The trend of decentralized finance means more and more funds are sent to smart contracts for various organizations. The most prominent one, Maker DAO, kept gathering millions of ETH as collateral, and prepares to accept multiple coins for holding.
But while the organization was growing, the smart contract also held a risky vulnerability. Recently, a bug reporter on HackerOne found a critical vulnerability that could steal the entire collateral during liquidation. The bug affected the protocol for multi-collateral DAI. So far, there is no information on the ETH collateral, and the Maker smart contract.
“A lack of validation in the method flip.kick allows an attacker to create an auction with a fake bid value,” state...