Odaily Planet Daily reports that on October 6, a new address funded by Tornado Cash withdrew 200 WETH from a dormant MakerDAO ETH-A liquidation bot proxy, resulting in approximately $538,000 in losses. This upgradeable proxy had previously won four ETH-A liquidation auctions in 2020—auctions #1457 through #1460—earning 50 WETH per auction, but never called the deal() function, leaving the collateral locked in the Flipper. The withdrawal function in the implementation contract was not protected by ds-auth, allowing any caller to trigger it: first calling deal() on the old auctions, then transferring the collateral to the keeper via Vat.flux, and finally calling GemJoin.exit to send the 200 WETH to a specified address and unwrap them into ETH. The MakerDAO core contracts functioned as designed; the vulnerability stemmed from a third-party bot’s exit function lacking proper access controls.
The MakerDAO liquidation bot was drained of 200 WETH, resulting in a loss of approximately $538,000.
KuCoinFlashShare
Summary
A new address linked to Tornado Cash drained 200 WETH from a MakerDAO ETH-A liquidation bot on October 6, resulting in a $538,000 loss. The bot’s proxy, which had won four auctions in 2020, never executed the deal() function, leaving the collateral exposed. The withdrawal function lacked ds-auth protection, enabling the exploit. The incident underscores the risks in Proof of Stake (PoS) systems where smart contract security is critical. MakerDAO’s core contracts were unaffected, as the vulnerability resided in the third-party bot’s unprotected exit function.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.