Marinade Finance Thwarts Malicious DAO Governance Attack on Solana

Marinade Finance, a prominent liquid staking protocol on the Solana blockchain, successfully defended its decentralized autonomous organization (DAO) against a sophisticated governance attack on September 25, 2024. An unidentified actor attempted to exploit a vulnerability in the voting mechanism to seize control of the treasury and alter the protocol's underlying code. Despite the attempt to manipulate voting power, the DAO committee intervened swiftly, ensuring that all user funds, including mSOL, Native Staking, and SAM services, remained entirely secure and unaffected.

Exploitation of MNDE Voting Mechanism

The incident began when the attacker identified a flaw in the DAO's voting logic that allowed a small quantity of MNDE tokens to be registered with disproportionately high voting weight. Leveraging this discrepancy, the malicious actor submitted two critical proposals: a forged "MIP-23" intended to replace the existing voting framework and a second motion designed to drain assets from the DAO treasury.

• The vulnerability allowed for artificial inflation of voting power.
• The attacker sought to bypass standard on-chain governance hurdles.
• The DAO committee acted within a 6-hour window to mitigate the threat.
• Total fund safety was maintained throughout the exploit attempt.

Protocol Response and Resolution

The defense was bolstered by the fact that the legitimate MNDE token holders maintained a cumulative voting power that exceeded the attacker’s inflated influence. The DAO committee finalized the rejection of both proposals approximately four days before they were eligible for execution, preventing any structural changes to the Solana-based protocol. Following the incident, Marinade Finance confirmed that the technical vulnerability within the voting mechanism has been patched to prevent similar governance manipulation in the future.

Governance attacks, often referred to as "governance 51% attacks", involve acquiring enough voting power to pass proposals that benefit the attacker, often at the expense of the protocol's liquidity and security.

The successful defense by Marinade Finance highlights the importance of active monitoring and multi-layered security in decentralized finance (DeFi) ecosystems. By neutralizing the threat within hours of its inception, the protocol demonstrated the resilience of its administrative structures. As of October 1, 2026, the platform continues to operate normally, with the development team emphasizing that no further risks to the staking infrastructure or treasury assets have been detected.