Cowrie Research

indexed-finance-hostile-governance-treasury-hijack-attempts-2023-11-16

13 min read

Indexed Finance Hostile Governance Treasury-Hijack Attempts (2023-11-16)

  • Name: Indexed Finance hostile governance treasury-hijack attempts
  • Date: 2023-11-16
  • Protocol: Indexed Finance / Indexed DAO
  • Chain: Ethereum
  • Category: governance capture / low-attention governance / remnant-treasury hijack / timelock-admin seizure attempt
  • Loss: no hostile treasury drain completed, but the attacker targeted the remnants of Indexed’s treasury and control surface, including about 36,662.6871 DAI, 4,652,138.2909 NDX, 19,961.2345 SUSHI, 50,929.9765 ZRX, and the NDX minter role; contemporaneous Indexed team commentary described the treasury at roughly $36k in DAI plus about $48k in NDX before slippage
  • Summary: This was a governance-capture attack against a mostly defunct protocol whose governance and treasury still had live admin rights. The first hostile proposal, created on 2023-11-16, tried to seize Indexed’s timelock admin, set the NDX minter to the attacker’s address, and transfer out the remaining treasury assets. Community holders narrowly defeated that attempt after an Indexed team member warned that only a few thousand votes separated the sides. The attacker then pivoted from direct treasury sweeping to constitutional seizure: proposal 27, titled Disable timelock admin, won the vote, was queued, and would have made the attacker the timelock’s pending admin. Defenders only neutralized that queued takeover by racing through proposal 29, which transferred timelock admin to a trusted multisig and was executed before the hostile path could complete. The preserved lesson is that a dead or abandoned DAO can still be very alive as an attack surface if its governor, timelock, token minter, or treasury never get decommissioned.
  • Trigger / entry point:
    • Indexed DAO governance still controlled the timelock admin path, the NDX token’s minter role, and remnant treasury balances even though the protocol had been largely inactive since the 2021 exploit.
    • A stale governance market with low attention and concentrated surviving voting power still had enough authority to pass privileged proposals.
    • The timelock / governor surface could execute arbitrary privileged calls, including setPendingAdmin(address), setMinter(address), and direct ERC-20 transfer(address,uint256) calls.
    • Defenders were relying on ad hoc community awareness and emergency coordination, not on a decommissioned governor, guardian, or hard onchain quarantine of the remaining control surfaces.
  • Root cause:
    • Indexed left a meaningful control plane live after the protocol was effectively dead: the governor still had root authority over treasury balances, timelock administration, and NDX minting.
    • Governance legitimacy had decayed far below governance power. The protocol no longer had an actively maintained community, but passed proposals still retained constitutional force over real assets and admin rights.
    • There was no automatic vote-neutralization, shutdown path, or stricter review layer separating low-attention governance from root actions such as treasury transfers, minter reassignment, or timelock-admin handoff.
    • In practice, the system treated whoever can still gather votes in the ruins as the rightful owner of the protocol’s remaining assets.
  • Exploit path:
    1. On 2023-11-16, attacker address 0xdf0b30404Ecbf0Fd6905D7722f76B0a9D3DA6E14 created proposal 24 against Indexed governance 0x95129751769f99CC39824a0793eF4933DD8Bb74B.
    2. Proposal 24 bundled six privileged actions: set the timelock 0x78a3eF33cF033381FEB43ba4212f2Af5A5A0a2EA pending admin to the attacker, set Indexed token NDX minter on 0x86772b1409b61c639EaAc9Ba0AcfBb6E238e5F83 to the attacker, transfer 4,652,138.29085531422 NDX, transfer 36,662.68710293726776093 DAI, transfer 19,961.234518689394 SUSHI, and transfer 50,929.976511876989147592 ZRX to the attacker.
    3. Laurence Day warned publicly that a hostile governance attack was underway against the remnants of Indexed’s treasury and asked remaining NDX holders to self-delegate and vote Against before voting closed.
    4. Proposal 24 was narrowly defeated. Tally shows 402,219.034255967828818148 votes For versus 413,035.761654950603787886 votes Against, confirming that the treasury-sweep path failed only because a small set of remaining holders mobilized in time.
    5. The attack then shifted from immediate asset transfer to governance-root capture. On 2023-11-22, attacker address 0x284D72effa0a1a6E4801A682C464908c5716D697 created proposal 27, also titled Disable timelock admin.
    6. Proposal 27 was simpler and more dangerous constitutionally: it only called setPendingAdmin(address) on the timelock, setting the attacker’s own address as pending admin. If later accepted, that would hand the attacker the timelock root key above treasury actions and other governance-controlled surfaces.
    7. Unlike proposal 24, proposal 27 actually passed the vote stage. Tally shows 493,945.183780225058640418 votes For against 468,956.312850520571836320 Against, and the proposal was queued onchain in transaction 0x28db3af5afff9b234492625945b48bde70abdde4afe576ddeb80181af0ef7ec7.
