A rug pull is a type of exit scam in which the perpetrators create a new token, launch a liquidity pool for it and pair it with a base token, like ether (ETH) or a stablecoin like dai (DAI). A liquidity pool is a large pool of tokens that a protocol uses to fulfill trades, as opposed to an order book system where buyers and sellers list their trade orders and wait to be filled.
“CertiK is actively investigating the recent Merlin DEX exit scam, where rogue developers are suspected of causing the loss of around $2 million in user funds,” the representative said. “Working closely with the remaining Merlin team, CertiK will initiate a compensation plan to cover the lost funds for affected users.”
“Initial investigations indicate that the rogue developers are based in Europe, and CertiK will collaborate with law enforcement authorities to track them down if direct negotiation is unsuccessful,” they added.
The rogue developer is urged to return 80% of the stolen funds and accept a 20% white hat bounty, CertiK said. On its part, CertiK emphasized that although private key privileges are outside the scope of a smart contract audit, they are committed to assisting impacted users in this case.
Recommended for you:
- Cory Doctorow's Web3 Rallying Cry: 'Seize the Means of Computation'
- CBDCs Are Going to Disappoint
- Bitcoin, Ether Retrace Weekend Losses as Bears See $183M in Short Liquidations
- Join the Most Important Conversation in Crypto and Web3 in Austin, Texas April 26-28
Merlin was seemingly exploited for over $1.8 million on Wednesday morning during a public sale of its mage (MAGE) tokens. The attack occurred despite Merlin touting an audit conducted by blockchain security firm CertiK.
Further analysis by firms and analysts alleged the attack was conducted by a rogue developer who held private keys to Merlin’s smart contracts – allowing them to withdraw all liquidity from the protocol.
Edited by Parikshit Mishra.
