Malicious proposal allows attacker to take over Tornado Cash governance

Tornado Cash is a privacy-focused decentralized application (dApp) that allows users to make anonymous transactions on the Ethereum blockchain. However, recent reports suggest that the governance mechanism of Tornado Cash is vulnerable to attacks, which could result in the loss of all locked votes, drained tokens, and a bricked router. Here are the most important things to know about this issue:

1. Total control over governance: The governance mechanism of Tornado Cash is based on a smart contract that allows users to lock their tokens and vote on proposals. However, if an attacker gains total control over the governance contract, they can withdraw all of the locked votes and use them to pass malicious proposals.

2. Drainage of tokens: In addition to withdrawing locked votes, an attacker can also drain all of the tokens in the governance contract. This means that they can steal all of the funds that are meant to be used for future proposals and community initiatives.

3. Bricking the router: Finally, an attacker can also brick the router, which means that they can render the entire Tornado Cash dApp useless. This would prevent users from making any transactions on the platform and could cause significant damage to the project’s reputation.

In summary, the vulnerability in Tornado Cash’s governance mechanism is a serious issue that could result in significant losses for the community. It is important for the project’s developers to address this issue as soon as possible and implement measures to prevent such attacks in the future. As always, users should exercise caution when using any decentralized application and be aware of the risks involved.