$500K Drained Through Exploit of Outdated MakerDAO Contract
Security firm CertiK has detailed an exploit targeting a legacy smart contract within the MakerDAO ecosystem. An attacker leveraged a missing access control vulnerability to withdraw 200 Ether (ETH), worth approximately half a million dollars.
The Flaw: A Function Without a Lock
At the heart of the exploit is a specific function, 0x8804d1de. CertiK's analysis reveals that this function lacked proper permission checks, allowing any external actor to invoke it. The contract in question is a historical component, not part of MakerDAO's current active infrastructure.
Assets Frozen in Time Since "Black Thursday"
This contract played a role during the March 2020 "Black Thursday" market crash, a period of mass liquidations in DeFi. It had successfully won several ETH auction lots with zero bids at the time.
- Dormant Funds: Four lots of 50 ETH each from those auctions had never been settled and remained locked in the contract.
- The Attack: The exploiter called the vulnerable function to claim ownership of these 200 ETH.
- Funds Movement: After acquisition, the funds were routed through a privacy-enhancing protocol to obfuscate their trail.
Legacy Risk: A Persistent DeFi Challenge
Even though the contract was inactive in MakerDAO's core operations, the valuable assets it held made it a target. This incident underscores a critical, often overlooked security consideration in decentralized finance: a smart contract deployed on-chain remains a risk vector if flawed, regardless of whether it is still in active use.
For DeFi projects and auditors, it serves as a stark reminder. While focusing on the security of cutting-edge protocols is essential, establishing ongoing monitoring and management procedures for outdated contracts and their assets is equally crucial to prevent "zombie contracts" from becoming an ecosystem's weak link.