Dormant MakerDAO ETH-A liquidation keeper proxy drained of 200 WETH (~$538K) via unprotected exit function on upgradeable proxy missing access control.
Security & Exploits ·
A dormant MakerDAO liquidation keeper contract lost approximately 200 WETH (~$538K) after an attacker exploited an unprotected exit function on the proxy's implementation. The keeper, deployed in 2020, had won four ETH-A liquidation auctions between 2020 and now, accumulating 50 WETH from each (#1457–1460), but never executed the settlement step to claim the collateral. The attacker, operating via a freshly funded address, invoked the drain function and withdrew all 200 WETH to an external recipient.
The vulnerability lay in the keeper proxy's implementation contract, which included an exit routine lacking any access control checks. The drain selector (0x8804d1de) was callable by anyone; once invoked, it triggered the settlement flow—calling Flipper.deal() on the old auctions, moving collateral via Vat.flux to the keeper, and then exiting the full WETH balance through GemJoin to the attacker's destination address before unwrapping to ETH. MakerDAO's core contracts (Vat, Flipper, GemJoin) operated correctly; the flaw was isolated to this third-party keeper's unprotected exit mechanism.
The keeper has remained inactive since 2020, suggesting the proxy and its implementation were abandoned. Whether the original deployer retained awareness of the dormant collateral or the proxy's authentication state remains unclear.