# \[Post Mortem\] ZRX Treasury patch **URL:** \ **Category:** Core Protocol\ **Created:** [May 4, 2021, 4:54pm UTC](https://forum.0xprotocol.org/t/post-mortem-zrx-treasury-patch/890 "2021-05-04T16:54:29Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![mintcloud](https://yyz1.discourse-cdn.com/flex027/user_avatar/forum.0xprotocol.org/mintcloud/32/166_2.png) [@mintcloud](https://forum.0xprotocol.org/u/mintcloud)\ **Post date:** [May 4, 2021, 4:54pm UTC](https://forum.0xprotocol.org/t/post-mortem-zrx-treasury-patch/890/1 "2021-05-04T16:54:29Z")
### What happened? Shortly after announcing [0x DAO’s treasury address](https://blog.0xproject.com/0x-dao-is-now-live-a71c051984c4), we were approached by [samczsun](https://samczsun.com/) who identified an exploit vector that would make it possible to virtually inflate the voting power of a ZRX holder or delegate. We estimated that it would theoretically be possible to inflate voting power by a factor of ~1000x. The exploit would consist in repeating multiple times the `operatedPoolIds` in the `castVote` and `propose` methods, trying to cover most of a block’s computation (e.g. by setting a high gas price and a high gas limit). This exploit would have enabled relatively small ZRX holder or pool operators to: - create proposals even if they didn’t meet the 100k ZRX minimum threshold - single-handily decide the outcome of a vote. A malicious proposal could, for example, send the entirety of the ZRX treasury to themselves Note that the 0x DAO is not connected to the core 0x smart contracts at this time, and **therefore no user funds were ever at risk.** However, the 2M ZRX tokens held by the DAO (seeded by 0x Labs), could theoretically be moved if a malicious proposal were to pass. ### What did we do? Shortly after samczsun reached out to the 0x Labs team, we immediately verified the attack and proceeded with patching the contract code. We then architected and executed the following plan: 1. Deployed the patched contract to a [new address](https://etherscan.io/address/0x0bb1810061c2f5b2088054ee184e6c79e1591101). 2. [Created a 0xDAO proposal](https://etherscan.io/tx/0x909bb88b8bfeadf0544687e124e5e5cbe39f244389da151e50aee12d01b6d4eb) to transfer the entire ZRX treasury to the new contract. This proved to be the very first 0x DAO proposal. 3. Notified [0x DAO bootstrap delegates](https://forum.0xprotocol.org/t/0x-dao-bootstrap-delegates/773) of the situation, getting their green light with regards to the plan and their commitment to vote in support of their proposal. 4. At that point, the primary risk consisted in having a malicious actor identify the vulnerability and inflating their voting power in order to block the migration. 5. Reached out to [Joey Zacharl](https://blog.0xproject.com/keeperdao-ama-on-discord-recap-3e004399e0d2), 0x DAO delegate and operator of the [VolleyFire Staking Pool](https://0x.org/zrx/staking/pool/23). With an abundance of caution, we asked him to leverage the exploit to inflate his pool’s voting power in order to neutralize the effect of any potential malicious actor could (VolleyFire is 0x DAO’s biggest delegate by voting power). 6. During the voting period, Joey [successfully leveraged the exploit](https://etherscan.io/tx/0xd471ff74ed1217da842a1304d2e5493fac4e84838b389c3c2fcffc319d2f7835). The proposal passed. 7. The proposal [was executed at Apr-27-2021 09:04:54 PM UTC](https://etherscan.io/tx/0x877def2cfdd17cb04de5a3ffe31b407058a44e9000e0b763fe56e3d7190baf1b), and the treasury successfully migrated to the patched contract. ![Screen Shot 2021-04-27 at 10.09.00 PM](https://canada1.discourse-cdn.com/flex027/uploads/x0xproject/original/1X/034ffb3fbd829049c959e2ad0f34652448e88d48.png) **What does this mean for ZRX holders and 0x DAO delegates?** The 2M ZRX treasury is safe in a new [contract](https://etherscan.io/address/0x0bb1810061c2f5b2088054ee184e6c79e1591101), and ZRX Portal was also updated to point at its new address. Everything about 0x DAO is therefore business-as-usual, with [all the functionalities described in the announcement unchanged.](https://blog.0xproject.com/0x-governance-roadmap-0x-dao-ac9218135d3) It was also an instructional time to **stress-test 0x DAO’s on-chain binding governance system**. Despite having identified a potentially critical vulnerability, there was no other way to proceed with a patch other than going through a governance vote. We thank all 0x DAO bootstrap delegates for their participation and leadership in the process. ### Rewarding samczsun with a bug bounty 0x Labs strongly believes in the benefits of open source development and rewards individuals that actively contribute to the security and reliability of 0x’s stack. In fact, we have an [ongoing bug bounty for all 0x’s smart contracts](https://protocol.0x.org/en/latest/additional/bounties.html). It is therefore with great pleasure and sense of gratitude that we want to award $50,000 to [samczsun](https://samczsun.com/) for discovering and graciously reporting the vulnerability. We thank him for his sense of commitment towards 0x and the DAO. ---
**Author:** ![cryptohydrate](https://yyz1.discourse-cdn.com/flex027/user_avatar/forum.0xprotocol.org/cryptohydrate/32/207_2.png) [@cryptohydrate](https://forum.0xprotocol.org/u/cryptohydrate)\ **Post date:** [May 4, 2021, 5:42pm UTC](https://forum.0xprotocol.org/t/post-mortem-zrx-treasury-patch/890/2 "2021-05-04T17:42:00Z")
Great catch! Well done team.