Build Finance Malicious Governance Takeover - Revision history

Azoundria: Another 30 minutes complete. Prevention added and much more research.

2023-07-12T15:23:10Z

Another 30 minutes complete. Prevention added and much more research.

Azoundria at 01:31, 6 March 2023

2023-03-06T01:31:51Z

← Older revision		Revision as of 19:31, 5 March 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/buildfinancemaliciousgovernancetakeover.php}}		{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/buildfinancemaliciousgovernancetakeover.php}}
			{{Unattributed Sources}}

	[[File:Buildfinance.jpg\|thumb\|Build Finance]]Build finance operated a decentralized autonomous venture builder, launching new projects using funds in a treasury overseen by a decentralized governance model. Unfortunately, a malicious actor took over the protocol and drained the funds once they gained enough BUILD tokens, managed to disable bots that notify users of new proposals, and used a successful proposal to mint themselves more tokens. All tokens were then exchanged through any available liquidity pairs. The project was unable to regain control over the smart contract. The website is presently offline as the domain expired.		[[File:Buildfinance.jpg\|thumb\|Build Finance]]Build finance operated a decentralized autonomous venture builder, launching new projects using funds in a treasury overseen by a decentralized governance model. Unfortunately, a malicious actor took over the protocol and drained the funds once they gained enough BUILD tokens, managed to disable bots that notify users of new proposals, and used a successful proposal to mint themselves more tokens. All tokens were then exchanged through any available liquidity pairs. The project was unable to regain control over the smart contract. The website is presently offline as the domain expired.

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.
			<ref name="slowmist-2069" /><ref name="buildfinancearchive-7035" /><ref name="buildfinancedocsarchive-7036" /><ref name="buildfinancemedium-7037" /><ref name="morioh-7038" /><ref name="coingecko-7039" /><ref name="financebuildtwitter-7040" /><ref name="coinmarketcapeth-4651" /><ref name="financebuildtwitter-7041" /><ref name="vice-7042" /><ref name="theblockcrypto-7043" />

	== About Build Finance ==		== About Build Finance ==
Line 81:		Line 83:
	!Description		!Description
	\|-		\|-
	\|February 12th, 2022 1:09:00 PM		\|February 12th, 2022 1:09:00 PM MST
	\|Main Event		\|Main Event
	\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
Line 108:		Line 110:
	== Ongoing Developments ==		== Ongoing Developments ==
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?
			== Individual Prevention Policies ==
			{{Prevention:Individuals:Placeholder}}

	== Prevention Policies ==		{{Prevention:Individuals:End}}
	~~Which policies could have prevented this event from happening?~~
			== Platform Prevention Policies ==
			{{Prevention:Platforms:Placeholder}}

			{{Prevention:Platforms:End}}

			== Regulatory Prevention Policies ==
			{{Prevention:Regulators:Placeholder}}

			{{Prevention:Regulators:End}}

	== References ==		== References ==
	[https://hacked.slowmist.io/en/ SlowMist Hacked - SlowMist Zone] (Jun 25)		<references><ref name="slowmist-2069">[https://hacked.slowmist.io/en/ SlowMist Hacked - SlowMist Zone] (Jun 26, 2021)</ref>

	[https://web.archive.org/web/20211028005527/https://build.finance/ BUILD Finance] (Mar 11)		<ref name="buildfinancearchive-7035">[https://web.archive.org/web/20211028005527/https://build.finance/ BUILD Finance] (Mar 11, 2022)</ref>

	[https://web.archive.org/web/20210217011742/https://docs.build.finance/build-knowledge-base/ https://web.archive.org/web/20210217011742/https://docs.build.finance/build-knowledge-base/] (Mar 11)		<ref name="buildfinancedocsarchive-7036">[https://web.archive.org/web/20210217011742/https://docs.build.finance/build-knowledge-base/ https://web.archive.org/web/20210217011742/https://docs.build.finance/build-knowledge-base/] (Mar 11, 2022)</ref>

