blockful.eth

Most ENS just sits in wallets doing nothing. The ENS Delegation Incentives Program changes that: delegate to an active delegate and you earn rewards from the ENS DAO while making ENS governance stronger. And the more holders join, the bigger the reward pool gets for everyone. 🧵

Yesterday, @binance was hacked and $6.3B was stolen. It is already the largest heist in history. After stealing the funds, the hacker deposited $60M in USDT on @aave and borrowed $44.6M in ETH from the protocol. The strategy is similar to the one used by the KelpDAO hacker earlier this year, but with a different goal. The hacker swapped USDT, which Tether can freeze, for ETH, which no one can freeze. That way they “lose” $16M from the attack, but lower the risk of having the stolen funds frozen. @LlamaRisk and other Aave risk managers froze all Aave v3 and v4 markets to stop the hacker from using other stolen tokens as collateral to borrow more from the protocol. The situation is not as bad as the KelpDAO theft, because the collateral is USDT rather than some illiquid token. Still, this money will need to be returned to Binance at some point - and that may be a problem Aave has to deal with.

In early October, we reported on the attempted attack on @letsgethai . The attempt was stopped, but the attacker went on to launch a series of attacks on the protocol's governance: more than 1,000 proposals submitted - and any one of them could have drained the DAO's entire treasury. @letsgethai contributors stayed active and built a bot called "Hai Commander" to vote NO on every potentially malicious proposal, so they didn't have to block the attacks manually. This is the risk of having not only a low quorum, but also no limit on proposals per address in governance.

Over the weekend, another abandoned governance was attacked, and $4.75M was stolen. This attack stands out because of how the targeted governance worked. x100 DAO operated like a multisig: the 3 wallets with the most locked tokens could not only submit but also immediately approve any proposal, as long as 2 of them agreed. To make matters worse, wallets' voting power for governance purposes was counted in the same second/block. There was no snapshot taken at a prior block - a common practice to prevent flash loan attacks, where attackers borrow voting power to drain DAO funds. With no flash loan protection and power concentrated in the 3 largest addresses, x100 DAO was drained. In a single transaction, the attacker: - Took out a $1.9M flash loan - Bought 38,200 $X, x100 DAO's governance token, and split it across 2 addresses - Locked 19,000 $X in each address, taking control of the DAO's 2 most powerful wallets - Using a fake $X pool the attacker had created earlier, sent 400,000 $X from the treasury into that pool and swapped it for just $35 - Took the 400,000 $X out of the pool and sold it on a "real" pool for $6.7M - Finally, sold $1.9M worth of $X to repay the flash loan, walking away with $4.75M from the operation. On top of that, right after the attack, other attackers spotted the vulnerability and decided to exploit it too, stealing another $100K after the first one. The issue at x100 DAO was an old and common vulnerability in past governance systems, and it has now joined the hall of exploited abandoned governances.

This week, a PHP vulnerability shook the world: ~70% of websites worldwide run on PHP, one of the most common languages on the entire internet. But how did it affect crypto projects? According to @SlowMist_Team, of the 1,488 crypto-related domains they mapped, 53.3% were using PHP. Those 793 sites could have been at risk due to this week's vulnerability. For crypto projects, the PHP flaw could have had impacts ranging from users being tricked into signing malicious transactions through front-end tampering to compromised payment plugins and APIs.

A big moment for @ensdomains

After all the debates around @aave and the disputes between Aave Labs and the Aave DAO, a proposal seeks to create the Aave Foundation. Its creation stems from the Aave Will Win proposal, which promised to establish a way to protect Aave's brand and intellectual property. This foundation will be responsible for holding the brand and IP of the Aave protocol. The foundation will have no members, but it will have an independent director and supervisor who can represent it legally. Cayman Islands were chosen so the structure can operate without members. For now, the proposal only asks for approval from $AAVE holders, but the final text will include the amounts to be used to pay the director and supervisor, as well as to set up the foundation in the Cayman Islands.

The final round of ENS’s incentive program has been distributed! In total, 8,000 ENS were distributed to 697 different wallets as a reward for delegating their tokens to Active Delegates in the ENS DAO. That’s 3,000 more tokens than the previous round 👀 With the results of this final round, we’ll produce a report with the key takeaways from running an incentive program to make $ENS holders more active. It will be shared on the ENS forum and explained here on X.

Last week, a DAO on Solana faced an attempted attack. @MarinadeFinance, a staking project on Solana, received 2 malicious proposals in its governance. To participate in its governance, you need to stake its token, $MNDE, and lock it for a set period. The longer the lock, the greater the voting power. The attacker found a bug in the contract: by calling the contract that counts addresses' voting power (the Voter Stake Registry, or VSR) hundreds of times, they could inflate their voting power. This gave them enough power to pass a proposal while staking only a small amount of tokens. They then submitted 2 proposals: one replaced Marinade's vote-counting contract with one supplied by the attacker; the other drained its treasury. So the attacker wanted not only to steal Marinade's funds, but to take control of all its contracts, potentially stealing from all of its users. The attack was stopped thanks to Marinade's Security Council, which was able to veto the proposal. Shortly after the veto, the VSR bug was fixed.

