Merlin DEX hack — April 2023

Merlin was a decentralised exchange on zkSync Era that had been audited by CertiK days earlier. On 26 April 2023, during a three-day Liquidity Generation Event for its MAGE token, its liquidity pools were emptied.

The mechanism was a privilege built into the pair contracts rather than an external bug. The initialize function granted the deployment-controlled "feeTo" address an unlimited allowance over both pool tokens, so whoever held that key could call transferFrom and move user deposits out of any pool. The zkSync DEX eZKalibur published the two lines of code responsible. CertiK said its initial findings pointed to a private key management issue rather than an exploit, said it had raised private key privilege issues in its audit report, and later described the event as a rug pull carried out by developers with privileged access rather than an outside attack. CertiK said the rogue developers were believed to be based in Europe, and subsequently in Serbia, and that it was working with law enforcement. No one has been charged and the individuals have not been publicly named.

Figures differ. The Block and Decrypt reported the loss as $1.82 million on the basis of on-chain evidence; CertiK repeatedly described "around $2 million" when discussing compensation. CryptoSlate reported that 402 ETH, then worth about $783,195, had been traced to a single wallet. CertiK offered the developers a 20% white-hat bounty, said on 4 May 2023 that it had frozen roughly $160,000 of the stolen funds with the help of partners, and said it was discussing a community compensation plan with zkSync.