Curriculum·Graduate·G203
Reading Audit Reports
Merlin DEX on zkSync, 26 April 2023. The team had said its pools would open only after CertiK finished its audit; the 14 April report found no critical issues, gave the protocol a security score of 90, and in its body flagged the owner's centralized privileges.
Start with lesson 14 lessons · about 2 hours · free account to read in full
Lesson 1 opens on
Merlin DEX, 26 April 2023
Merlin, a decentralized exchange on zkSync, said its pools would open only after CertiK finished auditing its contracts. The 14 April CertiK report found no critical issues and gave the protocol a security score of 90; in its body it did flag the owner's centralized privileges, under a heading on decentralization efforts.8 million dollars was drained from the pools by a party holding the private keys to Merlin's own contracts.
The lessons
- G203-01What an audit is, and what Merlin's did not sayState what a smart-contract audit checks and the two very different questions it can answerabout 30 min · opens on Merlin DEX, 26 April 2023
- G203-02Scope, findings, and severityRead an audit's findings table: severity, status, and whether each was fixed or acknowledgedabout 30 min · opens on KyberSwap Elastic, 22 November 2023
- G203-03The centralization finding you cannot audit awayExplain why a centralization finding describes a risk no code fix can remove, only a governance or custody changeabout 30 min · opens on Multichain, July 2023
- G203-04The audit that found itExplain why even a reviewed, multiply audited protocol can ship a fatal bug, using Euler Financeabout 30 min · opens on Euler Finance, 13 March 2023