A dormant third-party MakerDAO liquidation bot proxy was drained of 200 tokens WETH, with losses of approximately 538000 USD
BIBIBI
AT A GLANCE
A dormant third-party MakerDAO liquidation bot proxy was drained of 200 tokens because its exit function lacked access controls.WETH。
Article
A dormant third-party MakerDAO liquidation bot proxy was drained of 200 tokens WETH, with losses of approximately 538000 USD According to BlockBeats,October 6, Defimon Alerts monitoring found that a new address funded via Tornado Cash October 6 withdrew funds from a dormant MakerDAO ETH-A liquidation bot proxy: 200 WETH, with losses of approximately 538000 USD. The upgradeable proxy had won 2020 liquidation auctions in ETH-A(No. 1457 to 1460, 50 each), but did not call WETH(), leaving the collateral in deal.
The implementation contract's withdrawal function was not protected by Flipper, allowing any caller to trigger it: first, call ds-auth() on the old auctions above; then use deal to move the collateral to Vat.flux; subsequently,keeper transfers GemJoin.exit 200 to the caller-specified address and unwraps it into WETH. The ETH。MakerDAO core contract operated as designed; the vulnerability was the third-party bot's unprotected exit function.
Original link https://m.theblockbeats.info/flash/370419
Key points
01
According to BlockBeats, Defimon Alerts monitoring found that a new address funded via Tornado Cash October 6 withdrew funds from a dormant MakerDAO ETH-A liquidation bot proxy: 200 WETH。
02
The report estimates losses of approximately 538000 USD。
03
The upgradeable proxy had won 2020 liquidation auctions, No. 1457 to 1460, in ETH-A; each involved 50 WETH。
04
The report states that the proxy did not call deal(), so the collateral remained in Flipper.
05
The implementation contract's withdrawal function was not protected by ds-auth, allowing any caller to trigger it.
06
The report describes the withdrawal process as follows: call deal() on the old auctions, use Vat.flux to move the collateral to keeper, then GemJoin.exit transfers 200 WETH to a caller-specified address and unwraps it into ETH。
07
The report explicitly states that the MakerDAO core contract operated as designed and that the vulnerability was in the third-party bot's unprotected exit function.
AI-assisted interpretation
The following is analysis, separate from reported facts. Verify important claims independently.
This was not a failure of the MakerDAO core contract, as reported, but rather a third-party liquidation bot proxy that did not restrict who could call its withdrawal function. According to the report, the caller used this function to settle previously unfinished auctions and transfer out the retained WETH, unwrapping it into ETH。
Why it matters to readers
The incident shows that long-term dormancy does not mean assets in a contract are secure; if a third-party proxy's asset exit function lacks access controls, any caller may trigger a transfer of funds. The report involves 200 WETH and estimates losses of approximately 538000 USD。
Beginners should distinguish between a protocol's core contracts and third-party bots that integrate with the protocol: an access-control vulnerability in a third-party program does not mean that the core protocol itself has been compromised. Before using or authorizing a smart contract, check whether its fund-withdrawal functions restrict callers.
Risks and unknowns
The supplied information does not provide the affected proxy contract address, transaction hash, or recipient address, so the on-chain process cannot be independently verified on this basis.
The information does not state whether the bot operator has confirmed the losses or taken remedial action.
It remains unclear whether other third-party proxies use the same unprotected exit implementation.
“Funded via Tornado Cash” is only a monitoring description in the report; the supplied information provides no further evidence.
Related Developments
Loading event timeline…
Related concepts
WETH
This term is not in the glossary yet. Browse related concepts in the glossary.
