Adding to the existing blocks of decentralized cryptocurrency mixer Tornado Cash, an attacker managed to gain full governance control through a malicious proposition.
On May 20 at 3:25 ET, an attacker managed to grant 1.2 million votes to a malicious proposal. Since the proposal received more than 700,000 legitimate votes, the attacker gained full control of the governance of Tornado Cash..
On 2023/05/20 at 07:25:11 UTC, Tornado Cash governance effectively ceased to exist. Through a malicious proposal, an attacker granted themselves 1,200,000 votes. As this is more than the ~700,000 legitimate votes, they now have full control. https://t.co/nY87XmrYgT pic.twitter.com/h9qjc3xRqz
—@samczsun.com (@samczsun) May 20, 2023
On 05/2023/20 07:25:11 UTC, the Tornado Cash government ceased to exist. Through a malicious proposal, an attacker granted himself 1,200,000 votes. Since this is more than the 700,000 or so legitimate votes, he is now in complete control.
The information was shared by @samczsun from research-driven technology investment firm Paradigm, who revealed that, by sharing the malicious proposal, the attacker claimed that it used similar logic to a proposal that had previously passed through the community. However, this time, the proposal had an additional function.
As @samczsun explains:
“Once the proposal was approved by the voters, the attacker simply used the emergencyStop function to update the logic of the proposal and grant himself the fake votes.”
Full control over the Tornado Cash government allows the attacker to remove all locked votes, drain all government contract tokens, and crash the router. As of this writing, the attacker “just took down 10,000 votes like TORN and sold everything,” @samczsun said.
The attack comes as a reminder to crypto investors to review the descriptions and logic of the proposals. An active Tornado Cash community, calling themselves Tornadosaurus-Hex or Mr. Tornadosaurus Hex, confirmed that all funds in Governance are potentially compromised and asked all members to remove all funds locked in Governance.
As shown above, they also tried to deploy a contract that could potentially revert the changes while still suggesting to the community to withdraw their funds. Cointelegraph also came across a distress call from one of the Tornado Cash community developers who confirmed the above events, stating that:
“This morning there was an attack on the protocol that you already know about. All day another developer in the community and I have been thinking about what to do, but the situation is almost hopeless: the attacker currently controls the government.”
The team is currently looking for Solidity developers who can help save the protocol from extinction.. Additionally they stated that “we need to contact Binance: this exchange has more tokens than the attacker”.
According to reports, a former Tornado Cash developer is working on building a new cryptocurrency mixing service from scratch, which addresses the existing “critical flaw” in Tornado Cash.
1/ We fixed @tornadocash 😇
v0 of https://t.co/Nt4b2Tgx1D is live on @optimismFND
test out the demo, but please note:
– this is experimental code
– it has not been audited
– the trusted setup is untrustedread the full story anon 🧵👇 https://t.co/9nAU3RrgpN
— Ameen Soleimani (@ameensol) March 4, 2023
1/ We have fixed @tornadocash 😇
v0 of https://t.co/Nt4b2Tgx1D is on @optimismFND
try the demo, but keep in mind:
– this is experimental code
– has not been audited
– trusted settings are not trustedread the full story anon in the link
The developer hopes the solution will empower the “community to defend itself against hackers abusing the anonymity pools of honest users without requiring blanket regulation or sacrificing crypto ideals.”
Clarification: The information and/or opinions expressed in this article do not necessarily represent the views or editorial line of Cointelegraph. The information presented here should not be taken as financial advice or investment recommendation. All investment and commercial movement involve risks and it is the responsibility of each person to do their due research before making an investment decision.
Keep reading:
Investments in crypto assets are not regulated. They may not be suitable for retail investors and the entire amount invested may be lost. The services or products offered are not directed or accessible to investors in Spain.