A legacy MakerDAO auction-keeper contract was exploited on October 6, allowing an attacker to extract 200 ETH worth approximately $543,000 from collateral tied to liquidation auctions dating back to the 2020 Black Thursday crisis. According to CertiK’s incident analysis, the attacker abused a missing access-control check to obtain authority over the keeper’s MakerDAO Vat account and settle four long-dormant ETH-A auctions.
The exploit occurred at 06:13:11 UTC and involved auction IDs 1457 through 1460, each containing a 50 ETH lot that the keeper had won with a zero bid in March 2020 but never settled. Those four unsettled auctions created the economic value that made an old authorization flaw exploitable more than six years later. The incident affected legacy auction infrastructure rather than Ethereum itself or evidence of a compromise to Sky’s current core contracts.
Missing Access Control Exposed the Keeper’s Vat Account
CertiK traced the root cause to function 0x8804d1de in the keeper implementation contract. Unlike other privileged functions protected by Maker’s ds-auth authorization system, this function accepted an arbitrary adapter address without first checking whether the caller was authorized. That allowed the attacker to supply a malicious module and cause the keeper to grant it unrestricted Vat.hope() delegation.
Once delegated, the malicious adapter called deal() on the four retired ETH-A Flipper auctions. Settlement credited the corresponding 200 ETH of collateral to the keeper’s Vat account, after which the attacker used the newly granted authority to move the collateral out, exit it through the ETH-A GemJoin as WETH and transfer it to the attacking contract. The loss therefore resulted from an authorization failure combined with forgotten unsettled collateral, not from breaking MakerDAO’s auction mathematics or Ethereum consensus.
The attack also left a residual concern. CertiK said the malicious adapter still retained delegation over the keeper’s Vat account because the vulnerable function granted authority through hope() but never subsequently revoked it with nope(). In this case, however, the four historical auction lots supplied the immediately extractable value identified in the incident.
Six minutes after the exploit, the attacker began transferring the proceeds through Tornado Cash. Onchain tracing identified 20 separate deposits of 10 ETH, covering the entire 200 ETH balance, with the laundering sequence completing within roughly nine minutes. The attacker’s wallet itself had been funded shortly before the exploit through a 0.1 ETH Tornado Cash withdrawal.
Legacy Contracts Remain Part of DeFi’s Risk Surface
MakerDAO’s old auction-keeper repository was archived in April 2023 and is now read-only. The software was originally designed to let automated keepers discover, bid on and settle Maker collateral auctions, including the earlier flip liquidation system. Archiving the software did not remove the deployed contracts or settle every historical position associated with them.
That pattern has surfaced elsewhere in DeFi. A legacy Thetanuts Finance vault exploit showed how retired infrastructure can remain economically active when old contracts still hold assets, while stale ERC-20 approvals have exposed users long after applications were deprecated. Migration or deprecation reduces operational relevance, but it does not automatically eliminate onchain permissions, balances or callable logic.
The Maker incident differs from approval-based drains such as the Matcha Meta SwapNet exploit, where attackers abused user-granted token allowances. Here, the vulnerable authority existed inside a legacy keeper’s own Maker accounting relationship. The common security lesson is lifecycle management: contracts that retain assets or privileges remain part of the attack surface even after the surrounding product has effectively disappeared.
For Sky and other long-running DeFi systems, the incident highlights the value of auditing dormant contracts alongside active protocol components. The 200 ETH loss was not caused by a newly introduced bug, but by old code, old authorization and four unsettled auctions that remained economically relevant for more than six years.
Natalie Pierce tracks the parts of crypto that move fast and rarely wait for everyone to catch up. From South Africa, she covers DeFi, AI crypto, hacks, airdrops, sentiment and emerging narratives, especially when user behavior and protocol risk start to overlap.
Her reporting is built for messy sectors. Natalie looks at incentives, reactions, security concerns, social momentum and early signs of traction without pretending every new trend is already proven. Her voice is clear and accessible, but careful enough for areas where excitement can outrun the facts very quickly.