BanklessDAO Incident Report - Governance Sybil Attack

Governance
1

Title: BanklessDAO Incident Report - Governance Sybil Attack
Authors: Icedcool🏴#4947
Date Created: 4/25/23

SUMMARY

This Incident report is in response to a Sybil attack that occurred over the weekend on the forum by the Grants Committee member Sprinklesforwinners🏴#1125. She created accounts on the forum to vote on proposals, with the details of the accounts, some of their actions and their voting patterns below.

In the next steps I suggest a path forward for the DAO.

Timeline of events

  1. On Saturday, April the 22nd at around 9pm EST, I noticed unusual activity happening in the forum in relation to some of the active votes and users created.

  2. After a cursory investigation I saw 10 accounts sharing IP addresses, as well as emails that Sprinklesforwinners🏴#1125 owns.

    1. These emails were identified by Sprinklesforwinners🏴#1125 name and her main account.

  3. I looped in @InfoSec Team and we created an incident response DM, where we planned for the worst case scenario, during the investigation.

    1. This included temporarily restricting L2
    2. Backing up Notion fully

  4. During this @InfoSec Team was doing an investigation and identified the accounts, emails, IP addresses, and voting patterns.

    1. Details are below. Included are:
      1. Accounts
      2. Voting

  5. With security taken care of, I planned to talk with @Sprinklesforwinners🏴 on Monday April 24th.

  6. On April 24th at 3:30 EST, I looped in @Ombudsman and talked with them about the evidence and a plan forward, and they agreed that we should talk with Sprinkles first, then move forward with a report.

  7. Upon talking with Sprinklesforwinners🏴#1125 on April 24th at 4:59pm EST, she was initially reluctant to admit she created the accounts, saying that that could be anyone.

    1. Upon confrontation of the details, she admitted she did create the accounts.

  8. Trying to find a positive path forward, I asked her to delete the accounts, which she did, and I said I would need to submit a report to the DAO, but hopefully we can find a way that works.

    1. She stated that she aimed only to showcase a flaw, and not break governance, because she voted on things that wouldn’t count towards quorum. I assume also that wouldn’t sway a vote.

  9. The morning of April 25th she published this post.

    1. Airweave Transaction: link

Sybil Attack Details

These details showcase the accounts associated and the focus of the sybil attack on the governance forums and their votes.

All personal information has been blocked out.

Users

image
image1157×528 160 KB

Voting Patterns

image
image891×656 135 KB

Uses of the accounts

These are some of the messages one of the accounts made.

image
image1804×1538 215 KB

Evidence

Link

Next steps

Based on the above, I propose we should collect ideas for next steps in this forum post. After 3 days I will collect the options and present a vote to the DAO through governator, that will be gated to L1 as one person one vote.

This vote will have a timeline of 7 days, to be acted upon completion.

15 Likes
2

I would like to express my personal feelings on this, as a contributor to the DAO.

I am deeply disappointed by the progression of these events. When talking with Sprinkles, she was cooperative and I had hopes and plans to find a way forward that could have been positive for everyone involved. Sprinkles has been an excellent contributor to the DAO helping in many levels, and our DAO is our contributors. Losing them is to lose the DAO.

Sadly, the act of publishing her article shows a lack of regret, understanding of impact or remorse for her choices.

In my opinion, this is made inexcusable by the fact that she was an elected official of the DAO in control and responsible for funding and the stewarding of DAO governance.

With all that said, I DO believe she had positive intent, and she does highlight challenges with our infrastructure that I’m glad to see are getting attention.

Ultimately, I would like to encourage everyone to take some time before casting judgment, and attempt to approach this topic as evenly as possible.

Super bummed this has taken place, appreciate you all.
BanklessDAO strong. :muscle:

19 Likes
4

Just saw her response linked to the post, so I’ve deleted my question.

2 Likes
5

The two themes that keep coming up for me:

  1. Sprinkles has no remorse for her actions.
  2. She doesn’t seem to have a full understanding of what she has done.

I’m sure 1 stems from 2, but either way, I was hoping she would have apologized by now, and she hasn’t. For that reason, I don’t believe her actions were for the good of the DAO.

If you read her blog posts, it seems pretty clear that she blames the DAO for what’s happening in her personal life, and nothing good can come of a contributor who has that kind of sentiment towards the DAO.

