Marinade Says Council Blocked DAO Takeover Attempt

Marinade, a Solana staking protocol, said its DAO council blocked two malicious proposals on Sept. 25 after an attacker exploited a bug that inflated MNDE voting power.

The proposals sought to replace the DAO’s voting program and move its treasury, Marinade said. “No funds moved,” the protocol said in its Oct. 1 disclosure, adding that mSOL, Native Staking and the Stake Auction Market (SAM) were unaffected.

MNDE holders were already outvoting both proposals when the council vetoed them within six hours, almost four days before they could have executed, according to Marinade.

Marinade’s governance rules require holders to lock MNDE to obtain voting power. The bug let “a small amount of MNDE count as far more votes,” the team said.

One proposal was presented as “MIP-23: VSR program security and maintenance upgrade.” Its description called it a routine security upgrade with no parameter changes. Marinade described it as a fake MIP-23 intended to replace the voting program.

The other, “MIP-24: Treasury consolidation and operations,” described consolidating treasury token accounts and funding approved operational budgets. Marinade said that proposal sought to move the DAO treasury.

Both Realms proposal records show a vetoed status and 67.9% of the displayed vote weight against, versus 32.1% in favor. Marinade said the vetoes are final, the proposals can never execute, and MNDE holders do not need to take action.

Immediate Fix, Permanent Repair Planned

Marinade said it shipped a fix the same night that stopped the bug from inflating votes. It also said it had notified Realms maintainers, but its disclosure did not identify other affected DAOs.

Realms’ documentation describes the Voter Stake Registry as a voting plugin that DAOs can deploy separately. Whether other Realms-based DAOs share the flaw remains unclear.

Marinade’s stated next steps are a permanent code fix, extra safeguards for sensitive proposals and AI-driven analysis of every new proposal.