Certik and ZK-Sync Dex Merlin Check reimbursement plan of $ 2 million for Rugpull victims

Certik and ZK-Sync Dex Merlin Check reimbursement plan of $ 2 million for Rugpull victims

The blockchain security company Certik and ZK-Sync Decentralized Exchange (Dex) Merlin work on a plan to compensate users affected by a recent exploit that has deducted almost $ 2 million from the latter.

Merlin announced on Thursday that the incident, which was generally assumed that it was an exploit, was actually a carpet train of several renegade members of his back-end development team, who manipulated the code of the protocol to achieve their goal.

Certik and Merlin to compensate the victims

Remember that Merlin's liquidity pool was emptied on Wednesday, hours after Certik had checked the code of the protocol. The Dex carried out the public sale of its native token Mage when an attacker performed the hack.

reported as CryptoPotato said, an analysis of the incident indicated that a problem with the administration of private keys could have led to the incident. The security company announced that at the audit carried out on Monday, she had pointed out to a centralization risk and recommended Merlin to switch to decentralized mechanisms to avoid single points of key failure.

After further analysis, Merlin and Certik found that the hack was an insider job by the protocol team. The back-end team implemented a call action function that gave them control over the contracts and all trading pairs in the liquidity pools.

The developers were also able to manipulate the front-end contracts and the web hosts from Merlin, causing them to perform several on-chain transactions that exhausted public sale.

Our unshakable priority is to repay all funds to the parties and participants affected as soon as possible on the Merlin platform. For this we work together @ Certik (Team Doxx from Prospero & Alatar Recovery Plan), to all affected users compensate.

- Merlin (@themerlindex) 26. April 2023

a 20 % white hat premium

While Merlin and Certik work out a compensation plan, they also informed the responsible authorities about the incident and the whereabouts of the renegade technical team. The back-end team was traced back to Serbia, Europe and the local authorities were notified.

The protocol has also recruited on-chain analysts to monitor the movement of the funds. The stolen assets were persecuted in two wallpoons and were still there at the time of writing.

In the meantime, Certik offered a 20 percent white-hac premium And asked them to accept them to avoid the anger of the law.