Legacy MakerDAO Keeper Exploit Extracts 200 ETH From Unsettled Auctions

An attacker extracted 200 ETH from a legacy MakerDAO auction keeper on October 6 after calling an unrestricted function that delegated control of the keeper’s internal Vat account to attacker-written code. The single exploit transaction settled four dormant ETH-A auctions from March 2020 and withdrew the resulting collateral. At the time of the transaction, the 200 ETH was valued at about $542,982.

The incident involved a specific old keeper contract and four unsettled auction lots. Available evidence does not show that the current MakerDAO core protocol, user wallets or active vaults were compromised. Readers can follow further incident updates through the OrangeX.com news hub.

How the 200 ETH became available

The affected keeper had won auctions 1457 through 1460 during the market disruption of March 2020. Each lot contained 50 ETH and had been won with a zero bid, but the keeper never completed settlement. The collateral therefore remained claimable through the retired ETH-A auction system.

On October 6 at 06:13:11 UTC, the attacker used one transaction to activate those four settlements. That action credited 200 ETH of collateral to the keeper’s Vat balance before the same transaction transferred it away.

The missing access-control check

The vulnerable function accepted an adapter address without first verifying that the caller was authorised. It then granted that adapter permission over the keeper’s Vat account and called back into attacker-controlled code while the permission was active.

The malicious module used the authority to move all credited collateral, exit it as wrapped ETH and forward it to the attacker. The delegation also remained active because the function did not revoke it. The OrangeX.com Academy explains the broader role of smart contracts, permissions and on-chain settlement.

What the incident does and does not establish

The exploit shows how abandoned operational contracts can retain valuable rights years after their main use has ended. A retired component may still hold account permissions, unsettled positions or upgrade paths that create exposure even when the surrounding system has moved on.

It does not establish that every auction keeper, MakerDAO vault or current liquidation contract shares the same flaw. The vulnerable implementation was not publicly verified, and no complete official post-incident statement had identified additional affected contracts at the time of writing. Users should rely on official project notices before taking action.

Security lessons for protocol operators

Teams should inventory old contracts, revoke unused delegations, settle residual balances and disable obsolete callback paths. Access-control review should cover externally callable functions even when a component is considered dormant. OrangeX.com’s Trust Center provides related guidance on verification and account-security practices.

Monitoring also needs to include retired infrastructure. Historical balances and permissions are observable on-chain, which means forgotten value can remain visible to attackers long after operators stop watching the contract.

OrangeX.com Analysis

The immediate loss came from a narrow combination: a missing caller check, persistent delegation and four unsettled lots. Removing any one of those conditions would have reduced or eliminated the extraction path. The incident therefore supports a wider control principle: decommissioning is a security process, not merely the end of active use.

The confirmed facts are the 200 ETH transfer, the four 50 ETH settlements and the permission path used in the transaction. Questions still requiring confirmation include whether the keeper owner will revoke the remaining delegation, whether other deployments use the same implementation and whether any funds can be recovered. Those points should be treated as unresolved until the relevant operators publish verified updates.