Dormant MakerDAO Keeper Drained of $538K via Unprotected Withdraw Function
- —200 WETH worth ~$538K drained from a dormant MakerDAO ETH-A keeper
- —Drain function with selector 0x8804d1de lacked ds-auth protection, authority set to 0x0
- —Keeper won four ETH-A auctions in 2020 but never called deal(), leaving 200 WETH in Flipper
- —Attacker used a fresh EOA funded through Tornado Cash
Why it matters: The incident highlights risks from legacy third-party DeFi components: dormant contracts can lose funds even without a core protocol breach.
Source: The Crypto Times