	[https://medium.com/build-finance/announcing-build-finance-dc08df585e57 Announcing Build Finance] (Mar 11)		<ref name="buildfinancemedium-7037">[https://medium.com/build-finance/announcing-build-finance-dc08df585e57 Announcing Build Finance] (Mar 11, 2022)</ref>

	[https://morioh.com/p/8e673c5f1cdf Morioh] (Mar 11)		<ref name="morioh-7038">[https://morioh.com/p/8e673c5f1cdf Morioh] (Mar 11, 2022)</ref>

	[https://www.coingecko.com/en/coins/build-finance BUILD Finance price, BUILD chart, and market cap \| CoinGecko] (Mar 11)		<ref name="coingecko-7039">[https://www.coingecko.com/en/coins/build-finance BUILD Finance price, BUILD chart, and market cap \| CoinGecko] (Mar 11, 2022)</ref>

	[https://twitter.com/finance_build/status/1492591680716951556 @finance_build Twitter] (Mar 11)		<ref name="financebuildtwitter-7040">[https://twitter.com/finance_build/status/1492591680716951556 @finance_build Twitter] (Mar 11, 2022)</ref>

	[https://coinmarketcap.com/currencies/ethereum/historical-data/ https://coinmarketcap.com/currencies/ethereum/historical-data/] (Dec 20)		<ref name="coinmarketcapeth-4651">[https://coinmarketcap.com/currencies/ethereum/historical-data/ https://coinmarketcap.com/currencies/ethereum/historical-data/] (Dec 21, 2021)</ref>

	[https://twitter.com/finance_build/status/1493223190071554049 @finance_build Twitter] (Mar 11)		<ref name="financebuildtwitter-7041">[https://twitter.com/finance_build/status/1493223190071554049 @finance_build Twitter] (Mar 11, 2022)</ref>

	[https://www.vice.com/en/article/xgd5wq/democratic-dao-suffers-coup-new-leader-steals-everything Democratic DAO Suffers Coup, New Leader Steals Everything] (Mar 11)		<ref name="vice-7042">[https://www.vice.com/en/article/xgd5wq/democratic-dao-suffers-coup-new-leader-steals-everything Democratic DAO Suffers Coup, New Leader Steals Everything] (Mar 11, 2022)</ref>

	[https://www.theblockcrypto.com/post/134180/build-finance-dao-suffers-hostile-governance-takeover-loses-470000 Build Finance DAO suffers 'hostile governance takeover,' loses $470,000] (Mar 11)		<ref name="theblockcrypto-7043">[https://www.theblockcrypto.com/post/134180/build-finance-dao-suffers-hostile-governance-takeover-loses-470000 Build Finance DAO suffers 'hostile governance takeover,' loses $470,000] (Mar 11, 2022)</ref></references>

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/buildfinancemaliciousgovernancetakeover.php}} Build FinanceBuild finance operated a decentralized autonomous venture builder, launching new projects using funds in a treasury overseen by a decentralized governance model. Unfortunately, a malicious actor took over the protocol and drained the funds once they gained enough BUILD tokens, managed to disable bots that no..."

2023-01-28T16:48:32Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/buildfinancemaliciousgovernancetakeover.php}} thumb|Build FinanceBuild finance operated a decentralized autonomous venture builder, launching new projects using funds in a treasury overseen by a decentralized governance model. Unfortunately, a malicious actor took over the protocol and drained the funds once they gained enough BUILD tokens, managed to disable bots that no..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/buildfinancemaliciousgovernancetakeover.php}}

[[File:Buildfinance.jpg|thumb|Build Finance]]Build finance operated a decentralized autonomous venture builder, launching new projects using funds in a treasury overseen by a decentralized governance model. Unfortunately, a malicious actor took over the protocol and drained the funds once they gained enough BUILD tokens, managed to disable bots that notify users of new proposals, and used a successful proposal to mint themselves more tokens. All tokens were then exchanged through any available liquidity pairs. The project was unable to regain control over the smart contract. The website is presently offline as the domain expired.