15 Likes
6

We’ve known about this vulnerability for a while. Nothing needed to be proven. There was projects within the DAO already in the works to resolve it.

Even if good intentions, that claim went out the window when she used one of the fake accounts to

  1. Attack the integrity of @Trewkat
  2. Spread misinformation about a multisig being hacked

In the cyber security world, unsanctioned known vulnerability attacks without proper disclosure, you could face legal actions and penalties, including fines, imprisonment, and civil liabilities. The severity of the consequences may vary depending on scale of the attack. Regardless of your intentions.

I’ve been in scenario’s where I’ve stumbled on a vulnerability and have to shut down the actions to avoid any unintentional repercussions I may face as I must disclose the problem to the company / institution and give them reasonable time to fix it or get permission to exploit further or else I become a black hat.

19 Likes
7

But why?

Why would anyone do this to the DAO?

Voting on proposals just to “test it out” is bad enough, and then even adding comments that are against the DAO contributors and spreading false information is beyond any logic.

It’s no rocket science and fresh news that forums like this are vulnerable, so why this needed to be proven? And to do it on own accord without even telling anyone in the DAO.

This is straight up attack on the governance and the DAO, whatever the intentions may be.

11 Likes
8

There is so much I could say, so much I have already said. I asked her more than once to make her concerns explicit and provide evidence for her claims and to this day she is still hiding behind blanket statements and surface-level arguments. She refuses to acknowledge any counter arguments and has only managed to ‘prove’ something we all already knew. The reason her posts were not well received has nothing to do with denial or corruption and everything to do with the fact that they were ill-considered, misinformed, and produced without a shred of collaborative spirit.

When people expressed their concern about the interference with Forum polls, she repeatedly dismissed them with a comments that the polls don’t matter for proposal approval.

I have asked her to specify her concerns around her perception that system permissions are overly centralised and despite having the time to provide flippant commentary on the white hat debate (“I only wear cowboy hats. Re- read”) she has not responded to me, let alone apologised for throwing a massive amount of shade at me and some of my hard-working DAO colleagues.

I find her Mirror posts and the email addresses created to support her Sybil activity VERY telling of her state of mind about what she was trying to achieve. They don’t read to me as being from someone who simply wanted to help the DAO.

20 Likes
9

Same experience. Doesn’t care to explain, just attack, or not respond at all.

Irony entered the chat - comments around centralization, while the individual is highly subjective, dismissive towards anything she doesnt like, and makes own rules on the go.

As someone who is involved in the governance, she should understand the weight of these actions - and why this IS a governance attack.

There is no white-hatting and whatever excuses here.

Wouldnt want to be in @Icedcool 's shoes, and see the forum and proposals going mad.

6 Likes
10

I had to put a lot of thought into this because I don’t want to say the wrong thing here. For a few minutes, I even considered a different path. First and foremost, I want to clarify that nothing I am going to say or have said is directed towards any one particular person. My only concern is what is best for both the DAO and the contributors.

The fact of the matter is that some of the centralized admin access may have been calculated, while others may not have been. For instance, there is a difference in whether someone nominated themselves for all of these different areas with admin access, whether they were nominated by others to have this access, or if it has just been given to them because there was no one else who could or would do it.

I take full responsibility for what I did, and I have never denied that. I should have, at the very least, informed infosec of my plans and asked for their input.

I understand why I would be asked to step down from the Grants Committee Lead position, as this is not the example that should be set, and it is not one that I would like anyone to follow. However, I would like my fellow Grants Committee members to vote on this.

I was told not to defend myself, but I simply cannot do that. It goes against everything that I stand for. I won’t hide behind any excuses though.

I believe that I have fulfilled the requirements of my position and remained unbiased towards everything and everyone at all times. I always look out for the best interests of bDAO and every single contributor, whether I know them, have worked with them, or have never even heard their names before. I am as value-aligned as anyone could be - to the values of BanklessDAO according to our constitution:

Values

Education

We learn from each other.

We seek to become a trusted guide that empowers people all over the globe to adopt decentralized finance by sharing accurate,

truthful, and

objective information.

Integrity

We operate transparently and

build trust through

radically public discourse

and financial auditability.

Decentralized Governance

We put decision-making into

the hands of the collective.

