In an interesting series of events, Ethereum-based DeFi project Indexed Finance recently faced and triumphed over a double hijack attempt of the protocol DAO’s treasury. Following this development, the project’s founders will now take control of the DAO.
In a thread on X on SaturdayLaurence Day, a former director at Indexed Finance, shared two failed hijack attempts targeting the project’s DAO coffers, which is currently valued at $120,000.
According to Day, both attackers purchased a large amount of Indexed’s native token – NDX, and attempted to take control of the protocol’s treasury through malicious proposals. The first proposal, identified as Proposition 24, had no headline or description. Because it was virtually unnoticeable, this proposal almost won approval within an hour of the vote.
Okay, so this is what just happened with the indexed DAO
The wreckage can be seen in the Tally panel below
This is a long thread, but I want to include it somewhere pic.twitter.com/wRTRZZcwhm
— Laurence, powered by paradigm (@functi0nZer0) November 25, 2023
However, when discovered, Day, along with other community members, publicly called on others to vote against the proposal and ultimately thwarted the first hijacking attempt.
Related reading: HTX resumes operations after temporary halt due to hack
Indexed finance anticipates second attack and emerges victorious once again
Given the publicity and attention surrounding the incident, the Indexed DAO suspected that another attacker would attempt to replicate the same tactics to gain access to its treasury.
Therefore, the DAO passed Proposition 26, identified as the poison pill, which granted them the authority to burn the assets in the treasury if it was deemed the only means to stop such an attack.
As suspected, another hijacker tried to take control of the treasury and even managed to get the proposal passed – proposal 27. However, proposals on the Indexed Finance platform must be queued for 48 hours before being executed .
During this time, the hijacker approached the DAO to cancel the poison pill proposals, and in return he would receive only 50% of the money in the Treasury. However, he soon received a counter-offer from Dillon Kellar, co-founder of Indexed, who offered him $10,000 DAI in exchange for canceling his Proposition 27 or risk the DAO burning all the assets in the treasury.
The hijacker finally accepted Kellar’s proposal with four hours remaining to implement the poison pill proposal, successfully thwarting the second hijacking attempt.
Indexed Finance DAO transfers control of the treasury to the founders
Following the multiple hijacking attempts, the Indexed Finance DAO has now relinquished control of the treasury to Laurence Day, Kellar and an individual with the pseudonym PR0. Together, these three individuals will manage the Treasury using a ⅔ multi-sig system.
At the time of writing, NDX transactions at $0.00823, down 24.15% on the last day. At the same time, the token’s daily trading volume has also fallen by 44.35% and is valued at $2,347.
Total crypto market valued at $1.398 trillion on the daily chart | Source: TOTAL chart on Tradingview.com
Featured image from Hacked.com, chart from Tradingview