Black Thursday revisited: MakerDAO keeper exploited for $500K

A legacy MakerDAO auction-keeper contract has been exploited for over $500,000, with the exploit reaching back to Black Thursday in 2020.

Specifically, a CertiK analysis details how an attacker was able to remove 200 $ETH from a contract described as a “legacy auction-keeper.”

This auction-keeper contract was one of the first on Black Thursday in March 2020 to win $ETH from MakerDAO for “zero bids” during the liquidation crisis, and four 50-$ETH lots were never settled — something the hacker was able to take advantage of.

According to CertiK’s analysis “the root cause was a missing access control on function 0x8804d1de in keeper implementation 0x68399ed8aa33C5b43F863EE6782de492006A5546.”

Using this exploit, the attacker was able to gain access to four lots of 50 $ETH that remained from the original Black Thursday crisis.

These funds were then sent in 10-$ETH lots through Tornado Cash.

This contract wasn’t a core part of the current Sky ecosystem, however, this does serve as a reminder of the long tail of cryptocurrency risks.

Even contracts that haven’t been central for half a decade can still be lucrative targets for attackers if they contain real value.