Marinade Discloses DAO Voting Vulnerability: Attacker Submitted Malicious Proposal Without Causing Financial Loss

TechFlow reported on October 1 that Marinade, a Solana staking protocol, disclosed that on September 25, an attacker exploited a vulnerability in the DAO voting program to allow a small amount of MNDE to be counted as voting power far exceeding its actual quantity, and based on this, submitted two malicious proposals. One was a forged "MIP-23" proposal attempting to replace the voting program; the other aimed to transfer DAO treasury funds.

Marinade stated that MNDE holders subsequently vetoed both proposals, and the DAO Council also exercised its veto power approximately six hours later. At the time, there were still nearly four days remaining before the proposals could be executed, so no funds were transferred. mSOL, Native Staking, and SAM were unaffected.

The team has now deployed a temporary fix to prevent voting power from being abnormally inflated, and will continue to implement a permanent code patch and stricter protection mechanisms for sensitive proposals.