Tensions in @Compound_xyz governance reached a peak this Friday. Humpy, a well-known DAO attacker, has been putting pressure on Compound governance through Ugur Mersin. Ugur works at API3, a company that has a commercial relationship with Humpy through its dCOMP product. Humpy has been using dCOMP to post his $COMP as collateral and, potentially, increase his voting power in Compound. Today, he is the DAO's largest individual $COMP holder. Ugur/Humpy have already managed to block a proposal to renew Compound's Security Service Providers. Now, they've submitted an on-chain proposal that, among other things, would allow governance to cancel transactions from the group responsible for managing the DAO's treasury (TMC). This would let Humpy block that group's transactions. While the forum and governance are open to criticism, the strategy of spamming forums and disrupting the DAO's operations is a pattern seen in Humpy's past attacks on Sushi, Balancer, and others. Compound has a multisig capable of canceling malicious proposals, but if it has to use that power to stop Ugur/Humpy's proposals, it could put even more strain on its governance. We're glad to have contributed to the Compound, not only by identifying the relationship between Ugur/API3 and Humpy's use of his voting power to push his agenda through governance, but also by showing how dCOMP has been key to increasing his influence in Compound. If you'd like to learn more, we recommend reading our research about Humpy, dCOMP and Compound.

Someone tried to manipulate the outcome of a governance proposal by manipulating an oracle, but not in the way we usually see in protocol attacks. Hackers commonly manipulate token prices to attack projects. In this case, someone wanted to turn a "NO" into a "YES." A DAO called Potion uses SafeSnap, an architecture made up of three parts: a multisig wallet (Safe), the Reality Module, and an oracle, Reality.eth. The project's funds are held in the Safe. As a rule, the funds can be moved by its signers, but this can also be done through the Reality Module. This module works with Reality.eth, an oracle whose participants are responsible for reporting whether a proposal submitted to governance was approved or not. So anyone using Reality.eth is trusting the judgment of those who monitor and maintain this decision oracle. An attacker submitted a proposal through Potion DAO's Snapshot and, in its text, included a link to a broken image, injecting malicious code into the "onerror" parameter. Whenever someone opened the proposal and the browser failed to load the image, the injected code would run automatically. The code did something simple: if the person voted NO on the proposal, it automatically switched the vote to YES. It acted as a layer between the voter and their wallet. Since the only people who open these proposals and vote on them are the Reality.eth oracle participants, if the attacker submitted a proposal to drain Potion DAO's treasury and they voted NO, they would actually be voting YES without even knowing it. It's a clever attack that exploits the design of Reality Module proposals to inject malicious code. An update was released after the attempted attack, fixing the vulnerability in the mechanism.

Last week, we covered an attempted attack on Rarible's governance while it was still in progress. Thanks to its Security Council, the attack was stopped. Rarible joins the list of abandoned governance systems that have been targeted over the past few months. To better understand how the attempted attack was carried out, read the article 👇

This is the last week to earn $ENS just by delegating your $ENS to an Active Delegate. The final round of the incentives program can distribute up to 10,000 $ENS to those who delegate their tokens to someone who participates in ENS governance. Don't miss out: find an Active Delegate at the link below and delegate your $ENS NOW 👇 incentives.ens.blockful.io/

Yesterday, @Scroll_ZKP held its first governance call in months. During it, the team outlined a series of changes planned for the end of 2026. They include: - A full shift in focus toward AI, aiming to compete with OpenRouter - $SCR staking to participate in this ecosystem, and $USX for payments - No longer permissionless, but now permissioned

Another abandoned governance is under attack - this time it's Rarible's. @rarible was a well-known NFT marketplace between 2020 and 2022. It moved millions of dollars during the NFT frenzy. The protocol and its treasury are governed by $veRARI holders - locked $RARI - using veNomics to set voting power in the DAO, just like Curve does. On September 20, a wallet bought 3.5 ETH worth of $RARI and locked it in Rarible's contracts, receiving 132,576 veRARI in voting power. Moments later, the same wallet submitted a proposal from a supposed activist investor called Falcon. According to the proposal text, they would "unlock veRARI's value for its holders." In practice, if approved, the proposal transfers ownership of all contracts to "Falcon." The voting period ends on September 25 at 08:53 UTC. Rarible DAO has a Security Council, so it is able to block the attack, if it manages to get the multisig signers who control the Council to act in time. The strangest part of this attack is that Rarible has only $368 in its treasury, yet the attackers spent $9,311 to capture its governance. Like other attacks, they don't want money - they want control over what Rarible can do, such as: - The ability to mint unlimited $RARI tokens on the market and sell them on the secondary market (while shorting it on an exchange) - Stealing users' funds via $WETH, $USDC, and other token approvals (including NFTs) granted to Rarible's marketplace - Draining all the tokens locked in the veRARI contract These are just simple possibilities that let attackers extract profit without needing a treasury to steal from. Over time, these attacks are getting more sophisticated, and the pool of potential victims keeps growing - even projects with no money worth stealing. We recommend that anyone holding an address with approvals granted to Rarible revoke them, to avoid any trouble in case governance is indeed captured.