Marinade Finance Foils Governance Attack: Malicious Proposals Defeated, No Funds Lost
TREE NEWS reports: Solana staking protocol Marinade Finance disclosed that its DAO was targeted by attackers attempting to seize governance control through two malicious proposals on September 25. Both proposals were rejected by the DAO committee, no funds were moved, and the mSOL, Native Staking, and SAM services remained unaffected.
The attackers exploited a vulnerability in the DAO’s voting procedure that allowed a small amount of MNDE tokens to be counted as a disproportionately large voting weight. They then submitted a forged “MIP-23” proposal aimed at replacing the voting procedure, alongside a second proposal designed to drain DAO treasury assets.
How the Attack Unfolded
The exploit stemmed from a flaw in how voting power was calculated, enabling token balances to be artificially inflated. The attacker leveraged this to push two proposals: one to rewrite governance rules and another to transfer treasury funds. However, the actual voting power of legitimate MNDE holders exceeded that of the malicious proposals, and the DAO committee rejected both within six hours — roughly four days before the proposals were scheduled for execution.
Industry Implications
This incident highlights a growing trend of governance attacks across DeFi. As DAOs manage increasingly large treasuries, they become attractive targets for adversaries seeking to exploit procedural or smart contract weaknesses. While Marinade’s rapid response and the committee’s veto prevented losses, the event underscores the need for robust governance design, including timelocks, quorum requirements, and real-time monitoring.
Other protocols have suffered similar attempts, and some have lost funds. The Marinade case demonstrates that layered defenses — such as a security committee with veto power — can act as a critical backstop. However, reliance on centralized intervention also raises questions about decentralization trade-offs.
Forward-Looking Perspective
As DAOs mature, governance security will likely become a focal point for auditors and insurers. Expect to see more protocols adopting formal verification of governance contracts, dynamic quorum mechanisms, and perhaps decentralized identity solutions to prevent Sybil-style voting manipulation. Marinade’s swift remediation and transparency set a positive example, but the arms race between attackers and defenders in DeFi governance is only intensifying.
