What happened
On June 29, 2021, Merlin Labs' testing Alpaca single-asset vault was exploited after it was reachable on mainnet. The attacker made the vault treat directly transferred WBNB as strategy rewards, then used the resulting inflated performance-fee calculation to mint and sell excessive MERL rewards. Rekt reported about $330,000 stolen; Inspex recorded 22 uses of the technique yielding 1,056.31 WBNB.
How it happened
- The attacker deposited 0.1 WBNB in the Alpaca vault and directly transferred WBNB plus ALPACA to satisfy the reinvest condition.
- The vault treated the directly transferred WBNB balance as harvested reward.
- A withdrawal made the artificial profit feed a performance-fee calculation and the MERL minting function.
- The attacker swapped the excess MERL for WBNB and repeated the method.
Protocol details
Classification
Protocol Logic / Yield Aggregator / Token & Share Accounting
Protocol Type
Yield
Affected asset / contract
MERL
Implementation language
Solidity
Protocol links
Website
@MerlinLab_
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
