MakerDAO has patched a "critical" bug in its yet-to-be-launched Multi-Collateral Dai (MCD) upgrade that could have put more than 10% of the system's total collateral at risk.

The bug was caught by HackerOne user lucash-dev, who reported it via the HackerOne forum and received a $50,000 bounty for uncovering the potentially devastating flaw.

"Our auction system allowed the potential attacker to create a fake auction, basically offering very little collateral for a large amount of DAI," Chris Smith, a senior software engineer for MakerDAO, told CoinDesk. "The system would trust that number and use it as credit against collateral in the system, allowing the hacker to basically take that other collateral out of the system."

The bug could have devastated MakerDAO's planned MCD. Lucash-dev said in his report that it "allows an attacker to steal ALL collateral stored in the MCD system during the liquidation phase – possibly within a single transaction."

Lucash-dev told CoinDesk:

But neither the bug nor the MCD upgrade host ever went live – it was caught during the testing phase, before any users had access to the system.

Both lucash-dev and MakerDAO engineers told CoinDesk that no user funds were ever placed at risk.

Under the new MCD, users will be able to stake cryptocurrencies other than ETH as collateral to issue new Dai. The value of these "collateralized debt positions'' has to match the Dai in circulation as Dai is a representative currency – much like the US dollar was when it was backed by gold. Certain users can trigger a liquidation mode to balance out the system.

Lucash-dev told CoinDesk that the system had a fault:

The bug exploited MCD’s kick contract implementation that allowed users to post phony auctions, issue DAI, and then cash out collateral.

Wouter Kampmann, head of engineering for MakerDAO, said that bug tracking events like this were routine.

"Its through processes like these that you get through the system and make sure that it's absolutely as secure as possible before you launch it."

The bug was posted on August 28 and patched by September 26. Lucash-dev disclosed it to the public on October 1.

Hacker image via Shutterstock