MakerDAO ETH-A Liquidation Keeper Bot hacked for ~$538K
RootCause: Access Control vulnerability - Flipper.deal() on the keeper's old auctions → Vat.flux the collateral to the keeper → GemJoin.exit() 200 WETH to an attacker-supplied recipient → unwrap to 200 ETH
TX: https://etherscan.io/tx/0xbb6940f7c2a1e68cafbae7bb9b94d09af9af06ec3a114f6996f2cab993f3a88c
Attacker: https://etherscan.io/address/0x01eb957e5c7dcddd60f3c875956ccc6fb9bda5fa
Victim: https://etherscan.io/address/0x9c05a05893ada984fc20d0da0c046de5cc0e8273 (unverified impl)
@EthSecurity1
Post #113477
27