We create legitimacy

through an environment where

the best ideas win.

Culture

We reward action

and embrace risk.

We empower our community

to continually drive new initiatives by

providing a space to self-organize

and quickly move from idea to action.”

Financially, as I purchased my L1 membership And since then, I have held onto as more BANK than I am literally able to. I am a damn hard worker, dedicated contributor, and I believe that most of the content I produce is valuable. Anyone who knows me, I really believe knows this. I am honest and trustworthy.

Even the forum has me at trust level possible.

Now again, I take full responsibility for what I did, and I admit that I was wrong and am sorry with the way that I went about it.

Please read our code of conduct, the terms of service for the forum and again our values.

(I did, many times prior to doing this - to make sure that I wasn’t breaking any rules. I would have not even for a second thought of doing this if I saw that I couldn’t —or even shouldn’t. I am just not a rule breaker. I also don’t think anyone should be expected to follow a “social code” if they don’t know what it is.

And while I was almost talked into walking away, I stopped for a second to think it through.

Is it really fair that I am now not allowed access to content that I have created and projects that I have been building?

For breaking unwritten rules and disappointing people?

I don’t know how other families work, but growing up and in my house when someone makes a mistake they aren’t forced to give up everything that they have or get kicked out. With my children, I am as supportive as I can be, I don’t judge and would never kick them when they are down.

I thought that my BanklessDAO family was the same. So those who are disappointed with me, know that I am just as disappointed that you have let me down.

Take me out of it.

If anyone actually thinks and can honestly say - with good reason, that any contributor who doesn’t break a written rule, or rules that they have no knowledge of should be forced to give up what they have worked for, and loose/not have access to everything that they have previously created at the DAO is okay, then I will just leave. Because if that is the case, the DAO doesn’t follow its own principles and values, so it’s not for me.

I am not looking for criticism here. If my wording or tone seems off, I apologize. My wording through text does not always come out as I intend.

Financially, I purchased my L1 membership and have since then, literally held onto more BANK than I am able to.

I am a dedicated and hardworking contributor, and I believe that most of the content I produce is valuable. I am honest and trustworthy even the forum has me at the highest trust level.

However, I take full responsibility for my actions, and I admit that I was wrong and am sorry for the way I went about it. I encourage everyone to read our code of conduct, terms of service for the forum, and our values, which I have reviewed multiple times to ensure that I am not breaking any rules. I do not believe that anyone should be expected to follow an unwritten “social code” without knowledge of what it entails.

While I understand the consequences of my actions and why I am no longer allowed access to certain content, I question whether it is fair to deny me access to projects that I have been building and content that I have created. In my family and with my children, mistakes are met with support, not judgment or punishment. I thought that my BanklessDAO family was the same. For those who are disappointed in me, know that I am just as disappointed that you have let me down.

If anyone believes that contributors who do not break written rules or rules that they are unaware of should be forced to give up what they have worked for and lose access to everything they have previously created at the DAO, then I guess BanklessDAO is not in line with its principles and values, and it is not for me.

I am not looking for criticism, and I apologize if my wording or tone seems off as it may not always convey my intentions accurately through text

2 Likes
11

Curious, since what season was this vulnerability known and what amount of time to fix it seems reasonable?
Seems this sybil vulnerability is the crux of her violation of trust.
Wonder what she foresaw as a conclusion to her actions.

My opinion:
As she has lost trust of those facilitating the governance of the DAO, her permissions should be mitigated.
To be elected again she will need to work to earn trust.

Any personal attacks, should be mediated privately.

2 Likes
12

The issue here is the governance attack and slandering other community members?

Everyone does acknowledge your hard work and contributions to the DAO, that is not even a question, it’s the HOW you did this.

If you wanted to “test” the voting attack, your explanation “could” pass, but attacking other community members, hardworking contributors and spreading misinformation about the multisig being hacked is more than terrible. It’s harming the DAO, its reputation, it spreads panic, it puts those who are on the multisig in a very bad position. And the list goes on.

The fact that some “rules are unwritten”, doesn’t mean you can do whatever you please. And yes, disappointing people in a DAO, the people you are building and working with, it has weight. While we operate in a trustless environment, we still rely on each others as humans, as belief we are here to protect what we are building not attack it.

