ETH
by BSCN
May 4, 2023
CertiK's audit of Merlin, a zkSync protocol, proves ineffective in identifying an exploit that resulted in a loss of over $2 million.
Leading Web3 auditing firm, CertiK, appear to have made a mishap in conducting an audit of Merlin, a protocol on .
The auditing miss failed to identify an exploit that wiped out over $2 million in public sale, LP, and private raise.
The exploit was made possible by two lines of code that allowed developers to withdraw tokens from the protocol through a feature that was not present in the code of a typical decentralized exchange (DEX).
BSC News reached out to several competing auditing firms like D3ploy who confirmed it will have been exceptionally difficult to miss the aforementioned lines of code. They confirmed detection would have been clear and that it would not have passed audit.
Others such as @AtlasIsMe, have taken to Twitter to point out what they perceive as glaring errors that lead to an inevitable exploit.
@AtlasIsMe also read the audit by CertiK and discovered that the methodology explained in the audit consisted of comparing Camelot vs. Merlin code. Although not an SC dev, AtlasIsMe underlined that even he could spot the differences between the two codes for the same function. AtlasIsMe criticized CertiK for initially awarding Merlin a security score of 90/100 and then downgrading it to 38 right after the rug pull.
Certik were quick to underline that they were already in the process of exploring a community compensation plan. This goes some way in affirming the team's dedication to the broader community.
Robust auditing practices conducted by reputable firms remain a huge factor in ensuring the space is safer and more welcoming to seasoned and fresh users alike. While errors will occur, it is essential that leading security firms continue to tighten screws and ensure effective practices if we are to continue driving the space forward.
CertiK is a blockchain security firm that helps projects identify and eliminate security vulnerabilities in blockchains, smart contracts, and Web3 applications using its services, products, and cybersecurity techniques.
Latest News
1h : 20m ago
Indian Firm Jetking to Raise Funds for Bitcoin Investment
2h : 35m ago
Who are the First Recipients of BNB Chain’s $100M Liquidity Support?
April 2, 2025
Oasis Network and the ROSE Token: Understanding the Privacy-First Blockchain
April 2, 2025
PAWS Listing Date: What to Expect
April 2, 2025
Ice Network News Round-Up: Partnerships, Exchange Listings and Online+
April 2, 2025
Nigeria Officially Recognizes Cryptocurrencies as Securities
April 2, 2025
PiFest 2025 Recap: Pi’s Open Network Drives Global Commerce Engagement
April 2, 2025
What is Kava Chain & the KAVA Token? Explained