someone just pulled 200 WETH, about $538K, out of a bot that's been sitting dead since 2020.
it was a third-party liquidation bot for MakerDAO. in 2020 it won 4 ETH auctions, 50 WETH each, and never called the function to actually claim them. so the ETH just sat there.
the bot's withdraw function had no access check. anyone could call it.
today a fresh wallet funded through Tornado Cash did exactly that. MakerDAO's own contracts weren't touched. this was the bot's code.
nobody found a new trick here. someone just read old code more carefully than the people who wrote it.
same thing applies to us. old token approvals don't expire because you forgot about them.
when did you last check what your wallet has approved?
$ETH
NFA. DYOR.
#DeFi #CryptoSecurity #Ethereum
it was a third-party liquidation bot for MakerDAO. in 2020 it won 4 ETH auctions, 50 WETH each, and never called the function to actually claim them. so the ETH just sat there.
the bot's withdraw function had no access check. anyone could call it.
today a fresh wallet funded through Tornado Cash did exactly that. MakerDAO's own contracts weren't touched. this was the bot's code.
nobody found a new trick here. someone just read old code more carefully than the people who wrote it.
same thing applies to us. old token approvals don't expire because you forgot about them.
when did you last check what your wallet has approved?
$ETH
NFA. DYOR.
#DeFi #CryptoSecurity #Ethereum
