CertiK: MakerDAO's leftover auction contract was exploited, and the attacker took away 200 ETH

Security company CertiK's analysis shows that a legacy MakerDAO auction keeper contract was exploited, with the attacker taking away 200 ETH, worth over $500,000. CertiK stated that the root cause was the lack of access control for the 0x8804d1de function in the keeper implementation contract.

This contract was involved in the "Black Thursday" liquidation crisis in March 2020, when it won ETH with zero bids, with four transactions of 50 ETH each remaining unsettled. The attacker took this batch of funds and transferred them out in amounts of 10 ETH each via Tornado Cash. Although this contract is not currently a core part of the Sky ecosystem, old contracts with remaining funds may still become targets for attacks.