BanklessDAO Incident Report - Governance Sybil Attack

[Sprinklesforwinners]

I did not delete any messages in the Governance channel. I have no clue what you are talking about. I also am not sure if you know what gaslighting is, that is not what I have done. It is what you do here with this.

[quote=“AboveAverageJoe, post:41, topic:5533”]
I don’t want to compare Sprinkles to cancer, as I feel that’s unfair to her, so please understand this analogy that follows is not asserting that, it is more reflective of her behavior.

When a body has cancer, and it is not removed, it kills the host, and it must be removed completely or it will return and spread. What sprinkles has done is just as dangerous and life threatening, and we must as an org take the steps to remove this threat, or we risk losing everything we have worked for the last two years plus to build. It is painful, it is ugly. It is necessary.
[/quote]l
I am unsure if you think saying this is okay because it is prefaced with I don’t want to say, but it’s not okay and shame on you.
FYI, my husband - you know, the one that left me last week. Well he had Cancer. Probably just about 4 years ago. It was awful and the worst year of my life.

. I may not be at my best right now, but thank you Joe for daily questioning my mental stability.

I am too upset to really respond right now and any other words that I have for you will only get me into more trouble.

Last thing if you are looking to quote the Bible, I have one for you:
Galatians 6:3

[Sprinklesforwinners]

I am fully doxed. Feel free to check my Facebook page

[NFThinker]

@Sprinklesforwinners you are a curious explorer of our community, constantly asking questions to see what you may have missed. It’s a sort of “no stupid questions” approach. This can be helpful, and it’s led you down some important rabbit holes. The problem is, sometimes you discount a valid answer because it “could” be wrong, and you do so in a very public and accusatory way. You continuously ask leading questions to get the answer you’re looking for, and when it doesn’t come you cry wolf.

It’s OK to follow up assumptions with a thorough investigation, but when allegations start to fly you should have solid evidence of harm done, not just point out the possibility that harm could be done, therefore everyone’s corrupt. You are correlating possibility with probability.

@Sprinklesforwinners

The fact of the matter is that some of the centralized admin access may have been calculated, while others may not have been.

Yes, it’s possible our admins colluded to control power, but it’s not probable. This can be deduced from their past actions and their continued support of the DAO with little compensation. I also know many of them personally through IRL events, and can vouch for them. But if I’d vouched for them, I fear I would have been lumped in as a co-conspirator.

I don’t disagree, many of the governance flaws you brought to light are important, but they have all been discussed in Discord governance channels, and you could have led the effort there in a more level headed way,

Some of the accusations you listed were blatantly false. The multisig was NOT hacked. Our public Notion settings led to the main multisig address being manually changed, which led us to tightening permissions.

In summary, you’ve acted in a deranged manner and could possibly benefit from personal growth through therapy, medication, or a combination of the two. I’m not a doctor, but I do think you should see one.

I don’t think you should be drop kicked out of here. I think you should be given a chance for reform, and until you can provide proof, you should have all access and community rights revoked.

@Icedcool, you asked for next steps. I propose the following for Sprinklesforwinners:

• issue a public apology (details of that apology TBC)
• ban from Discord, Discourse, Notion editing and wider community tooling for 6 months
• show proof that she has sought reform through therapy, and provide a bill of clean mental health from a medical professional before being allowed back into forums and chat spaces
• ban from holding any Committee, Guild, or Department roles for 6 months after her return
• ban from seeking grant funding for any project for 6 months after her return

I realize we’re operating in a pseudonymous environment, and my suggestions fly in the face of that, but recent occurrences have shown that if we are going to act as a community that trusts each other, we also need to depend on some traditional forms of remediation and reform.

EDIT: I have no basis for choosing the time periods of 6 months, and leave this open to interpretation by any community appointed arbiter(s)

[DAOlexa]

Still not taking responsibility for your actions; and still going with the victim narrative.

Do you think this is a fun discussion for anyone in the DAO to have?

Did this come out of nowhere?

You literally attacked governance, slandered contributors using fake accounts and spread lies about multisig being hacked (are you aware what situation that puts the multisigners in?), tried to lie about it, then when it wasn’t possible anymore, you blamed it on the community, and took quotes from the BanklessDAO’s governing docs and twisted them to serve your purpose.

So many people in the DAO has some issues with you before this. It’s repetitive and continuous.

