of BTC

Join our free newsletter for daily crypto updates!