It’s not new that these forums are vulnerable and can be attacked, so why need to prove it? It has different weight when this type of attack is done from an outsider, and when it comes from one of our own.

Going after DAO contributors and posting comments to hurt their reputation is another level of terrible. You hold GC role, you are level 2 contributors, and that carries weight and responsibilities. Surely you wouldnt get a pat on the back for going rogue and attacking governance.

6 Likes
13

Could you please show me where this was done?

Although Infosec is great, This can be done by any outsider. This has been known for a long time I believe. It is also known that these posts can (and have been) edited, even after they are closed. And not just by the authors. I recently brought this up again. Correct me if I am wrong, but I cannot see where any action is being taken to acknowledge or prevent it.

Yes. However the framework of our governance allows non-humans to also participate, so in this trustless environment, I personally find it difficult to rely on anyone and verify first - as I was taught

14

I would but those post were deleted. Courtesy of great people here. Why say the multisig was hacked. Dont you understand the damage?

Still doesnt make it right you do it the way you did it.

So you do whatever you think is right?

1 Like
15

I honestly wasn’t sure. There are no clear consequences.
What I do know is what has been done previously. Someone who fraudulently impersonated other members, stole BANK from the DAO and wasn’t honest about it, had his position removed via a poll by others in each specific area that he was a role holder.
All of this was done via the centralization of power that is still continuing.

The least amount of time that it has been known is at least 3 seasons. I am not sure if the maximum amount of time it has been known for.

16

image
image1284×285 89.1 KB

This is the post. As a legal professional, do you consider this slander?

Also, out of sheer curiosity, how this would be considered slander, but it is not slander when derogatory opinions are now being shared about me, or attack me and name call, question my mental health or use the word “attack” (because that is not what I did)

17

I agree. I acknowledge this. I should have talked with infosec about it first.

I do just want to point out, that my way and your way and someone else’s way may not be the same. But it doesn’t make it wrong unless one knows that it is wrong.

Because this was said in a previous comment on the same forum post. The author has since edited their post

18

This was not the only one. How about the one where you said multisig got hacked? :smiley:

If someone says they had a bad experience with you, it’s stating (presumably) facts. There were several complaints against you with the Ombuds office (you made this public during a CCall).

My first communication with you - bad experience. I heard you talk to other people, so yes I understand why people feel the way they feel about you. If someone doesnt like you, they dont like you.

But what you did to Trewkat (a different comment) and to multisig - it is. Now paint it whatever the way you like it, but it doesnt change what you did.

And what you did is a governance attack. Like it or not, it is.

2 Likes
19

This is that comment. I have made zero slanderous comments

Please show me what comment you are talking about. This is the only comment that was deleted. I am sorry, but you are incorrect

Would it be possible to answer my question?

“Also, out of sheer curiosity, how this would be considered slander, but it is not slander when derogatory opinions are now being shared about me, or attack me and name call, question my mental health or use the word “attack” (because that is not what I did)”

20

I believe the decentralization of governance has to have a balance so that it’s not rudderless, and so elected technocrats(expert facilitators) are consequentially needed to push the mandate forward. We instill trust that elected members see their roles as a fiduciary duty to the DAO whether implicit or implied.
I do agree that we must strive to decentralize as best we can without loosing so many things such as momentum, trust, engagement, and advantages.

5 Likes
21

Is it links’ comment you’re referring to as evidence that this was said?
As I have told you before, it’s possible to see what edits have been made to Forum posts and comments. The text about the mulitsig in links’ comment has not been altered, and does not say the multisig was hacked. It says that a hacker changed the multisig address in the documentation on Notion, and that this was the catalyst for changing the way the DAO handled Notion access.

I asked you earlier to articulate why you feel that Notion access is too centralised when we have seven workspace owners in different locations and changes are recorded in an audit trail available to page editors. Instead of providing any kind of credible evidence for your statements you just keep on making them, or as in the case above you misrepresent the evidence to defend your actions.

Whether you have directly slandered me or others - legal definition aside - is secondary to the fact you have made many inferences that core contributors are corrupt and greedy. To play innocent here, and to declare on Twitter that you ‘never impersonated anyone’ is disingenuous to the point of obstruction. If you truly cared about the DAO you would be willing to engage with the details of your concerns rather than blocking or ignoring attempts to examine your claims.

5 Likes