Joe ain’t questioning your mental stability ffs, he is literally stating your actions and everyone who can read can see those are the facts. Whether you have mental issues or not, well heck everyone has some, is not what’s been discussed here. It’s your actions!!!

Where do they come from - from you not really getting it, or being malicious, or bc you do have some mental issues - we do not care!

[brianl]

@Sprinklesforwinners

The L2 role tag (which only allows messages to be pinned, role tags assigned, the ability to delete others messages and to VIEW the server audit log) was simply taken away from me.
Was it because I am not deserving of the tag or because I am not wanted to see the audit log and changes made.
Either way, can 1 person decide this?

Your L2 tag was temporarily suspended as a security measure, which I believe any organization of any sort would have done in this situation. It could easily be restored later if that is the will of the DAO. When this situation came to my attention temporarily pulling the L2 tag was my very first thought. For several weeks now I have started every morning by opening the Discord Audit Log and filtering by your username to see what damage you’ve done.

What bot have you screwed with:

Or deleted from the server:

What setting have you randomly changed:

What channel have you deleted:

Can one person decide this? Yes, probably. That’s reasonable for a system admin to do in a scenario like this. But that’s not what happened here.

[Sprinklesforwinners]

I am unsure what is wrong with any of these changes @brianl , but it’s irrelevant.

You should then be able to tell us who modified the @bdaomultisig tag so that it was un-taggable

[AboveAverageJoe]

As an addendum to my previous post:
Work done must be compensated, and as part of the freezing of BANK payments, the value should be converted to stablecoins and paid out in that form to settle the debt.

An offer at market rate for BANK she holds to be bought back, also in USDC/ETH. We cannot nor should we force her to sell, but I believe we should proactively give an offramp to that Bank. She can choose to decline at her prerogative.

[Icedcool]

Vote Options:

Based on the above discussion I’ve Identified these options:

1. Timeout in the DAO
2. Temporary ban from the DAO (with a timeout)
3. Permanent Ban from the DAO (without timeout)
4. Do Nothing

If there are any others, please respond.
I will leave this on the forum for 1 day, then create a gated poll to L1 to be voted on for 7 days in the DAO.

Open to debate whether it should be L1 or L2 only.
Thoughts?

---

1. Timeout in the DAO

Temporary Restrictions, but she can stay at the DAO.

This includes:

• Removal of L2
  • L1 Is maintained as long as she qualifies.
• Removal from Notion admin privileges.
• Ineligible for DAO elected Roles and multisig involvement.

This will be rescinded AFTER the timeout period is done.

Suggested 1 Seasons (4 months).

2. Temporary Ban

This is essentially a more serious timeout, that would be rescinded after the ban timeout expires.

This includes:

• Temporarily banning her account and wallet from discord, with a timeout.
• Temporarily banning her account from Discourse with a timeout.
• Removal from Notion admin privileges.

Suggested 1 Season (4 months)

3. Permanent Ban

This is permanent expulsion.

This includes:

• Permanently banning her account and wallet from the the DAO.
• Permanently banning her account from Discourse with a timeout.
• Removal from Notion admin privileges.

4. Do nothing

Self explanatory.

---

@AboveAverageJoe

Ban IP from Discourse
Ban from Discord
Ban from Notion

High level, these are the only actions we can take as a DAO.
The others, are the prerogative of their individual units.

[iSpeakNerd]

I don’t disagree with the points raised or the possibilities for forward movement here.

I would however, like to point out that afaik the DAO still does not have an approved, consistent policy for:

• offboarding (what to do with member’s permissions)
• what constitutes a violation that necessitates offboarding (where is the line?)
• and a written enforcement mechanism for said policies

I have raised the issue in the past and it was an issue of social conduct that the #daoversity workstream that @RedCrystalDragon, @VallentinaC, @Humpty and I were active on in may 2022. These things above are necessary and have been missing from bDAO constitution as a Code of Conduct and have allowed negative behavior to continue and escalate unchecked until it becomes a crisis level issue when things could have been addressed before they reach that level if people know where the line is.

P.S. it appears red has been active in trying to revive the Code of conduct on the forums in the time since

[Jengajojo]

Thanks for taking the lead on this @Icedcool I agree with the options you have listed.

Since many people call for a 6 month or more “time-off” I’d like to suggest changing the scope of time out and temporary ban to 2 seasons.

