Defimon Alerts said a newly funded address linked to Tornado Cash withdrew 200 WETH from a dormant MakerDAO ETH-A liquidation bot proxy on Oct. 6, with losses estimated at about $538,000. The proxy had previously won four ETH-A liquidation auctions in 2020, auctions No. 1457 through 1460, with 50 WETH tied to each one, but never called deal(), leaving the collateral sitting in Flipper.
According to the monitoring account, the issue came from an unprotected withdrawal function in the implementation contract rather than from MakerDAO’s core system. Because the extraction function was not protected by ds-auth, any caller could trigger the sequence: call deal() on the old auctions, move the collateral to the keeper through Vat.flux, then use GemJoin.exit to send 200 WETH to an address chosen by the caller and unwrap it into ETH.
The report said MakerDAO core contracts behaved as designed. The flaw was in the third-party liquidation bot’s exit function, which lacked access control.
ChainCatcher reported, citing Defimon Alerts, that a newly funded address linked to Tornado Cash withdrew 200 WETH from a dormant MakerDAO ETH-A liquidation bot proxy on Oct. 6, causing an estimated loss of about $538,000.
Assets traced to old ETH-A liquidation auctions
The upgradeable proxy had won four ETH-A liquidation auctions in 2020 — auctions No. 1457 to 1460 — with 50 WETH in each auction. But it never called deal(), which left the collateral in Flipper.
Unprotected withdrawal path was callable by anyone
Defimon Alerts said the extraction function in the implementation contract was not protected by ds-auth, which meant any caller could trigger the process. The sequence was to call deal() on the old auctions, move the collateral to the keeper through Vat.flux, then use GemJoin.exit to transfer 200 WETH to an address specified by the caller and unwrap it into ETH.
Maker core contracts were not the source of the flaw
The monitoring account said MakerDAO core contracts operated as designed. The weakness was in the third-party bot, whose exit function lacked access control.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
