Expert Highlights Potential $756 Million Vulnerability in Sky

William Morriss, founder of VM Capital, criticized Sky (formerly MakerDAO) for utilizing an EOA to store $756 million in USDC reserves within the LitePSM mechanism.

@SkyEcosystem (formerly MakerDAO) is letting an EOA custody 756M USDC for their “Lite PSM”. As far as I can tell, that account can rug the full balance any time.

— wjmelements (@willmorriss4) December 6, 2024

This iteration of the DAI stablecoin’s stability module was implemented by developers in July.

Morriss, who previously worked as an engineer at TrustToken and MetaMask, considers the decision to rely on an external account unsafe. Standard Ethereum wallets in the EOA format are managed using a private key, which is susceptible to compromise and other malicious activities.

“As far as I can tell, that account can have its entire balance stolen at any moment,” the programmer believes.

The project team is gradually migrating assets to LitePSM, initially transferring 20 million USDC.

Sky co-founder Rune Christensen told Cointelegraph that “the private keys necessary to restore the MPC account were destroyed during the setup process with Coinbase Custody.”

The publication noted that this partially mitigates the risk of account compromise but does not address who controls the wallet and authorizes transactions.

Back in August, a Sky user lost $55.47 million in DAI on a DeFi platform due to a phishing attack.