[DAOlexa]

I did a code of conduct, if you would have to review - BanklessDAO Code of Conduct - Google Docs

Would love to see what was done and see what can be merged.

[homie]

@AboveAverageJoe

Blocking funding to any project that retains her as a contributor from the GC or main treasury, Guilds or Projects.
Removal/Ejection from any DAO tooling missed by this list in which she may have access.

I’ve had a lot on my mind in regards to this.

This statement above spoke to me:

During the cooridnape attack, when whales admitted that he stole from the DAO.

Design Guild Paid him out. This is no disrespect to @Reinis , and he put out a sensible point behind why he paid whales out. Even though whales did a major effort to hurt me, hurt the DAO, hurt coordinape (an external project) @Reinis was right in the decision he made in paying whales out.

However, if you discipline projects due to sprinkles, and you didn’t discipline projects do to whales. That’s going to leave a mark. I encourage you to reconsider this aspect of your decisions.

[angyts]

This is really shocking. Thanks for sharing.

I feel sorry for all parties involved.

Mainly because there are a lot of flaws in DAO governance. And this case really opened the can of worms. Whereas previously we have used our human discretion and “good faith” to mull over all the differences.

I guess it’s time to upgrade our systems again.

[Icedcool]

I’ll create a secondary vote to collect those opinions.

Personally, 2 Seasons would be 8 months and that feels like a long time to me.

[Humpty]

I second this. It is why I have stated that it seems like it an emotional reckoning and not one based on written policy. Personally, I feel bDAO has existed long enough to have established more robust processes for this and similar instances. Specially as this is not the first time we are dealing with this type of behavior. I introduced several forms of doing this in the past with Colony, Moloch DAO, and other decentralized tools in the past, but it fell to deaf ears. I’d like to think that bDAO will now take its responsibility to its community more seriously and build better governance. But sadly, I expect nothing will come out of this too.

[links]

@Humpty

But sadly, I expect nothing will come out of this too.

We are responsible for our own initiatives in a DAO. If you want something to happen, why not spearhead the issue? There are lots of people interested, I’m sure you will find others who want to help.

[Humpty]

I have. Please re-read, “I introduced several forms of doing this in the past with Colony, Moloch DAO, and other decentralized tools in the past, but it fell to deaf ears.” This was back around Season 3 of bDAO. I would happily collab on this again “But sadly, I expect nothing will come out of this too.”

There is a culture change needed. And reading many of the comments on this forum and on Discord the past few days, I am not sure how open we would be to taking on such a change. Though without it, I see it very difficult to grow beyond where we find ourselves today.

[links]

@Humpty

“I introduced several forms of doing this in the past with Colony, Moloch DAO, and other decentralized tools in the past, but it fell to deaf ears.”

What do you mean by introduced? Did you test them in a project or guild? Are there tests spaces that one can log into to see how it works? That would be awesome and engaging!

Again I say: people are interested in this now, so now is a great time to gain consensus. If you care about this then it’s an excellent time to get others to care as well. Why not start by sharing the lessons you learned while introducing these tools in S3?

[homie]

But perhaps not long enough when it comes to the attackers mindset.

[cryptodad]

It took me a bit to wrap my head around what went down. IMHO, I’ve got much respect for @Sprinklesforwinners as a top-notch contributor in bDAO. She has done great work with the Project Management Guild, Treasury Department, and Grant Committee. I bet many people who’ve worked with her feel the same way. My first thought was like, “No way, not her!” 'Cause it’s clear she’s all about this community based on her past actions. However, I strongly disagree with how she tried to show off our system’s vulnerability. That being said, it’s crucial to remain objective when assessing this incident and determining appropriate consequences, considering both her previous contributions and the harm caused by this incident.

Rather than becoming sidetracked by minor disputes in the thread, I suggest we should get our community to focus on the big picture:

1. Which principles have been violated?
2. What was her intention, and was it positive or negative? It may also be necessary to consider her recent personal challenges with her family.
3. What consequences or damages resulted from this incident? What sort of restitution or punishment, both financial and non-financial, needs to happen?
4. How can we prevent similar incidents in the future?
5. Verify the frustrations expressed by @Sprinklesforwinners. If found to be accurate, what solutions should be implemented?

In the end, let’s all just chill a bit and handle this thing together. The long-term well-being of bDAO will benefit if we can collaborate with all members, including @Sprinklesforwinners , to resolve the situation.