🚨 MakerDAO ETH-A Liquidation Keeper Bot - Loss ~$538K (2026-10-06)

Token: $WETH
Network: Ethereum

Type: Access Control (missing auth on keeper proxy)

A Tornado-funded fresh EOA drained a dormant (2020) MakerDAO flip-keeper proxy. The keeper (upgradeable proxy 0x9c05…8273, impl 0x6839…5546) had won four ETH-A liquidation auctions (#1457–1460, 50 WETH each) back in 2020 and never called deal(), leaving 200 WETH of collateral locked in the ETH-A Flipper. The impl's drain routine (sel 0x8804d1de) was NOT protected by ds-auth (owner=0xadc374e7, authority=0x0), so any caller could invoke it: it calls Flipper.deal() on the keeper's old auctions → Vat.flux the collateral to the keeper → GemJoin.exit() 200 WETH to an attacker-supplied recipient → unwrap to 200 ETH. MakerDAO core (Vat/Flipper/GemJoin) behaved as designed; the flaw is the third-party keeper's unprotected exit function.

TX: https://etherscan.io/tx/0xbb6940f7c2a1e68cafbae7bb9b94d09af9af06ec3a114f6996f2cab993f3a88c
Attacker: https://etherscan.io/address/0x01eb957e5c7dcddd60f3c875956ccc6fb9bda5fa
Victim: https://etherscan.io/address/0x9c05a05893ada984fc20d0da0c046de5cc0e8273 (unverified impl)

@defimon_subscription_bot