[Loss of approximately $538,000, Dormant MakerDAO Liquidation Bot Proxy Extracted 200 WETH] Odaily Planet Daily News: A new address funded by Tornado Cash extracted 200 WETH from a dormant MakerDAO ETH-A liquidation bot proxy on October 6, resulting in a loss of approximately $538,000. This upgradable proxy had won four ETH-A liquidation auctions in 2020, specifically auctions No. 1457 to No. 1460, earning 50 WETH in each auction. However, the `deal()` function was never called, leaving the collateral in the Flipper contract. The withdrawal function in the implementation contract was not protected by `ds-auth`, allowing any caller to trigger it. The process involved first calling `deal()` on the aforementioned old auctions, then transferring the collateral to the keeper via `Vat.flux`, and finally calling `GemJoin.exit` to transfer the 200 WETH to an address specified by the caller and unpacking it into ETH. MakerDAO's core contracts operated as designed, with the vulnerability stemming from the third-party bot's withdrawal function lacking access control.