Defimon Alerts: A dormant third-party MakerDAO liquidation bot agent was withdrawn 200 WETH, resulting in a loss of approximately 538,000 USD

According to Defimon Alerts monitoring, a new address funded by Tornado Cash withdrew 200 WETH from a dormant MakerDAO ETH-A liquidation bot on October 6, resulting in a loss of approximately $538,000.

This upgradable proxy had won four ETH-A liquidation auctions in 2020 (numbers 1457 to 1460, each with 50 WETH), but did not call deal(), leaving the collateral in Flipper.

The withdrawal function of the implementation contract was not protected by ds-auth, allowing any caller to trigger it: first calling deal() on the aforementioned old auctions, then transferring the collateral to the keeper via Vat.flux, and subsequently using GemJoin.exit to transfer 200 WETH to the address specified by the caller and unpacking it into ETH. The MakerDAO core contracts operated as designed, with the vulnerability lying in the unprivileged exit function of the third-party bot.