Incident Overview
Meerkat Finance was allegedly rug-pulled by its team or an external attacker for the amount of $31 million through proxy upgradable smart contracts.
Meerkat Finance was a fork of the successful Alpaca Finance project. Essentially, Meerkat Finance was a lending and yield aggregation protocol offering its users yield through lending assets or pledging assets to the platform's vaults. The vaults would pursuit automated investment strategies.
This rekt case gained traction when the contract deployer invoked the upgradeTo() function, setting new implementation to the BUSD Vault at:
https://bscscan.com/tx/0xf19fa4bc…842553
The contract deployer also invoked the upgradeTo() function, setting new implementation to WBNB Vault at:
https://bscscan.com/tx/0x063970f8625f250101a7da8abf914748cf8eaaaa9458041f1928501accfe5
This altered the vault logic, introducing two new functions that were not included in the earlier implementations. This is where the real danger of proxy upgradable smart contracts lies. Code is king in DeFi and rather than trusting mediators users of DeFi can trust the code. However, when the code becomes changeable and upgradable by a centralized entity without governance by the token holder, the story changes.
An external address, marked as Fake_Phishing 17, invoked init() function to the Vaults through the proxy contract at:
https://bscscan.com/tx/0xfcf48681…b21f5d
https://bscscan.com/tx/0x5050d0f2…345027
According to decompiled bytecode, this function sets the address on storage slot 0 to the address provided to the function. There’s no permission check, making this newly added function the backdoor into the vaults.
The attacker called method 0x70fcb0a7 on BUSD Vault to transfer out 13,968,039 BUSD at:
https://bscscan.com/tx/0x1332fadc…cae27d
The attacker called method 0x70fcb0a7 on WBNB Vault to transfer out 73,635 WBNB at:
https://bscscan.com/tx/0xd8145dfe…ae8cd0
BUSD Vault:
https://bscscan.com/address/0x7e0c621e…04a61c
BNB Vault:
https://bscscan.com/address/0x639f18c7…1a1e4d
External Hacker Address (Fake_Phishing 17):
https://bscscan.com/address/0x9542966f…dbfa79
Incident Report
Protocol Information
Market Context at Time of Hack
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Meerkat Finance, these are the critical security checks that could have prevented this incident (March 2021).
- Verify all logic paths related to Drained Contracts / Rugpull are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSources & References
Learn to Prevent the Next Meerkat Finance
The Meerkat Finance hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.