Merlin DEX - REKT

$1.8M disappeared in a puff of smoke as Merlin pulled the classic DeFi magic trick. The zksync-native DEX had just completed its audit with Certik. How can such an easily ruggable protocol be green-lit? Or are users also to blame?

audit certik defi dex green magic merlin protocol pulled zksync