MakerDAO Liquidation Bot Agent Withdraws 200 WETH, Incurring Losses of Approximately $538,000

On October 6, a new address funded by Tornado Cash withdrew 200 WETH from a dormant MakerDAO ETH-A liquidation bot agent, incurring losses of approximately $538,000. This agent had won four ETH-A liquidation auctions in 2020 but did not call the deal, leaving the collateral in Flipper. The withdrawal function was not protected by ds-auth, allowing any caller to trigger it. The caller first invoked the deal on the old auction, then transferred the collateral to the keeper via Vat.flux, and finally used GemJoin.exit to transfer 200 WETH to a specified address and unwrap it into ETH. The MakerDAO core contracts operated as designed, with the vulnerability lying in the unprivileged exit function of the third-party bot.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.