Legacy MakerDAO Auction Contract Exploited, 200 ETH Taken

A legacy MakerDAO auction keeper contract was exploited, allowing an attacker to take 200 Ether (ETH) worth more than $500,000 from funds left in the contract.

CertiK identified missing access controls in the implementation contract’s 0x8804d1de function as the root cause. The contract was involved in MakerDAO’s March 2020 “Black Thursday” liquidation crisis, when it acquired Ether through zero-bid auctions.

Four lots of 50 ETH each remained unsettled after the crisis. The attacker used those funds and transferred them through Tornado Cash in four 10-ETH transactions.

The contract is not part of the current core Sky ecosystem, but other older contracts that still hold funds may remain exposed to similar attacks.