CertiK Flags Possible Exploit Involving MakerDAO Liquidation Keeper Bot

CertiK reported an issue involving a liquidation keeper bot associated with the MakerDAO protocol, drawing attention to operational risks that can arise from third-party automation used around DeFi systems. Keeper bots are external automated programs that monitor collateralized vaults and initiate liquidations when positions drop below required collateral ratios. While they are essential to day-to-day protocol functioning, they operate outside MakerDAO’s core smart contracts. As a result, a compromised keeper bot would not necessarily indicate a flaw in MakerDAO’s core protocol code, but it can still create material risk if manipulated to miss liquidations, execute at unfavorable prices, or lose funds held in the bot’s operating wallet. CertiK has previously highlighted the expanding attack surface created by DeFi automation, noting that AI-assisted attacks can tilt the balance against defenders. Keeper bots are considered attractive targets because they run autonomously and often control gas-funded wallets. MakerDAO maintains a security disclosure portal at security.makerdao.com, which the team treats as the primary channel for official updates. Readers seeking confirmed details are advised to monitor that site as information develops. In MakerDAO’s collateral framework, keeper bots compete to liquidate undercollateralized vaults and earn liquidation fees. If keepers fail or are tampered with, positions can remain unliquidated and leave the protocol exposed to bad debt. Similar outcomes have occurred during prior market stress events, when network congestion and missing keepers contributed to protocol losses. Potential keeper-bot attack paths can include draining ETH or stablecoin balances used for operations, front-running liquidation transactions, or coercing a bot into executing transactions that benefit an attacker rather than the protocol. CertiK has not confirmed which vector, if any, applies in this case. The broader theme extends beyond MakerDAO. Recent incidents across DeFi have shown that peripheral components—adapters, automation, and other supporting infrastructure—can be exploited even when core contract logic is not directly at fault. Examples referenced include a FlashLoopAdapter issue flagged by SlowMist that reportedly drained two Safe wallets, as well as losses cited at Maya Protocol ($1.7 million across six bugs) and a reported $10 million THORChain exploit impacting cross-chain assets. For now, the scope of the incident remains unverified pending a CertiK postmortem or an official statement from MakerDAO’s security team. No confirmed loss amount, affected wallet address, or transaction hash has been established based on the available information. The report underscores that keeper bots are foundational infrastructure. If a liquidation keeper fails during a sharp market move, the protocol’s solvency backstop can weaken at the moment it is most needed—one reason reports of this kind can matter even before the full picture is known. It remains to be seen whether the incident will lead MakerDAO to tighten third-party bot requirements or prompt broader changes in how DeFi protocols audit automation operating around their contracts. Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.