Shaw Publishes Daos.fun Reconstruction, Claims Critical Flaw

Developer Shaw, known as @shawmakesmagic, published what he says is a byte-identical reconstruction of daos.fun’s closed-source Solana program on Oct. 24 and claimed to have found a critical vulnerability in its mainnet code.

His public repository contains reconstructed Rust source, a captured program binary, build instructions and a comparison record reporting identical SHA-256 hashes for the captured and rebuilt files. A GitHub Actions run for “Rebuild exact source” is marked successful.

The repository’s security review covers a captured executable, not a certification of current mainnet state. It says its local tests do not establish that a real-world attack occurred. Which live user positions, if any, are affected remains unconfirmed.

The reconstruction is not necessarily the original author’s source text: the README notes that historical comments and identifiers cannot be uniquely recovered from a binary. Its claim is that the reconstructed code compiles into the same captured executable.

Solana co-founder Anatoly Yakovenko amplified Shaw’s post, quoting “There is no security by obscurity anymore” and adding three target emojis. His post did not provide separate verification of the vulnerability claim.

Existing Tokens After the Shutdown

Daos.fun, an investment-fund launchpad, let communities pool $SOL in funds whose creators could trade the assets. Its creator documentation describes moving raised $SOL into a DAO wallet and launching a tradable DAO token. The reconstructed program’s documented functions include treasury execution and $SOL and token redemptions.

The daos.fun website now says the platform is no longer maintained and that new DAO and token creation is no longer supported. It says existing bonding curves and pools are on Meteora and tokens can still trade through compatible clients. The site also directs creators to manage existing tokens and claim fees.

Solscan’s program page lists the program as upgradeable. Its last-deployment slot matches the captured deployment identified in the repository’s audit. Whether daos.fun received a private disclosure or acknowledged Shaw’s claim could not be established from the public materials reviewed.

The repository publishes audit material and local test scripts rather than withholding technical details. Its security policy says the reconstruction intentionally retains the reported vulnerabilities and provides no deployed remediation.