USDC

Wednesday

ZKsync

Ethereum-based decentralized exchange (DEX) Merlin, which uses zero-knowledge sync (zkSync), has lost more than $1.8 million in a liquidity pool exploit hours after smart contract security firm CertiK audited its code.
The hack <a href="https://explorer.zksync.io/address/0x2744d62a1e9ab975f4d77fe52e16206464ea79b7" data-wpel-link="external" target="_blank">occurred</a> on Wednesday morning during the public sale of Merlin’s native token, MAGE, with the attacker siphoning several assets, including USD Coin (USDC), Ether (ETH), and other illiquid tokens.
<h2 class="p2" id="b-merlin-s-lp-drained-after-code-audit-b">Merlin’s LP Drained After Code Audit</h2>
A few hours after the exploit, CertiK <a href="https://twitter.com/CertiK/status/1651088669187473408?s=20" data-wpel-link="external" target="_blank">tweeted</a> that it was investigating the incident and working to understand its impact on the community. The security firm disclosed that its initial findings suggested that a private key management issue may have led to the hack and not an exploit, as widely believed.
CertiK said it pointed out the centralization risk in the recent audit report for Merlin under the “Decentralization Efforts” section. The firm insisted that while audits could not prevent private key issues, they always ensured to highlight better practices for projects.
As claimed in the audit dated April 24, 2023, CertiK <a href="https://skynet.certik.com/projects/merlin-dex" data-wpel-link="external" target="_blank">recommended</a> that Merlin improve its centralized roles to a decentralized mechanism like multi-signature wallets to enhance security practices. The firm also asked the protocol to implement a timelock feature with a latency of at least 48 hours to avoid a single point of key management failure. CertiK has also promised to work with appropriate authorities if any foul play is discovered.
<blockquote>
“We encourage all community members to review this information and all audits fully. As we navigate this challenging situation, we want to assure you that we are taking all necessary measures to protect our community’s interests,” CertiK said.
</blockquote>
<h2 class="p2" id="b-malicious-code-detected-b">Malicious Code Detected</h2>
Interestingly, eZKalibur, another zkSync DEX and launchpad, <a href="https://twitter.com/zkaliburDEX/status/1651087592052359169?s=20" data-wpel-link="external" target="_blank">revealed</a> it had identified the malicious code that enabled the hackers to drain Merlin’s funds. The DEX said it found two lines of code in the initialize function that gave the feeTo address <a href="https://cryptopotato.com/terraport-finance-exploited-for-2m-barely-10-days-after-launch/" data-wpel-link="internal">approval</a> to transfer an unlimited amount of tokens from the contract’s address.
<blockquote class="twitter-tweet">
<img src="https://s.w.org/images/core/emoji/14.0.0/72x72/1f4e2.png" alt="📢" class="wp-smiley" style="height: 1em; max-height: 1em;" /> We did some research on Merlin smart contracts and we identified the malicious code responsible for the draining of funds.
These two lines of code in the initialize function are essentially granting approval for the feeTo address to transfer an unlimited (type(uint256).max)… <a href="https://t.co/mIksh4HkhB" data-wpel-link="external" target="_blank">pic.twitter.com/mIksh4HkhB</a>
— eZKalibur ∎ (@zkaliburDEX) <a href="https://twitter.com/zkaliburDEX/status/1651087592052359169?ref_src=twsrc%5Etfw" data-wpel-link="external" target="_blank">April 26, 2023</a></blockquote>
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
Meanwhile, the Merlin team has <a href="https://twitter.com/TheMerlinDEX/status/1651090982274752513?s=20" data-wpel-link="external" target="_blank">asked</a> users to revoke access to the connected site on their wallets as they analyze the cause of the exploit.
The post <a href="https://cryptopotato.com/zksync-dex-merlin-exploited-for-over-1-8m-after-code-audit/" rel="nofollow">zkSync DEX Merlin Exploited for Over $1.8M After Code Audit</a> appeared first on <a href="https://cryptopotato.com/" rel="nofollow">CryptoPotato</a>.

zkSync DEX Merlin Exploited for Over $1.8M After Code Audit

Tabla de contenidos

CryptoPotato_News

Otros artículos publicados el 26 abr 2023

Merlin Decentralized Exchange Hacked for Over $1.8 Million Despite Code Audit by Certik

NFT Guide: What is OpenSea and How does it work?

Blockchain Revolutionizes Human Collaboration and Ethics, Say Buterin and Sadhguru

South Korea’s crypto regulation bill receives initial approval

What can Uniswap (UNI) investors expect? UNI price prediction!

Big Eyes Crypto – A Comprehensive Overview of the Emerging Digital Currency

¡Únete a nuestro boletín gratuito para recibir actualizaciones diarias de criptografía!