zkSync DEX Merlin reportedly hacked for $1.82 million immediately after code audit

Quick Take

  • Decentralized exchange Merlin was reportedly hacked immediately after receiving a code audit.
  • Certik claims that initial findings indicate an issue with private key management, not code.
  • eZKalibur, a zkSync DEX, claims it found evidence of problematic code in Merlin’s smart contract.

Merlin, a decentralized exchange using zkSync, appears to have been hacked for over $1.82 million immediately after receiving a code audit from smart-contract auditor Certik.

Certik tweeted that it is investigating the incident and that its initial findings suggest a potential issue with private key management — not necessarily a code exploit. "While audits cannot prevent private key issues, we always highlight best practices to projects," Certik said. "Should any foul play be discovered, we will work with the appropriate authorities and share relevant info. Stay tuned for updates."

Meanwhile, eZKalibur — a zkSync decentralized exchange and launchpad that, like Merlin, forked part of DEX Camelot's contract  — claims to have identified the malicious code responsible for the draining of funds.

"These two lines of code in the initialize function are essentially granting approval for the feeTo address to transfer an unlimited (type(uint256).max) amount of token0 and token1 from the contract's address," it explained while questioning the quality of Certik's audit. "In this case, the feeTo address could potentially call the transferFrom function on the respective tokens to transfer tokens from the contract's address to itself."

Though Certik tweeted that it highlighted Merlin's centralization risk in its audit of the DEX, some feel that the risk of a rug pull should have been highlighted.


Keep up with the latest news, trends, charts and views on crypto and DeFi with a new biweekly newsletter from The Block's Frank Chaparro

By signing-up you agree to our Terms of Service and Privacy Policy
By signing-up you agree to our Terms of Service and Privacy Policy

A finding like this should be reported at least as "major," if not "critical." eZKalibur commented to The Block, adding: "It can't be marked as a hidden and simple decentralization issue since, without a timelock, it could lead to an immediate drain of the totality of the funds deposited on the protocol, which is exactly what happened."

Merlin developers have since asked users to revoke wallet permissions connected to its website. They claim to be analyzing the exploit of the protocol.

Merlin did not immediately respond to a request for comment. The Block also contacted Certik.

Update: Initially believed to be a hack, security analysts, including CertiK, concluded that it was a rug pull – an exit scam executed by one or more developers of the Merlin team with privileged access to user funds deposited in the protocol's smart contracts.

© 2023 The Block. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.

About Author

Adam is the managing editor for Europe, the Middle East and Africa. He is based in central Europe and was a managing editor and podcast host at the crypto exchange OKX's former research arm, OKX Insights. Before that, he co-founded BeInCrypto.com, which he elevated into one of the leading crypto media brands at its peak as the editor-in-chief. Earlier, he served as the editor-in-chief at Bitcoinist.com. Before joining the blockchain and crypto industry, he worked for Looper.com, Grunge.com and SVG.com. He tweets via @XBT002 and can be emailed at [email protected].


To contact the editor of this story:
Ryan Weeks at
[email protected]