Attacker Drains 200 WETH From Abandoned MakerDAO Keeper That Never Settled 2020 Auctions

On October 6, an attacker took 200 wrapped ether (WETH), worth about $538,000 to $543,000 at the time, from a liquidation keeper that a third party had deployed for MakerDAO's collateral auctions in 2020. The security monitor Defimon flagged the theft. Researchers have since added a working reproduction to the DeFiHackLabs repository (commit, earlier commit).

The keeper, an upgradeable proxy, won four ETH-A collateral auctions during the March 2020 crash known as Black Thursday (auction IDs 1457 to 1460, 50 WETH each). It never called deal() to settle them, so the 200 WETH stayed in Maker's ETH-A Flipper contract for six years. According to the DeFiHackLabs pull request, the function at selector 0x8804d1de has no authorization. It decodes an address and an amount and runs its body without checking the caller or the owner.

The attacker used that function to make the keeper settle the four stale auctions, which credited 200 WETH to the keeper's balance in the Vat, Maker's core accounting contract. The attacker then had the keeper call vat.hope() to authorize a worker contract the attacker supplied. The worker moved the collateral out through the join, flux and exit functions and unwrapped it to ether. The attack is an access-control failure. The funds reached the attacker's wallet within a minute, and Tornado Cash deposits began six minutes later in 10-ether batches. No freeze, recovery or attribution has been reported. MakerDAO's core contracts, which now back Sky's USDS ($7.03 billion in circulation according to DeFiLlama) and DAI ($4.77 billion), were not affected.