Loss of approximately $538,000: A dormant MakerDAO liquidation bot proxy was drained of 200 WETH

a new address funded via Tornado Cash extracted 200 WETH on October 6 from a dormant MakerDAO ETH-A liquidation bot proxy, causing losses of approximately $538,000. The upgradeable proxy had won 4 ETH-A liquidation auctions in 2020, namely auctions #1457 through #1460, earning 50 WETH each, but never called deal(), leaving the collateral stuck in the Flipper. The implementation contract's exit function was not protected by ds-auth, allowing any caller to trigger it: first calling deal() on the aforementioned old auctions, then transferring the collateral to the keeper via Vat.flux, and subsequently calling GemJoin.exit to send the 200 WETH to a caller-specified address and unwrap it into ETH. The MakerDAO core contracts operated as designed; the vulnerability lies in the third-party bot's exit function lacking access controls.