Quick update following yesterday’s situation with the creation of a scammy Euler vault and an incentive campaign by a bad actor on @merkl_xyz
The first thing to note is that Merkl operates as a permissionless platform: anyone can create a campaign on top of any asset/pool using Merkl, provided that they use a reward token that we've whitelisted.
That being said, as maintainers of the Merkl app, we recognize our responsibility to protect users. Everyone deserves clear warnings and the tools necessary to conduct proper due diligence before committing to any opportunity, especially those carrying significant risk.
On this topic in particular, as soon as we were notified of the potential danger on this vault, we labeled it as UNVERIFIED and later proceeded with removing it from the Merkl app.
We're working on adding extra safeguards to prevent scammy incentive campaigns from appearing on our frontend. We’re also collaborating with protocols to improve metadata parsing, spot risky vaults or markets ahead of time, and help everyone steer clear of such traps.
Be VERY careful interacting with unverified @merkl_xyz campaigns.
A bad actor is creating triple digit APR incentives on Sonic for depositing USDC into an Euler vault, and drains all deposits. This is how it works:
Because Euler is permissionless, the attacker was able to deploy a 'fake' market using scUSD as collateral and USDC as debt. The market has a 1$ deposit cap for scUSD - fully taken by the bad actor. The scUSD oracle price is set to $1M per token, allowing the attacker to borrow 700,000 USDC against a single scUSD (at 70% LTV). The attacker controls the oracle and can raise the price further to extract more funds if needed.
Next, the attacker created an unverified, fake campaign on Merkl to attract deposits. Any USDC deposited to this market is borrowed, swapped into ETH, and transferred to @RAILGUN_Project.
Current losses: roughly $145,000, and growing.
As the attacker is not actively monitoring the vault for new deposits, it allowed 0xc0f8feab321f8ffe97666768451747d16da8cad5, a victim who previously deposited USDC into this vault, to withdraw USDC before the attacker managed to borrow it.
While we don't think @merkl_xyz or @eulerfinance are at fault here, as they both clearly flag the campaign/market as unverified, @merkl_xyz should likely make depositing into an unverified campaign much more annoying with more pop-up warnings, just to prevent this from happening in the future.
Main operator: 0x8ba913e764c5cc9b22ee63737841059ad9caac5f
Final receiver before railgun: 0xa86399e78fb3d9fb5be053825a016e32d390fc12
The list of victims can be found here:
Campaign (SCAM, don't deposit):
Euler Market (SCAM, don't deposit):
cc @zachxbt
4,21 тыс.
19
Содержание этой страницы предоставляется третьими сторонами. OKX не является автором цитируемых статей и не имеет на них авторских прав, если не указано иное. Материалы предоставляются исключительно в информационных целях и не отражают мнения OKX. Материалы не являются инвестиционным советом и призывом к покупке или продаже цифровых активов. Раздел использует ИИ для создания обзоров и кратких содержаний предоставленных материалов. Обратите внимание, что информация, сгенерированная ИИ, может быть неточной и непоследовательной. Для получения полной информации изучите соответствующую оригинальную статью. OKX не несет ответственности за материалы, содержащиеся на сторонних сайтах. Цифровые активы, в том числе стейблкоины и NFT, подвержены высокому риску, а их стоимость может сильно колебаться. Перед торговлей и покупкой цифровых активов оцените ваше финансовое состояние и принимайте только взвешенные решения.