Meerkat Finance Hack

Meerkat Finance was allegedly rug-pulled by its team or an external attacker for the amount of $31 million through proxy upgradable smart contracts.

Meerkat Finance was a fork of the successful Alpaca Finance project. Essentially, Meerkat Finance was a lending and yield aggregation protocol offering its users yield through lending assets or pledging assets to the platform's vaults. The vaults would pursuit automated investment strategies.

This rekt case gained traction when the contract deployer invoked the upgradeTo() function, setting new implementation to the BUSD Vault at:

https://bscscan.com/tx/0xf19fa4bc…842553

The contract deployer also invoked the upgradeTo() function, setting new implementation to WBNB Vault at:

https://bscscan.com/tx/0x063970f8625f250101a7da8abf914748cf8eaaaa9458041f1928501accfe5

This altered the vault logic, introducing two new functions that were not included in the earlier implementations. This is where the real danger of proxy upgradable smart contracts lies. Code is king in DeFi and rather than trusting mediators users of DeFi can trust the code. However, when the code becomes changeable and upgradable by a centralized entity without governance by the token holder, the story changes.

An external address, marked as Fake_Phishing 17, invoked init() function to the Vaults through the proxy contract at:

https://bscscan.com/tx/0xfcf48681…b21f5d

https://bscscan.com/tx/0x5050d0f2…345027

According to decompiled bytecode, this function sets the address on storage slot 0 to the address provided to the function. There’s no permission check, making this newly added function the backdoor into the vaults.

The attacker called method 0x70fcb0a7 on BUSD Vault to transfer out 13,968,039 BUSD at:

https://bscscan.com/tx/0x1332fadc…cae27d

The attacker called method 0x70fcb0a7 on WBNB Vault to transfer out 73,635 WBNB at:

https://bscscan.com/tx/0xd8145dfe…ae8cd0

BUSD Vault:

https://bscscan.com/address/0x7e0c621e…04a61c

BNB Vault:

https://bscscan.com/address/0x639f18c7…1a1e4d

External Hacker Address (Fake_Phishing 17):

https://bscscan.com/address/0x9542966f…dbfa79