Huoxing Finance reports, according to Defimon Alerts monitoring, a new address funded by Tornado Cash withdrew 200 WETH from a dormant MakerDAO ETH-A liquidation bot proxy on October 6, resulting in a loss of approximately $538,000. This upgradeable proxy previously won four ETH-A liquidation auctions in 2020 (Auctions #1457 to #1460, 50 WETH each), but never called deal(), leaving the collateral in the Flipper contract. The withdrawal function in the implementation contract was not protected by ds-auth, allowing any caller to trigger it: first call deal() on the above-old auction, then transfer the collateral to the keeper via Vat.flux, followed by GemJoin.exit to send the 200 WETH to the caller-specified address and unwrap them into ETH. The MakerDAO core contracts functioned as designed; the vulnerability stemmed from a third-party bot’s permissionless exit function.
Defimon Alerts: 200 WETH stolen from dormant MakerDAO liquidation bot proxy
MarsBitShare
Summary
Defimon Alerts reported that 200 WETH, valued at approximately $538,000, was stolen from a dormant MakerDAO ETH-A liquidation bot proxy. The bot, funded via Tornado Cash, exploited a missing ds-auth protection in the withdrawal function. ETH prices remain under pressure as the incident underscores risks associated with third-party liquidation tools. Traders are advised to monitor altcoins for potential volatility following such exploits. The core MakerDAO contracts were unaffected.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.