Worked example · 2026-10

MakerDAO legacy auction keeper — four lots won with zero bids on Black Thursday sat unsettled for six and a half years behind a function that never checked its caller — third-party keeper on MakerDAO / Ethereum — 2026-10-06

Loss

200 ETH (~$543K per CertiK; ~$538K per Defimon) — the collateral from ETH-A Flipper auctions #1457–#1460 (50 ETH each), won by this keeper with zero bids in March 2020 and never deal()-settled. MakerDAO's core contracts behaved as designed.

OAK Techniques observed

OAK-T9.004 (Access-Control Misconfiguration — primary, confirmed. Function selector 0x8804d1de in the keeper implementation lacked the ds-auth check its other privileged functions had, accepted any address as an "adapter," called Vat.hope on it and then its join(). The attacker's module ran with Vat delegation over the keeper's account, called deal() on the retired Flipper, flux()-moved 200 ETH to itself, and exited through ETH-A GemJoin as WETH. See techniques/T9.004-access-control-misconfiguration.md). OAK-T11.013 (Legacy-Version Maintenance Attack Surface — the keeper was dormant since 2020 and held claimable value nobody was watching).

Attribution

pseudonymous. Attacker EOA 0x01EB957E5C7DcDDD60F3C875956cCc6fb9BdA5FA, funded by a single 0.1 ETH Tornado Cash withdrawal 16 minutes before the exploit; proceeds returned to Tornado Cash in 10 ETH deposits.

Key teaching point

Unclaimed value does not expire; it waits for the first caller. The collateral was the keeper's from the 2020 Black Thursday zero-bid auctions; the only thing standing between it and anyone was one unauthenticated function. Settling or sweeping what a retired contract is owed is part of retiring it.