GoPlus Security 🚦 (@GoPlusSecurity): 🧵1/4

🧵1/4 ⚠️ Vulnerability Analysis: Token of Power Exploit Analysis Token of Power (TOP) on #TH was exploited due to a #AragonDAO misconfiguration, resulting in a loss of 944.2 $WETH, approximately $1.5 million. Attack Mechanism Analysis: 1. The attacker completed the entire process of submitting, voting on, and executing an execution script within the same transaction. During this process, there was no timelock between script submission and voting, nor between voting and execution. Whether the vote could pass was determined by the ratio between a user’s $TOP balance and the total supply. The attacker held 8,192.000001 TOP, while the total supply was 16,384, meaning the attacker held more than 50% of the total $TOP supply. As a result, the attacker was able to pass the voting threshold alone and execute the proposal within a single transaction.