    8. Defenders responded with proposal 29, Assign ownership of timelock to trusted multisig to prevent hostile takeover, which called setPendingAdmin(address) on the timelock for trusted multisig 0xbe85AB86dF87529c75561950249E5D90284D5F48 and then acceptAdmin() from that target.
    9. Proposal 29 passed unanimously with 569,141.132628045379133060 votes For, was queued, and was executed in transaction 0x8544814b77f6406193b3a9ee6ac84dd9a9afd53ca94c26099edbdb38459400ef.
    10. After the defensive admin migration succeeded, hostile proposal 27 was canceled in transaction 0x773fad57f37444ffe39de6ceedc19bc8cf43e1a9b1834f446d2f4b0fe79022d4, ending the immediate takeover attempt.
  • What the attacker needed to be true:
    • A mostly inactive protocol still needed to retain live governance authority over non-trivial assets and admin roles.
    • Enough NDX voting power had to remain reachable by a hostile proposer despite the protocol’s dormancy.
    • The governor / timelock had to allow direct root actions instead of narrowly scoped parameter updates.
    • Community monitoring had to be weak enough that a proposal could approach passage before enough legacy holders noticed.
    • There had to be no stronger break-glass control already sitting above the old governor.
  • Technical anatomy worth remembering:
    • Proposal 24 shows the most obvious remnant-treasury hijack shape: combine timelock-admin seizure, token-minter reassignment, and direct treasury transfers in one vote.
    • Within the governance-decay branch, Indexed is the clean dead-protocol remnant-authority / defender-race anchor: the protocol was socially over but its timelock, minter, and treasury were still live, so the attacker escalated from direct sweep proposal to cleaner constitutional seizure while defenders survived only by outracing the hostile queue.
    • Proposal 27 is the cleaner governance-capture anatomy. The attacker no longer needed to specify the treasury drain up front; controlling timelock admin would have been enough to dominate the remaining Indexed control surface.
    • The interesting failure is not just low turnout. It is that Indexed’s post-mortem state still left real power behind a governor that no longer had healthy social defense.
    • The defensive success came from outracing the hostile queue with another governance action, not from a built-in constitutional safeguard. That means the protocol survived because some old holders were still reachable, not because the design was robust.
    • This is a good dead-protocol governance is still live risk exemplar: deprecating development does not decommission the governor, timelock, treasury, or minter unless someone actually unwinds them.
  • Representative transactions and addresses:
    • Indexed governance: 0x95129751769f99CC39824a0793eF4933DD8Bb74B
    • Indexed timelock: 0x78a3eF33cF033381FEB43ba4212f2Af5A5A0a2EA
    • NDX token: 0x86772b1409b61c639EaAc9Ba0AcfBb6E238e5F83
    • DAI token: 0x6B175474E89094C44Da98b954EedeAC495271d0F
    • SUSHI token: 0x6B3595068778DD592e39A122f4f5a5cF09C90fE2
    • ZRX token: 0xE41d2489571d322189246DaFA5ebDe1F4699F498
    • Hostile proposer / treasury-sweep target: 0xdf0b30404Ecbf0Fd6905D7722f76B0a9D3DA6E14
    • Hostile timelock-admin proposer: 0x284D72effa0a1a6E4801A682C464908c5716D697
    • Defensive proposer: 0x7e388444731C38189C0685F6D98605107fF59282
    • Trusted multisig / new timelock admin: 0xbe85AB86dF87529c75561950249E5D90284D5F48
    • Proposal 24 creation tx: 0x96993d8baf553fe655a237dcee6104186939aa2a37a3e51ffbb5ac8bfad7338c
    • Proposal 27 creation tx: 0x062fec19df745de1f8744eeb02abe1df1eb5c04dc3dfee741189ad32217c8b70
    • Proposal 27 queue tx: 0x28db3af5afff9b234492625945b48bde70abdde4afe576ddeb80181af0ef7ec7
    • Proposal 27 cancel tx: 0x773fad57f37444ffe39de6ceedc19bc8cf43e1a9b1834f446d2f4b0fe79022d4
    • Proposal 29 creation tx: 0x6dc407d1491c2297dd0d797024834d6b80e7514cebbf5a0c784412c73361430f
    • Proposal 29 queue tx: 0x571fab1167e34e6ecaeea07bb8b06df599d29bf2a0b5ae53bd5a94e37b343e6a
    • Proposal 29 execution tx: 0x8544814b77f6406193b3a9ee6ac84dd9a9afd53ca94c26099edbdb38459400ef
  • Response / mitigation:
    • Indexed contributors publicly warned holders that a hostile vote was live and asked them to self-delegate and vote against it.
    • Remaining community members narrowly defeated the first treasury-sweep proposal rather than assuming an abandoned protocol was harmless.
    • Defenders then had to use governance itself to migrate timelock admin to trusted multisig 0xbe85AB86dF87529c75561950249E5D90284D5F48 before the attacker’s already-queued admin-seizure path could finish. That is an important anatomy detail: the protocol survived by outracing stale constitutional machinery with more constitutional machinery, not because an already-built shutdown or guardian layer caught the problem.
    • The incident’s deeper mitigation lesson is structural: dormant protocols need explicit shutdown, admin migration, vote neutralization, or treasury offboarding rather than just social abandonment.

