The MakerDAO Critical Governance Vulnerability by Alejo Salles (Devcon5)

Transcript

[Applause] they only voted option okay so it is normal operation what does the attack work so I'll show you an example where we really want to buy sell so what we do is find a combination of proposals that has not been voted before right a specific combination when we compute the hash of chain when we have this revolved for a hash and what this will do a signal that doesn't have the Association

I told you about in storage and what we will do is it will record my vote but it won't produce any approvals for the options because it doesn't know what options these are and so this was brought some sort of corresponds so then we see the way for other users to vote for the actual proposals that were in my original goal and once I have enough support for these options what I do we say actually vote for the option I really want support right and so what this will do it will reduce the approvals for the other options as the approvals are not mine because in my first vote there were no you should know what rules issued but will do is reduce the approval from other voters and of

course it will increase approval for my know he chosen option so with this what I'd like to do is to steal votes from other users okay and the second consequence of this issue is that say another yellowish user was to and withdraw their funds from the contract so will do is this is the picture at home and they say okay I call the free function to freedom maker but the contract has a different picture in mind where if things there's no approval and afterwards for the option did the yellow user voted for so it tries to reduce those approvals it would fail to do so I never got the

whole transaction through I log in the pants of the use okay so there's two attack fields one is for free if one can't find that combination recent proposals and with this I mean that proposal that will be naturally voted for so this is for free or if I can do this I can always trade the new proposals which is just said anything matters and perform the attack at the cost so we just of this to the maker team and they quickly should apiece and how to users migrating fund so everything's good not ok so I invite you to visit our blog where we have this and

many other vulnerabilities and we recently Libra so we have the audit reports for compound and inside we also have this person's in the problem soon please [Applause]