הסיווג ושיטת התקיפה משקפים את דיווחי המקורות. תיאורים מפורטים מוצגים בשפת המקור; לקריאת התחקיר המלא ניתן לפתוח את הקישור המצורף.
DefiLlamaתיאור המקור באנגלית
A dormant third-party MakerDAO ETH-A liquidation keeper had an unprotected drain routine that lacked ds-auth authorization. Any caller could invoke the function and provide the withdrawal recipient. The attacker triggered Flipper.deal() for four auctions the keeper had won in 2020, causing 200 WETH of previously unclaimed collateral to move through Vat.flux to the keeper, then used GemJoin.exit() to send it to an attacker-controlled recipient and unwrap it to ETH. MakerDAO’s core contracts behaved as designed; the vulnerability was in the third-party keeper
SlowMistתיאור המקור באנגלית
A Tornado Cash-funded address called an unprotected drain function on a dormant MakerDAO ETH-A liquidation keeper. The upgradeable proxy had won auctions #1457–1460 in 2020 (200 WETH total) but never called deal(), leaving the collateral in the Flipper. The attacker called deal(), moved the collateral to the keeper via Vat.flux, then used GemJoin.exit() to withdraw 200 WETH to an attacker-chosen address and unwrap it to ETH. The flaw was in the third-party keeper, not MakerDAO core.
הסיווג ושיטת התקיפה משקפים את דיווחי המקורות. תיאורים מפורטים מוצגים בשפת המקור; לקריאת התחקיר המלא ניתן לפתוח את הקישור המצורף.
DefiLlamaתיאור המקור באנגלית
A dormant third-party MakerDAO ETH-A liquidation keeper had an unprotected drain routine that lacked ds-auth authorization. Any caller could invoke the function and provide the withdrawal recipient. The attacker triggered Flipper.deal() for four auctions the keeper had won in 2020, causing 200 WETH of previously unclaimed collateral to move through Vat.flux to the keeper, then used GemJoin.exit() to send it to an attacker-controlled recipient and unwrap it to ETH. MakerDAO’s core contracts behaved as designed; the vulnerability was in the third-party keeper
SlowMistתיאור המקור באנגלית
A Tornado Cash-funded address called an unprotected drain function on a dormant MakerDAO ETH-A liquidation keeper. The upgradeable proxy had won auctions #1457–1460 in 2020 (200 WETH total) but never called deal(), leaving the collateral in the Flipper. The attacker called deal(), moved the collateral to the keeper via Vat.flux, then used GemJoin.exit() to withdraw 200 WETH to an attacker-chosen address and unwrap it to ETH. The flaw was in the third-party keeper, not MakerDAO core.
