Attacker hijacks Tornado Cash governance via malicious proposal

Share This Post

Adding to the existing roadblocks of the decentralized crypto mixer Tornado Cash, an attacker managed to gain full control of the governance through a malicious proposal. On May 20 at 3:25 ET, an attacker successfully granted 1.2 million votes to a malicious proposal. Given that the proposal received more than 700,000 legitimate votes, the attacker gained total control over Tornado Cash governance.On 2023/05/20 at 07:25:11 UTC, Tornado Cash governance effectively ceased to exist. Through a malicious proposal, an attacker granted themselves 1,200,000 votes. As this is more than the ~700,000 legitimate votes, they now have full control.https://t.co/nY87XmrYgT pic.twitter.com/h9qjc3xRqz— @samczsun.com (@samczsun) May 20, 2023The information was shared by @samczsun of research-driven technology investment firm Paradigm, who revealed that, when sharing the malicious proposal, the attacker claimed that it used a logic similar to a proposal that had previously passed by the community. However, this time, the proposal had an additional function. As explained by @samczsun:“Once the proposal was passed by voters, the attacker simply used the emergencyStop function to update the proposal logic to grant themselves the fake votes.”
The total control over Tornado Cash governance allows the attacker to withdraw all of the locked votes, drain all of the tokens in the governance contract and brick the router. At the time of writing, the attacker “simply withdrew 10,000 votes as TORN and sold it all,” said @samczsun.The attack comes as a reminder to crypto investors to vet proposal descriptions and logic. An active community of Tornado Cash, who goes by the name Tornadosaurus-Hex or Mr. Tornadosaurus Hex, confirmed that all funds in Governance are potentially compromised and requested all members to withdraw all funds locked in governance.As shown above, they also attempted deploying a contract that could potentially revert the changes while still suggesting the community to withdraw their funds. Cointelegraph also came across a distress call from one of Tornado Cash’s community developer who confirmed the above developments, stating:“There was an attack on the protocol this morning that you already know about. All day, another community developer and I thought about what to do, but the situation is close to hopeless – currently the attacker controls Governance.”The team is currently in search of Solidity developers that can help save the protocol from extinction. They additionally stated that “we need contact with Binance – this exchange has more tokens than the attacker.”Related: Allbridge offers bounty to exploiter who stole $573K in flash loan attackA former Tornado Cash developer is reportedly working on building a new crypto mixing service from scratch, which addresses the “critical flaw” existing in Tornado Cash.1/ We fixed @tornadocash 😇v0 of https://t.co/Nt4b2Tgx1D is live on @optimismFNDtest out the demo, but please note:
– this is experimental code
– it has not been audited
– the trusted setup is untrustedread the full story anon 🧵👇https://t.co/9nAU3RrgpN— Ameen Soleimani (@ameensol) March 4, 2023


Source
Attacker hijacks Tornado Cash governance via malicious proposal is written by Cointelegraph By Arijit Sarkar for cointelegraph.com

Related Posts

Fantom: Revolutionizing Blockchain Technology

Fantom, often abbreviated as FTM, is a decentralized blockchain...

Bitcoin halving shows new users that ‘code is ultimately the law’ in crypto

As the Bitcoin (BTC) halving marked another major milestone...

Yuga Labs Burns 14% of HV-MTL Supply After Faraway Acquisition

Recently, Yuga Labs, the creator of the popular Bored...

Spotting Cryptocurrency Scams: Red Flags and Warning Signs

With the rise of cryptocurrencies, the number of scams...

Web3 Watch: Someone at Adidas likes crypto culture

As NFTs boomed and Meta went all-in on the...

Splinterlands Releases Promo Cards for Bitcoin Halving Event

Splinterland’s New Reward System and Glint StoreIn addition to...
ethereum
Ethereum (ETH) $ 3,218.12
bitcoin
Bitcoin (BTC) $ 66,449.80
tether
Tether (USDT) $ 1.00
xrp
XRP (XRP) $ 0.553331
binance-usd
BUSD (BUSD) $ 1.00
cardano
Cardano (ADA) $ 0.504835
dogecoin
Dogecoin (DOGE) $ 0.160863
litecoin
Litecoin (LTC) $ 85.15
solana
Solana (SOL) $ 157.19