This is a global/international case not involving a specific country.

== About Build Finance ==
"There are so many ideas in DeFi that desperately need to get built, yet nobody is working on them. Why isn’t there a DAO which actively incentivizes the development of new projects by rewarding builders with tokens? This is our attempt to start it. BUILD Finance is a decentralized venture builder."

"According to Google, venture builders are organizations dedicated to systematically producing new companies, which they help grow and succeed. There are five core activities in which venture builders engage: identifying business ideas, building teams, finding capital, helping govern or manage the ventures and providing shared services."

"BUILD Finance is a decentralised autonomous venture builder, owned and controlled by the community. BUILD Finance produces, funds, and manages community-owned DeFi products." "BUILD produces, funds, and manages decentralised solutions on Ethereum."

"BUILD operates a shared capabilities model, where the DAO provides the backbone support and ensures inter-entity synergies so that the product entities can focus on their own outcomes. Each product accrues value for the DAO and $BUILD holders."

"BUILD takes care of all organisational, hiring, back/mid office functions, and the product companies focus on what they can do best, until such time where any individual product outgrows the DAO and becomes fully self-sustainable. At that point, the chick is strong enough to leave the nest and live its own life. The survival of the fittest. No product entity is held within DAO by force."

"$BUILD token is used as a governance token for the DAO. It also represents a pro-rata claim of ownership on all DAO’s assets and liabilities (e.g. BUILD Treasury and $bCRED debt token)."

"Only provide liquidity on $BUILD if you believe in the project. As of today, the token has literally zero monetary value. The only way $BUILD can gain value is if we, as a community, start building projects around it."

"The token was distributed via liquidity mining with no pre-sale and zero founder/private allocation. The farming event lasted for 7 days around mid-Sep 2020. At the time, BUILD didn't have any products and held no value. Arguably, $BUILD has still zero value as it is not a legal instrument and does not guarantee or promise any returns to anyone."

"The Build Finance DAO has been the target of a hostile governance takeover in which a malicious actor has put forward and succeeded with a proposal to take control of the Build token contract." "Unfortunately @finance_build has been subject to a hostile governance takeover. A malicious actor has minted 1.1M $BUILD tokens and has drained the project liquidity pools."

"The venture capital DAO organization Build Finance tweeted that the project suffered a malicious governance takeover."

"The attacker succeeded in the takeover by having a large enough vote in favour of the proposal and there were not enough countervotes to prevent the takeover from happening." "The malicious actors successfully controlled the Build token contract by getting enough votes, minting 1,107,600 BUILD tokens in three transactions." "The proposal passed because no alert was issued on Discord that a new proposal had been made, The Block reported." "Thanks to their move to disable bots that would have alerted the community to the new proposal, it eventually passed."

"Suho.eth transferred tokens to 0x…2c28 and attempted a malicious takeover which succeeded at block height 14175830." "0x…2c28 minted 1,107,600 BUILD in three transactions (14182042, 48, and 54) and drained the majority of the funds in the liquidity pools on Balancer and Uniswap." "0x…2c28 then took control of the balancer pools via the governance contract and drained the remaining funds including 130k METRIC tokens."

"With most of the funds in Balancer and Uniswap liquidity pools exhausted, attackers continue to take control of the balancer pools via governance contracts and drain the remaining funds including 130,000 METRIC tokens, METRIC liquidity on Uniswap and Fantom Both pools subsequently came under intense selling pressure."

"Both METRIC liquidity pools on Uniswap and Fantom were then subject to intenses sell pressure as the attacker sold all 130k METRIC tokens into the available liquidity." "0x…2c28 then minted 1,000,000,000 BUILD at block height 14188763." "The attacker proceeded to sell BUILD tokens into whatever available liquidity was present; this situation is ongoing although activity appears to have abated as per 14:00h on 13th February 2022." "The wallet where the drained funds went appears to have gone silent two days ago after sending 163 ETH to Tornado Cash, a service that lets users obscure Ethereum transactions."

