Reimburse mrtdlgc and Those Who Helped Solve Common Pool Drainage Issue

Proposal Information

On November 1st, I discovered a vulnerability on 1Hive Gardens. Anyone who submit a proposal would be arbitrarily able to drain the Common Pool funds. Upon discovering this vulnerability, I, myself decided to drain all the HNY in the Common Pool to my wallet, and then sent it to the Gardens Multisig after discussions as we thought it would not be appropriate to hold those funds in an EOA, no matter how safe it can be.

Proposal Rationale
This proposal is to reimburse myself and those who helped solve the vulnerability in Gardens due to a misconfiguration allowing anyone to drain funds from the Common Pool arbitrarily. I, unintentionally, acted as a whitehat as soon as I discovered the vulnerability and transferred around 8K HNY to my wallet as soon as possible.

Afterward, through efforts from the Seeds and Fauna, the vulnerability allowing the drainage of funds from the Common Pool was solved.

I was not intending to get reimbursed myself for this considering the current financial situation of our DAO. However, 4 days ago, two huge earthquakes stuck Turkey, one with 7.8 and one with 7.6 magnitude, killing thousands and leaving millions homeless and in hunger.

I shall be distributing 75% of the funds from this reimbursement proposal to the Gnosis DAO contributors efforts in helping funding NGOs in Turkey on Giveth.

And the rest of the funds shall be distributed among the people who helped solve the vulnerability in Gardens through Coordinape.

Team Information (For Funding Proposals)

Myself
Sem
rperez
luigy
Also DM me if I did not mention anyone if the proposal passes and we go into the Coordinape stage.

Funding Information (For Funding Proposals)

500 HNY
(300 HNY for myself as a bug bounty) (75% of which shall be directly donated to GnosisDAO’s Giveth Project)
(200 HNY to be distributed through Coordinape)

Ethereum address where funds shall be transferred:

0x14d92832265eeafdef9e526356fefc90105966c3
(my personal wallet)

Link to Proposal on Gardens:
https://gardens.1hive.org/#/xdai/garden/0x8ccbeab14b5ac4a431fffc39f4bec4089020a155/proposal/151

5 Likes

Hey @mrtdlgc maybe it’s just me but I don’t see how its a reimbursement. I see it as a bounty yes but if its a reimbursement of HNY that you loose during that, maybe I don’t understand where you lost funds :stuck_out_tongue:

Well, yes. It is actually a bounty. Forgive my wording here. But you could also see it as a reimbursement of time and effort spent by people solving the issue. :heart:

Oh alright, no problem. Just that I was looking for money lost. So hopefully there is not (only time lost and time is money/honey :p)

Exactly sir. And to give a better idea about why I am asking for this bounty is that: If I haven’t acted as quickly as possible, we would not be able to talk about any common pool right now cause well, at some point, all the HNY in the common pool was basically in my wallet, and anyone would be able to do so. Basically corresponding to critical bug due to its ease of execution according to CVSS scoring. You can do the scoring yourself as well.

It would amount to 20k according to our bug bounty rules, but I know the situation of 1hive as I am a “core” contributor myself as you know. And yeah, I am trying to do my best and trying not to hurt the DAO financially, which will constitute the main topic of my next comment under this post.

2 Likes

As the percentage of the amount I requested here as a bug bounty, namely 75%, corresponds to around 200 HNY, and considering the liquidity of HNY, I do not want to market dump, be subject to slippage, and allow some MEV bot to make money out of a humanitarian effort.

Hence, I am proposing the treasury swarm some alternatives to do some OTC trade as they have some stables already built up to help reduce the decay of HNY price in specific cases.

Would be glad if there’s some participation in the following poll or would love to hear any alternative opinions as well:

  • Should Treasury Swarm Do an OTC Deal with The Stables with mrtdlgc?
  • OTC Swap 200 HNY with corresponding Slippage on Cowswap.
  • OTC Swap 100 HNY with corresponding Slippage on Cowswap.
  • OTC Swap 50 HNY with corresponding Slippage on Cowswap.
  • No OTC Swap with the Treasury Swarm Funds. (Means, I will be market dumping)

0 voters

I want be able to help, but i dont really understand the options.

If this proposal, passes, I will get 500 HNY from the common pool, 200 of which will be distributed through Coordinape by people who helped solve the misconfiguration of 1Hive Garden. I am just asking for a bounty of 300 HNY in the proposal, and 75% of which, I will directly donate to GnosisDAO Giveth Project for the Earthquake Relief Fund, which is directly sent to one of the most reliable NGOs in Turkey, Ahbap. You can see the list of other NGOs here: Turkiye Relief DAO website.

And due to lack of liquidity of HNY, directly selling 200 HNY to the open market would be subject to like 5% slippage due to how AMMs work, and would allow a MEV-bot runner to get benefit from this transaction.

Treasury Swarm has been raising a treasury for 1hive, which consists of stablecoins, and afaik, it has around 15 + around 100k from the Luna Swarm, the main purpose of which is to utilize instead of paying contributors with HNY and to mitigate the price decay of HNY as well.

Hence, as I am planning to directly contribute with stables instead of leaving it to non-crypto natives like NGOs, which wouldn’t be able to liquidate the amount of HNY, I am proposing to do an OTC deal with our Treasury Swarm and exchange the HNY at a discount with the swarm, which then can utilize the HNY through other means to build up more stables again.

I could do the OTC myself, but I am trying to donate everything ASAP cause this is a time sensitive issue as people in the earthquake zone lack basic means of survival such as shelter, toilets, and food.

Btw, the poll got my question as one of the options. But you got the gist, I guess. :slight_smile:

We used a Hedgey Escrowless Swap for this:

Screen_Shot_2023-02-28_at_10.28.20_AM

1 Like