Defimon Alerts said on Oct. 6 that a newly funded address, seeded through Tornado Cash, withdrew 200 WETH from a dormant MakerDAO ETH-A liquidation bot proxy, resulting in an estimated loss of about $538,000. The proxy had previously won four ETH-A liquidation auctions in 2020, auctions No. 1457 through 1460, with 50 WETH tied to each one, but never called deal(), leaving the collateral sitting in Flipper.
The reported issue was not with MakerDAO’s core contracts. Instead, the weakness was in a third-party liquidation bot implementation contract, where the withdrawal function was not protected by ds-auth. That meant any caller could trigger the sequence: call deal() on the old auctions, move the collateral to the keeper through Vat.flux, then use GemJoin.exit to send the 200 WETH to an address chosen by the caller and unwrap it into ETH. The case points to an access-control failure in an external bot rather than a protocol-level flaw in MakerDAO itself.
According to BlockBeats on Oct. 6, Defimon Alerts detected that a newly funded address, backed through Tornado Cash, withdrew 200 WETH from a dormant MakerDAO ETH-A liquidation bot proxy, causing an estimated loss of about $538,000.
Collateral came from old ETH-A liquidation auctions
The upgradeable proxy had won four ETH-A liquidation auctions in 2020, auctions No. 1457 to 1460, with 50 WETH in each auction. But it never called deal(), which left the collateral in Flipper.
Issue traced to an unprotected withdrawal function
The implementation contract’s withdrawal function was not protected by ds-auth, allowing any caller to execute the sequence. The caller could first invoke deal() on the old auctions, then move the collateral to the keeper through Vat.flux, and finally use GemJoin.exit to transfer the 200 WETH to an address specified by the caller and unwrap it into ETH.
The report said MakerDAO’s core contracts operated as designed. The flaw was in the third-party liquidation bot’s exit function, which lacked access control.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