Pattern tags

  • governance-capture
  • governance-decay-remnant-authority-capture
  • deprecation-without-deauthorization
  • backstop-failure-governance-capture
  • The decisive trick was not flash liquidity, proposal-smuggling code, or a hidden signer compromise. It was that a socially dead DAO still retained enough constitutional force to rewrite timelock-admin, mint, and treasury reality.
  • Proposal 24 preserves the direct remnant-treasury sweep branch; proposal 27 preserves the cleaner constitution first, treasury later branch where seizing timelock admin mattered more than naming each token transfer up front.
  • The defensive success was itself evidence of weak design: Indexed survived only because legacy holders could still be roused into an emergency counterproposal race before the queued hostile path matured.

Why the exploit worked

  • Indexed still treated a mostly abandoned electorate as fully legitimate constitutional authority over timelock admin, NDX minting, and leftover treasury assets. Once that mismatch existed, the protocol had already become cheap to attack relative to the value still behind governance.
  • Governance power was too broad for such a weak social shell. A passed proposal could directly call setPendingAdmin(address), reassign the NDX minter, and transfer treasury tokens without any narrower constitutional lane for root actions.
  • The protocol had no stronger retirement boundary. There was no precommitted shutdown path, no already-installed successor custodian, and no hard deauthorization of remnant root powers after the protocol had effectively died.
  • Defender success depended on ad hoc attention, not standing safeguards. Proposal 24 failed because people noticed; proposal 27 nearly succeeded because the same sleepy constitution was still the only machine that could save the protocol.
  • Indexed therefore preserves a sharper lesson than generic low turnout: the real bug was that governance legitimacy had decayed far below governance authority, yet the timelock still honored both as if nothing had changed.

Detection and audit pivots

  • Inventory every inactive, deprecated, or post-incident DAO and ask what root powers still remain live: timelock admin, token minter, treasury balances, proxy admin, market admin, or signer-set control.
  • Compare protected value with the cost of decisive governance capture in current attentive float, not historical token distribution. Indexed’s remnant DAI, NDX, and token balances were small in absolute terms, but still large versus the cost of mobilizing a sleepy electorate.
  • Flag any proposal path that can seize a cleaner second-stage root key. Proposal 27 mattered more than proposal 24 because pending admin on the timelock was constitutionally stronger than one bundled treasury sweep.
  • Ask whether defenders would need to improvise a counterproposal race to survive. If the only realistic rescue is mobilize the ruins faster than the attacker, the backstop is already too weak.
  • Treat abandoned-governance alerting as security-critical until authority is truly extinguished. If no one watches the queue and no successor custodian is installed, the system is still live risk.
  • Review whether retirement status is machine-legible. A protocol that calls itself dead but still exposes live treasury, minter, and admin verbs is not retired from an attacker’s point of view.