"As a byproduct of the DAO structure the attacker was able to gain access to 130,000 METRIC tokens that were contained within the BUILD DAO treasury, all of these tokens were sold into the market using whatever liquidity was available." "This extreme supply shock has caused a large fall in the spot price of the METRIC token. However, the attacker does not have control of any parts of the METRIC token or the http://metric.exchange infrastructure."

"The team does not believe the attacker has the ability to cause any further disruption to METRIC, and it should be safe to trade METRIC tokens again with the following caveat: the supply shock has still caused a large change in the distribution of METRIC token and it is" "still possible that a percentage of these tokens may be under control of heretofore unidentified bad actors. However we do not believe there is any outstanding systemic risk to METRIC token or http://metric.exchange."

"The attacker was able to access funds in this way due to the structure of the Build DAO governance model. It is believed that the attacker took extra steps to stop evidence of their activities by way of disabling the gitbooks and the proposal bot."

"It is with deep regret that we have to inform the community of this total and irrecoverable loss of BUILD DAO treasury assets through the deeds of one malicious actor." "Team members have made direct contact with the attacker but there seems to be no appetite for a dialogue, much less any reparations."

"As it stands, attackers have full control over governance contracts, minting keys, and treasuries, and the DAO no longer controls any part of critical infrastructure." "As things stand, the attacker has full control of the governance contract, minting keys and treasury. The DAO no longer has control over any part of the key infrastructure. Do not buy BUILD tokens on any platform."

"We would welcome a discussion in the discord with community members about the way to move forward from this but it is difficult to see a future for BUILD with only its brand recognition and IP assets, and no liquid treasury." "However we do believe that due to the lack of severe impact on the core infrastructure of http://metric.exchange, the Metric protocol and METRIC token can continue to operate and develop independent of the BUILD DAO."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:
* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - Build Finance Malicious Governance Takeover
!Date
!Event
!Description
|-
|February 12th, 2022 1:09:00 PM
|Main Event
|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
|-
|
|
|
|}

== Total Amount Lost ==
The total amount lost has been estimated at $490,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?

== Prevention Policies ==
Which policies could have prevented this event from happening?

== References ==
[https://hacked.slowmist.io/en/ SlowMist Hacked - SlowMist Zone] (Jun 25)

[https://web.archive.org/web/20211028005527/https://build.finance/ BUILD Finance] (Mar 11)

[https://web.archive.org/web/20210217011742/https://docs.build.finance/build-knowledge-base/ https://web.archive.org/web/20210217011742/https://docs.build.finance/build-knowledge-base/] (Mar 11)

[https://medium.com/build-finance/announcing-build-finance-dc08df585e57 Announcing Build Finance] (Mar 11)

[https://morioh.com/p/8e673c5f1cdf Morioh] (Mar 11)

[https://www.coingecko.com/en/coins/build-finance BUILD Finance price, BUILD chart, and market cap | CoinGecko] (Mar 11)

[https://twitter.com/finance_build/status/1492591680716951556 @finance_build Twitter] (Mar 11)

[https://coinmarketcap.com/currencies/ethereum/historical-data/ https://coinmarketcap.com/currencies/ethereum/historical-data/] (Dec 20)

[https://twitter.com/finance_build/status/1493223190071554049 @finance_build Twitter] (Mar 11)

[https://www.vice.com/en/article/xgd5wq/democratic-dao-suffers-coup-new-leader-steals-everything Democratic DAO Suffers Coup, New Leader Steals Everything] (Mar 11)

[https://www.theblockcrypto.com/post/134180/build-finance-dao-suffers-hostile-governance-takeover-loses-470000 Build Finance DAO suffers 'hostile governance takeover,' loses $470,000] (Mar 11)