Merlin — Cryptocurrency hacking has become more common in recent years.

Individuals and businesses with digital assets may incur significant losses as a result of these attacks.

Hackers utilize a number of methods to get access to cryptocurrency wallets and exchanges, including phishing attacks, ransomware, and social engineering.

Two high-profile examples of such thefts include the 2014 Mt. Gox assault, which led in the loss of 850,000 bitcoins, and the 2016 Bitfinex incident, which resulted in the theft of 120,000 bitcoins.

With the growing popularity and significance of cryptocurrencies, these types of assaults are likely to continue unless stronger security measures are put in place.

Merlin and CertiK

On Wednesday, Merlin, a newly founded decentralized exchange, was hacked, and around $1.82 million was stolen from its liquidity pool.

CertiK, an auditing firm that performed the DEX audit prior to its implementation, blamed the hack on “rogue developers.”

“Initial investigations indicate that the roge developers are based in Europe,” the auditor tweeted.

“[And] we are working with law enforcement to track them down.”

CertiK has requested that the rogue developers take the given white hat award of 20%.

Meanwhile, Merlin alleged several Back-End team members of exhausting its contracts.

CertiK is now working with the rest of the Merlin team to establish a victim assistance fund for the impacted users.

Investigations

The public sale of the MAGE token marked the formal debut of Merlin last week.

The platform is built on zkSync, a layer-2 scaling solution for Ethereum.

Just before the launch, Merlin was subjected to a code audit by CertiK, a smart contract security company.

Most crypto businesses consider code auditing to be an essential step in ensuring the safety of customers’ funds and maintaining consumer trust.

CertiK is investigating the Merlin incident.

According to the company, preliminary inquiries indicate a possible issue with private key management rather than an attack as the root cause.

“While audits cannot prevent private key issues, we always highlight best practices to projects,” wrote CertiK.

“Should any foul play be discovered, we will work with the appropriate authorities and share relevant info.”

Merlin’s centralization issue was discovered in the smart contract security firm’s audit report.

As a precaution, Merlin published a developer statement advising users to disable associated site access on their wallets.

The DEX also indicated that it is investigating the matter and will provide further information.

Read also: Coinbase takes steps to evolve with Web3

Centralization problems

The Merline DEX’s smart contracts raised serious centralization problems, according to blockchain security experts.

Gonçalo Magalhes, a smart contract engineer at bug bounty platform Immunefi, shared his thoughts, saying:

“Though we’re still early in this whole story, there are indications that there were major centralization issues on the Merlin DEX smart contracts.”

“Specifically, the address receiving pool fees was allowed to drain all funds from every pool in the protocol.”

eZKalibur, another zkSync-based DEX, claims to have discovered the malicious code responsible for the currency draining in Merlin’s smart contracts.

“There’s no mention of this specific point, where the fee recipient address has full approval to withdraw every token from the pools – which is actually a crucial singular point of failure,” said Magalhães

“If this was indeed the case of a private key compromise, then it would certainly not be the first.”

According to Magalhes, proper key management of privileged addresses on a protocol is a necessary condition.

While mitigations such as multisig wallets are beneficial, he claims that fund transfer permissions on a single account makes the private key an easy target for blackhat hackers.

Smart contract audits

Smart contract audits, according to Andy Zhou, CEO of audit platform BlockSec, are helpful in discovering flaws and preserving users’ assets in protocols.

He did, however, warn out that one component that is sometimes missed is whether or not the protocol is harmful, mentioning the desire to rugpull users.

Zhou compared Merlin to a bank where the owner has pre-authorized all client withdrawals.

“If you know this, will you still deposit your tokens in the bank?” he raised.

Magalhes concurred, adding that the protocol’s reasoning required unfettered charge recipient approval.

“We would expect an audit to have flagged this as concerning,” he said.

“This is another reason why having more than one external party auditing your code is important.”

“What was missed by one firm, might be flagged by another one.”

While audits can detect potential hazards and vulnerabilities, they can’t avoid hostile activities such as rug pulls initiated by rogue developers, according to CertiK.

Customers were instead urged to search for programs that employed a voluntary KYC screening process.

The company also noted that smart contract audits do not cover essential privileges, but it is committed to aiding impacted individuals and prosecuting those responsible for the “exit scam.”