How Indexed Finance Foiled Two Treasury Hijack Attempts

admin — Sun, 26 Nov 2023 17:30:21 +0000

In an interesting line of events, Ethereum-based DeFi project Indexed Finance recently faced and triumphed over a dual hijack attempt of the protocol DAO’s treasury. Following this development, the project’s founders will now re-assume control from the DAO.

In a thread on X on Saturday, Laurence Day, a former executive at Indexed Finance, shared two failed hijack attempts targeted at the treasury of the project’s DAO, which is currently valued at $120,000.

According to Day, both attackers purchased a high amount of Indexed’s native token – NDX and attempted to assume control of the protocol’s treasury via malicious proposals. The first proposal, identified as Proposal 24, was without a heading or description. Being virtually unnoticeable, this proposal almost gained approval within an hour of voting.

Okay so here’s what just happened to the Indexed DAO

The wreckage can be seen in the Tally panel below

This is a long thread, but I want to record it somewhere pic.twitter.com/wRTRZZcwhm

— laurence, backed by paradigm (@functi0nZer0) November 25, 2023

However, upon detection, Day, alongside other community members, publicly rallied others to vote against the proposal and eventually thwarted the first hijack attempt.

Indexed Finance Anticipates Second Attack, Emerges Victorious Again

Considering the publicity and attention surrounding the incident, the Indexed DAO suspected another attacker might attempt to replicate the same tactics to gain access to its treasury.

Therefore, the DAO passed proposal 26, identified as the poison pill, which granted them the authority to burn the assets in the treasury if considered as the only means of halting such an attack.

As suspected, another hijacker attempted to take control of the treasury and even succeeded in getting the proposal passed – proposal 27. However, proposals on the Indexed Finance platform have to be queued for 48 hours before execution.

During this time, the hijacker approached the DAO to cancel the poison pill proposals, and in return, he would take only a 50% bounty of the funds in the Treasury. However, he soon received a counter-offer from Indexed Co-founder Dillon Kellar, who offered him $10,000 DAI in exchange for canceling his proposal 27 or risk the DAO burning all the assets in the treasury.

The hijacker eventually accepted Kellar’s proposal with 4 hours remaining for the execution of the poison pill proposal, marking the successful foiling of the second hijack attempt.

Indexed Finance DAO Hands Over Treasury Control To Founders

Following the multiple hijack attempts, the Indexed Finance DAO has now ceded treasury control to Laurence Day as well as Kellar and an individual with the pseudonym PR0. Together, these three persons will manage the Treasury using a ⅔ multi-sig system.

At the time of writing, NDX trades at $0.00823, with a 24.15% decline on the last day. In tandem, the token’s daily trading volume is also down by 44.35% and valued at $2,347.

Total crypto market valued at $1.398 trillion on the daily chart | Source: TOTAL chart on Tradingview.com

Featured image from Hacked.com, chart from Tradingview

Source link

Indexed DAO Overcomes Threats, Plans Victim Compensation

admin — Sun, 26 Nov 2023 00:07:50 +0000

Indexed Finance has successfully averted two aggressive takeover attempts on its Decentralized Autonomous Organization (DAO). This blockchain-based entity, victim to a significant $16 million hack in 2021, faced recent threats from attackers aiming to commandeer its treasury. Yet, the community’s vigilance and strategic maneuvers ensured its safety, safeguarding assets worth about $120,000.

The Battle Against Malicious Proposals

The first sign of danger emerged when an attacker, leveraging significant holdings in the protocol’s NDX token, launched a covert proposal to seize control. This move, lacking any title or description, nearly slipped under the radar. However, the Indexed community, led by former core contributor Laurence Day, mobilized swiftly. They rallied a formidable defense, casting enough dissenting votes to thwart the attack barely an hour before its potential success.

Recognizing the likelihood of a repeat assault, Day and the team prepared. They anticipated another attempt, potentially exploiting an identified vulnerability that could endanger funds beyond the immediate treasury. They adopted a defensive strategy – a ‘poison pill’ proposal. This tactic would enable the burning of the treasury funds, a drastic measure aimed at deterring future attacks.

Indexed Finance Negotiations and Resolution

Indeed, a second threat materialized. This time, the attacker, emboldened, sought a direct negotiation, demanding a significant portion of the treasury. In a calculated move, Dillon Kellar, a founding member of Indexed, countered with an offer – a mere fraction of the demand, paired with a stark ultimatum. With the clock ticking, the attacker capitulated, accepting the $10,000 counteroffer and retreating.

In response to these threats, the Indexed team adjusted their strategy. They canceled the ‘poison pill’ proposal and instead transferred control of the timelock to a 2/3 multisig. This multisig, managed by Day, Kellar, and the pseudonymous co-founder PR0, represents a strategic pivot to ensure greater security and governance stability. This decisive action marks the end of a tumultuous chapter for Indexed, with the community emerging more robust and united in the face of adversity.

As Indexed Finance transitions from defense to restitution, the focus shifts to healing and rebuilding trust within the community. This episode not only demonstrates the resilience and solidarity of the Indexed DAO but also highlights the evolving nature of security and governance in the DeFi space. With the attackers thwarted and plans for victim compensation in place, Indexed Finance looks to a future where such incidents serve as lessons for more robust, more secure decentralized financial systems.