Governance Under Siege: Suspicious Proposal Puts Tornado Cash DAO's $23M Treasury at Risk

The decentralized governance mechanism of the Tornado Cash DAO is facing a critical test. A newly submitted proposal has raised immediate red flags among security experts, with evidence suggesting it could be a sophisticated attempt to drain the organization's treasury.

Unmasking the Threat: Key Red Flags Identified

Security researcher Sergey Shemyakov detailed several alarming anomalies that set this proposal apart from legitimate governance actions:

  • Unverified Contract Code: The core smart contract code of the proposal remains unverified on block explorers. This lack of transparency is a severe departure from standard DAO practice and is often the hallmark of malicious intent.
  • Opaque Proposal Originator: The wallet address that created the proposal received its initial funds via the privacy protocol Railgun just four days prior, effectively obscuring its origin. This pattern aligns with attackers seeking to hide their tracks.
  • Deceptive Execution Path： While the proposal description may be misleading, its technical function is clear: if passed, it would grant the attacker high-level permissions through a `delegatecall` to the governance contract. This mechanism is a classic vector for fund appropriation.

A Treasury in the Crosshairs

The potential target is the DAO's treasury, which currently holds TORN tokens valued at approximately $23 million. Shemyakov clarified that while Tornado Cash's mixing pools are not directly affected, the governance framework controlling these assets is under direct threat.

This scenario bears a worrying resemblance to a previous attack in 2022, where a malicious proposal successfully hijacked the protocol. The recurrence of such tactics highlights the persistent vulnerabilities in on-chain governance systems when vigilance wanes.

A Call to Action for Token Holders

The researcher's warning is unequivocal: all TORN token holders must independently scrutinize this proposal before any voting concludes. In decentralized ecosystems, the responsibility for security is distributed, and informed community participation is the primary defense against governance attacks.

This incident serves as a stark reminder that in the world of DAOs, every vote carries weight, and every proposal requires rigorous examination to safeguard collective assets.