[Temp Check] Governance Security: Compensating blockful for preventing a potential attack on the ENS DAO

[alextnetto.eth]

@NameSys

No action was taken at that time though since no single wallet exceeded the quorum at that time. 2 years later, someone has collected the tokens and made the possibility very real using a single wallet only.

@NameSys

the only difference is that now a single wallet could capture the DAO instead of 2-3 wallets at the time of our disclosure.

This isn’t the attack vector and metric to be concerned.

One actor can have 1 or 100 different wallets. Recently, there was an unknown whale that is accumulating a lot of tokens in one wallet, showing how feasible it is. But it could go under the radar if it used much more wallets… (which probably it’s)

The main metric that is the concerning attack vector and reason to attack ENS governance is:
Liquid treasury (the treasury not considering the DAO’s native governance token) - value of delegated tokens.

That’s the current situation without the outcomes of the research. I don’t think it’s safe.

This vector has existed since March 2023, after your work. I can’t consider your work as part of the bounty since it wasn’t used to guide the outcomes and doesn’t expose the actual reason for attacking the DAO, as you can see above. Sorry.

@NameSys

the vulnerability was exposed as soon as you posted about it in the forum.

That’s not true. veto.ensdao.eth was created on 12th Apr, and the first time the situation was disclosed in the forum was on the same day in this post.