0xf7253a0e…0041sent to0x1f3d3a7a…0591·#25,728,670·0xecf719d5…d3db16
{"title":"Security Bounty for blockful","description":"## Summary\n\n$150,000 security bounty to blockful for discovering and remediating a governance capture vulnerability in Shutter DAO.\n\n## The vulnerability\n\nCapturing Shutter DAO governance cost roughly $150k to reach quorum, against a treasury of about $6M. That is a ~45x return for an attacker.\n\nblockful proved the attack was practical by accumulating 2.2M SHU in 3 days without price impact, then disclosed it responsibly to the brainbot team, who acted on the information and delegated 60M SHU to raise the cost of attack.\n\n## Remediation\n\n- Cyfrin-audited SecurityCouncilAzorius veto guard\n- 2-day timelock on proposal execution\n- Anticapture monitoring for abnormal token accumulation\n\n## Payout\n\n- $149,900 in sUSDS shares\n- $100 in ETH to fund the recipient wallet for gas\n\n## Included at no cost\n\n12 months of governance frontend support on Anticapture for Shutter DAO, covering the governance frontend and other Anticapture products.\n\n[Forum discussion](https://shutternetwork.discourse.group/t/retroactive-grant-for-blockfuls-security-work/810)"}