Failure-prevention checklist

  • Tie protocol retirement to authority reduction: migrate or offboard residual treasury balances, revoke token minters, and remove stale timelock-admin paths instead of leaving them behind a sleepy governor.
  • Split constitutional root actions from ordinary governance. Timelock-admin reassignment, mint-role transfer, treasury seizure, and equivalent authority-moving calls should require a much stronger lane than day-to-day parameter changes.
  • Put dormant deployments into explicit sunset mode: disable new proposals, lengthen delays, raise thresholds, or narrow governance scope while residual assets and admin rights are being unwound.
  • Pre-authorize a successor custodian or shutdown path before the electorate decays. Defenders should not need to improvise whether they are allowed to rescue a dead DAO’s live root key.
  • Keep proposal alerting, delegate paging, and queue monitoring first-class until governance authority is actually extinguished.
  • Neutralize treasury-held governance inventory and other residual vote blocs before treasury-management or cleanup votes can themselves reshape the electorate.
  • Treat pending admin, proxy admin, minter, and equivalent meta-authority objects as higher-priority retirement targets than the residual treasury they guard.
  • Periodically re-price governance capture against residual protected value. If buying or mobilizing votes is cheaper than the cash, mint rights, or admin powers left behind, decommissioning is already overdue.

Audit prompts

  • Which supposedly dead or inactive deployments can still move treasury, mint supply, reassign timelock admin, or transfer proxy / market ownership right now?
  • If a hostile proposal passed tomorrow, what exact authority object would it seize first: treasury tokens, token minter, timelock admin, proxy admin, or some cleaner second-stage root key?
  • How much real attentive float remains, and what would it cost to cross proposal threshold plus quorum under current liquidity and self-delegation conditions?
  • Would defenders have any interrupt path besides notice, coordinate, and pass a faster counterproposal?
  • Has the protocol defined a machine-legible retirement state, or is abandoned only a social description while onchain authority stays live?
  • Which remnant governance powers are still broader than the social layer defending them?
  • If the last alerting path failed for one vote cycle, what residual treasury, mint, or admin rights would still be exposed?
  • Are there any legacy token roles or timelock verbs that should have been revoked immediately after the protocol’s main business effectively ended?

Lessons that should already be standard

  • A dead DAO with live timelock admin is not dead enough.
  • The right retirement question is not can anyone still vote? but what real-world value or root authority does that vote still control?
  • Defeating one hostile proposal does not solve remnant-authority risk if the same constitution can be attacked again one week later.
  • Treasury sweep proposals are noisy, but constitutional-seizure proposals are often the more dangerous shape because they turn one vote win into durable root authority.
  • Governance alerting is only a temporary bridge. If legacy holders must be roused by surprise every time, decommissioning is unfinished.
  • Social abandonment without admin extinction converts yesterday’s governance into tomorrow’s unattended root key.
  • A protocol can be economically small and still worth attacking if the residual authority is cleaner than the market cap suggests.
  • Pending admin and other meta-authority objects deserve the same incident-response urgency as direct treasury outflows because they are often the real control surface.

Why this incident matters

  • It preserves a governance-capture case where the core issue was not flash loans or thin-spot token accumulation, but remnant authority left behind after the project died.
  • It is the clean dead protocol still had live governor -> live timelock admin -> live minter / treasury anchor inside the broader retirement-boundary family. The preserved healthy boundary was not merely watch sleepy votes better; it was turn the leftover governor into a deliberately narrowed or extinguished residual authority object before attackers could buy or mobilize the ruins.
  • It shows how little value is needed for a stale governance surface to become worth attacking once the protocol still controls transferable assets or mint rights.
  • It is also a useful defender-race case: once proposal 27 had queued a pending-admin handoff, the remaining community only survived because it could still assemble enough votes faster than the hostile queue matured.
  • It is a useful comparison point for any DAO that considers itself inactive while still leaving a governor, timelock, token minter, or treasury live onchain.

Internal linkages

Control surface

Graph View

Backlinks