Marinade Finance: DAO hit by malicious proposal attack, vulnerability fixed with no fund losses

PANews reported on October 1 that Solana staking protocol Marinade Finance said its DAO was attacked on September 25 when an attacker attempted to seize governance control through two malicious proposals, but both proposals were rejected by the DAO committee, no funds were transferred, and the mSOL, Native Staking and SAM services were unaffected.

The attacker exploited a vulnerability in the DAO voting process that caused a small amount of MNDE tokens to be counted as far more voting power than they actually held, and submitted a forged "MIP-23" proposal attempting to replace the voting process, along with another proposal to transfer DAO treasury assets. The actual voting power of MNDE holders reportedly exceeded both malicious proposals, and the DAO committee completed the rejection within 6 hours, about 4 days ahead of the proposals' originally scheduled execution time. Marinade said the vulnerability was fixed that same night, and the rejected proposals cannot be executed again.

Marinade said it will subsequently carry out a permanent code fix, add extra security measures for sensitive proposals, and introduce an AI-driven proposal analysis mechanism. Meanwhile, the team has notified the Realms DAO maintainers to help other DAOs guard against similar risks.