Meerkat Finance Rug Pull

Meerkat Finance was allegedly rug-pulled by its team or an external attacker for the amount of $31 million through proxy upgradable smart contracts.

Meerkat Finance was a fork of the successful Alpaca Finance project. Essentially, Meerkat Finance was a lending and yield aggregation protocol offering its users yield through lending assets or pledging assets to the platform's vaults. The vaults would pursuit automated investment strategies.

This rekt case gained traction when the contract deployer invoked the upgradeTo() function, setting new implementation to the BUSD Vault at:

Tx 0xf19f…2553

The contract deployer also invoked the upgradeTo() function, setting new implementation to WBNB Vault at:

Tx 0x0639…cfe5

This altered the vault logic, introducing two new functions that were not included in the earlier implementations. This is where the real danger of proxy upgradable smart contracts lies. Code is king in DeFi and rather than trusting mediators users of DeFi can trust the code. However, when the code becomes changeable and upgradable by a centralized entity without governance by the token holder, the story changes.

An external address, marked as Fake_Phishing 17, invoked init() function to the Vaults through the proxy contract at:

Tx 0xfcf4…1f5d

Tx 0x5050…5027

According to decompiled bytecode, this function sets the address on storage slot 0 to the address provided to the function. There’s no permission check, making this newly added function the backdoor into the vaults.

The attacker called method 0x70fcb0a7 on BUSD Vault to transfer out 13,968,039 BUSD at:

Tx 0x1332…e27d

The attacker called method 0x70fcb0a7 on WBNB Vault to transfer out 73,635 WBNB at:

Tx 0xd814…8cd0

BUSD Vault:

Address 0x7e0c…a61c

BNB Vault:

Address 0x639f…1e4d

External Hacker Address (Fake_Phishing 17):

Address 0x9542…fa79