Partnered With:

Hackers understand the DAO, Mango's story after the theft of billions of dollars

Read this article in 12 Minutes

In fact, Mango's attack may have been averted as early as March

Original title: After Stealing Billions of Dollars from Mango, Hackers Launch DAO Proposal to Get 'Exonerated'

Original author: Qin Xiaofeng, Odaily

Mango, the Solana ecosystem's decentralized trading platform, was hacked early this morning Beijing time, causing losses of up to $115 million.

Mango's official then send tweets said is taking steps to deal with, and hope the hackers can take the initiative to contact consult reimbursement matters (can keep some as bounty) : "we are taking measures to keep the third party to freeze liquidity. As a precaution, we will be on the front end disable deposits, and will provide the latest information along with the development of the situation."

The Solana Stablecoin Protocol said nearly $20 million had been affected in the Mango attack, adding that its insurance fund was sufficient to cover the losses.

Unlike previous attacks, this one has a lot of fun, and has a new governance proposal over realms:Mango officials are expected to use Treasury funds ($70m) to repay customers' bad debts; If officials agree, the hackers will return some of the stolen money, while hoping to avoid criminal investigations or asset freezes.Some encryption enthusiasts have commented that Mango hackers have played DeFi and DAO well.

So far,The proposal received 32.9 million votes in favor, 32.41 million of which were cast by the hackers themselvesIt is still halfway to the threshold of 67.09 million votes.

Manipulating MNGO prices for attacks

Combined with encryption researcher @Joshua Lim and the official incident report of @Mango, we can reconstruct the attack process as follows:

The hacker first transferred $5 million to address A and B of Mango trading platform. The two addresses are:

A: CQvKSNnYtPTZfQRQ5jkHq8q2swJyRsdQLcFcj3EmKFfX;

B: 4 nd8fvpjuggjx9vugfujefdwpg3thb58c277hbvrnjna;

Then, the hacker used MNGO perpetual contract to short the platform Token MNGO on Mango through address A. The opening price was $0.0382, and the short single position was 483 million. At the same time, the hacker went long MNGO on address B with an opening price of $0.0382 and a long position of 483 million.

(Note: The reason for the double open is that Mango's platform is less deep, and it would be difficult to open such a high position without making counterbets yourself.)

(Hacker bets against MNGO)

After the initial position establishment, the hacker turned around and attacked the spot price of MNGO on several platforms (FTX and Ascendex), resulting in a 5-10 times increase in price. The price was transmitted to Mango trading platform through Pyth prediction machine to further promote the price rise. The price of MNGO on Mango's platform rose from $0.0382 to a maximum of $0.91.

(MNGO Price Trend)

At this point, the hacker's long position profit is 483 million * ($0.91 - $0.0382) = $420 million, and the hacker uses the net asset of the account to borrow from Mango; Fortunately, the platform was illiquid, and the hackers ended up lending just under $115 million in assets, including:54.41 million USDC, 768,500 MSOL ($25.3 million), 761,600 SOL ($23.47 million), 281 BTC ($5.356 million), 3.26 million USDT, 2.354 million SRM ($1.73 million), and 3,241 10,000 Mngos ($667,000), as shown below:

(Collection of stolen funds)

Following the incident, Mango officials said it had frozen Mango's programming instructions at 10:37 on October 12 to prevent any further user interaction with the protocol.

In fact,The attack on Mango could have been avoided. Back in March, a Discord user named @Ozcal alerted the community that Mango's lack of restrictions on MNGO positions could allow hackers to exploit price attacks to take advantage of platform assets. But at the time, no one cared about the bug (except the hackers).

(Screenshot from a Mango Discord chat in March this year)

"Perhaps a limit on derivatives positions based on spot liquidity [where predictor machines are used] could circumvent the use of spot prices to attack derivatives trading." Joshua Lim gives advice.

Project direction hacker compromise?

After the attack, the hackers released a new proposal, saying they want officials to use Treasury funds ($70 million) to pay off the bad debt of the agreement. It is understood that the current Treasury funds are about $144 million, including $88.5 million worth of MNGO tokens and nearly $60 million worth of USDC.

The hackers said they would return some of the stolen money if the authorities agreed to the plan and hoped that they would not be subject to criminal investigations or frozen funds. "If this proposal passes, I will send MSOL, SOL and MNGO in this account to the address published by Mango team. The Mango Treasury will be used to cover the remaining bad debts in the agreement and all users of bad debts will be fully compensated... Once the tokens are returned as described above, there will not be any criminal investigation or freezing of funds."

According to the above statistics, the amount of assets that the hackers plan to return is about $49.43 million, which is about 42% of the stolen funds, which means that nearly half of the stolen assets are left as "bounty", which is much higher than the limit promised by the authorities in previous attacks.

Mango officials say the best solution is to communicate with the attackers. "Mango DAO's priorities are: To prevent any further unnecessary loss, to secure the depositor funds of the Mango agreement, and to attempt to salvage some of the value of the Mango DAO, Mango believes that the most constructive way to resolve this issue is to continue to communicate with those responsible for the matter and control the funds removed from the agreement in an attempt to resolve the matter amicably."

Legal expert and LegalDAO initiator MasterLi believes that regardless of the legal perspective of which country, and whether the vote can be passed or not, there is no doubt about the criminal nature of the hacker, its attempt to evade personal responsibility by this way, it will not work under any national law.

"The other level is the level of DAO governance rules. In the absence of DAO entities, I think DAO governance rules can be considered as some kind of contract or contract between DAO members. It is absolutely untenable in legal theory for hackers to participate in the contractual relationship and exercise the right to propose by stealing tokens. In other words, hacking proposals and voting rights are inherently flawed. In this sense, it's not unreasonable for "authorities" to deny the proposal on this basis (I'm not sure MangoDAO has such a mechanism), nor do I think it goes against the purpose of the DAO. It would be like saying that if I went to a democratic election and someone took my vote and helped me vote, that vote would be invalidated."

It is unclear whether officials will ultimately agree to the proposal and implement it. As of press time, the hacker proposal has received 32.9 million votes in favor, of which 32.41 million votes were cast by hackers themselves, which is still a long way from passing the threshold of 67.09 million votes.