Odaily reported that a new address funded via Tornado Cash withdrew 200 WETH from a dormant MakerDAO ETH-A liquidation bot proxy on Oct. 6, causing an estimated loss of about $538,000. The upgradeable proxy had previously won four ETH-A liquidation auctions in 2020, auctions No. 1457 through No. 1460, receiving 50 WETH in each case. Those auctions were never finalized through a call to deal(), which left the collateral sitting in Flipper. The disclosed issue was not in MakerDAO’s core contracts. Instead, the flaw was in a third-party bot implementation contract, where the withdrawal function lacked ds-auth protection. That allowed any caller to execute a sequence that first called deal() on the old auctions, then moved the collateral to the keeper through Vat.flux, and finally used GemJoin.exit to send the full 200 WETH to an address chosen by the caller and unwrap it into ETH.
According to Odaily, a new address funded via Tornado Cash withdrew 200 WETH from a dormant MakerDAO ETH-A liquidation bot proxy on Oct. 6, causing an estimated loss of about $538,000.
The upgradeable proxy had won four ETH-A liquidation auctions in 2020, specifically auctions No. 1457 to No. 1460. Each auction yielded 50 WETH, but deal() was never called, leaving the collateral in Flipper.
How the withdrawal path worked
The report said the withdrawal function in the implementation contract was not protected by ds-auth, which meant any caller could trigger the flow. The sequence involved calling deal() on the old auctions, moving the collateral to the keeper through Vat.flux, and then calling GemJoin.exit to transfer the 200 WETH to an address specified by the caller before unwrapping it into ETH.
Issue traced to a third-party bot
Odaily said MakerDAO’s core contracts operated as designed. The weakness was in the third-party liquidation bot, whose exit function lacked access control.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
