A legacy MakerDAO auction-keeper contract has been exploited for over $500,000, with the exploit reaching back to Black Thursday in 2020.
Specifically, a CertiK analysis details how an attacker was able to remove 200 ETH from a contract described as a “legacy auction-keeper.”
This auction-keeper contract was one of the first on Black Thursday in March 2020 to win ETH from MakerDAO for “zero bids” during the liquidation crisis, and four 50-ETH lots were never settled — something the hacker was able to take advantage of.
Read more: Tether has publicly listed a company that partially controls USDS
According to CertiK’s analysis “the root cause was a missing access control on function 0x8804d1de in keeper implementation 0x68399ed8aa33C5b43F863EE6782de492006A5546.”
Using this exploit, the attacker was able to gain access to four lots of 50 ETH that remained from the original Black Thursday crisis.
These funds were then sent in 10-ETH lots through Tornado Cash.
This contract wasn’t a core part of the current Sky ecosystem, however, this does serve as a reminder of the long tail of cryptocurrency risks.
Even contracts that haven’t been central for half a decade can still be lucrative targets for attackers if they contain real value.
Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.
The post Black Thursday revisited: MakerDAO keeper exploited for $500K appeared first on Protos.
