Malicious governance proposal on HAI Protocol disguises treasury voting power delegation to attacker as routine maintenance, risking 34% voting control and $1.58M protocol assets.
Security & Exploits ·
A governance proposal on HAI Protocol masks a voting-power seizure as routine maintenance. An attacker-controlled address submitted proposal 9453 on HaiGovernor labeled "Quarterly Treasury Maintenance," bundling six Safe actions. Five are legitimate: token approvals and small KITE/OP transfers. The sixth—buried in calldata as a delegate function—would redirect the DAO Treasury's 328,143 KITE (34% of total supply) to the proposer's own address, granting unilateral governance control.
The exploit's mechanics rely on a description-calldata mismatch. While the proposal narrative frames the sixth action as activating standard self-delegation, the actual bytecode executes delegate(0xCc7B…2E0E), routing voting power to the attacker rather than the Treasury itself. The 328,143 KITE would exceed the 1% quorum (9,739 KITE) by a factor of 34, enabling the proposer to unilaterally pass or block any subsequent governance decision over approximately $1.58M in protocol assets.
The proposal has begun voting and no funds have moved as of the report date. Whether the treasury multi-signature holders, community watchers, or other governance participants will intervene before the voting window closes remains unclear.