$500 vs the 1inch DAO Treasury — Anatomy of a Live Governance Attack
On September 14, 2026, a fresh wallet with six transactions submitted two governance proposals against 1inch DAO's treasury Safe. One of the two can actually execute. This post breaks down exactly what happened, what can happen next, and what the on-chain parameters say about the timeline.
Every value in this post was read directly from Ethereum mainnet via eth_call or transaction receipt logs. No assumptions, no docs-only claims.
The attacker
Address: 0x6f25Cc4d6bD161e7F4514948AF1aE1B8bafF5AE1
Total lifetime transactions: 6. All on September 14, 2026.
Funding: 0.197702 ETH from 0x3f3e...0207b (ChangeNOW deposit address — anonymous instant exchange, no KYC) plus 0.0036 ETH from a second address. Total received: 0.2013 ETH. After posting two 0.1 ETH bonds and paying gas, the wallet holds 0.000913 ETH.
What 1inch uses
1inch DAO's treasury is a Gnosis Safe multisig at 0x7951c7ef839e26F63DA87a42C9a87986507f1c07 (7-of-12 threshold).
The Safe has a Zodiac RealityModuleETH enabled as a module. This module can execute transactions on the Safe without requiring multisig signatures — that is the entire point of SafeSnap governance. Proposals go through Reality.eth as an optimistic oracle: if no one disputes the answer within the timeout, the module can execute.
Two proposals, one live
The attacker submitted two proposals to two different RealityModuleETH contracts. Only one of them is actually connected to the treasury Safe.
Proposal 1 — "wave3-drain" (THE LIVE ONE)
Proposal 1 — "wave3-drain" (THE LIVE ONE)
| Field | Value |
|---|---|
| Module | 0xa62d2a75eb39c12e908e9f6bf50f189641692f2e |
| Module enabled on Safe | YES (verified via isModuleEnabled()) |
| proposalId | wave3-drain |
| questionId | 0x03b47cdd30ffa3f228f186bf7123ab6e73671c5b0c36bed8006eb84249e79f7d |
| txHashes | 5 batched operations |
| Submitted | Sep 14, 15:31:47 UTC |
| YES bond | 0.1 ETH at 15:34:23 UTC |
| Proposal TX | 0x4db430aa... |
| Bond TX | 0x47a4c2f6... |
This module is enabled on the treasury Safe. If the Reality.eth question finalizes as "YES" and the cooldown passes, executeProposal can run 5 transaction batches against the Safe.
The name "wave3-drain" is not subtle.
Proposal 2 — "wave5-accumulation-001" (CANNOT EXECUTE)
| Field | Value |
|---|---|
| Module | 0xa7456392eb978a756264d54968f55baf227fcbcf |
| Module enabled on Safe | NO (verified via isModuleEnabled()) |
| proposalId | wave5-accumulation-001 |
| questionId | 0xf84299c435bfe991936dfdfec377cc4e700a70b7fddd465385cbe832d786dae1 |
| txHashes | 1 batched operation |
| Submitted | Sep 14, 16:37:35 UTC |
| YES bond | 0.1 ETH at 16:37:59 UTC |
| Proposal TX | 0xeb8e7593... |
| Bond TX | 0xb3ecad6e... |
This module is not enabled on the treasury Safe. Even if the Reality question finalizes as "YES," executeProposal will revert because the Safe will reject the call. This proposal is either a decoy, a mistake, or aimed at a different Safe.
On-chain parameters (RealityModuleETH 0xa62d)
These values were read via eth_call against the live contract on Ethereum mainnet, cross-verified on two independent RPC endpoints.
| Parameter | Value | What it means |
|---|---|---|
questionTimeout |
259,200 seconds = 72 hours | Time for the Reality.eth answer to be challenged. Each dispute resets the clock. |
questionCooldown |
259,200 seconds = 72 hours | Delay after the answer finalizes before executeProposal is allowed. This is the veto window. |
answerExpiration |
604,800 seconds = 7 days | Finalized answers expire after 7 days. Execution must happen within this window. |
minimumBond |
100,000,000,000,000,000 wei = 0.1 ETH | Minimum bond to post an answer on Reality.eth. |
oracle |
0x5b7dD1E86623548AF054A4985F7fc8Ccbb554E2c |
RealityETH_v3_0 on Ethereum mainnet |
avatar |
0x7951c7ef839e26F63DA87a42C9a87986507f1c07 |
The treasury Safe this module controls |
Timeline (wave3-drain, undisputed scenario)
Sep 14, 15:34 UTC — Attacker posts YES bond (0.1 ETH)
72-hour question timeout starts
Sep 17, 15:34 UTC — If undisputed, Reality answer finalizes as YES
72-hour cooldown starts
Safe signers can veto during this window
Sep 20, 15:34 UTC — Cooldown ends, executeProposal becomes callable
5 transaction batches run against the treasury Safe
Sep 21, 15:34 UTC — Answer expires (7-day answerExpiration)
Execution no longer possible after this point
If someone posts a "NO" bond at any time during the question timeout, the clock resets. The escalation continues until one side stops bonding. The last answer standing after 72 hours of silence wins.
During the 72-hour cooldown, the 7-of-12 Safe signers can intervene — remove the module, move funds, or otherwise prevent execution.
The treasury
Safe: 0x7951c7ef839e26F63DA87a42C9a87986507f1c07
Verified holdings at time of writing (Etherscan):
| Asset | Amount | Value |
|---|---|---|
| Aave Ethereum USDC | 2,712,464 | ~$2.71M |
| ETH | 257.53 | ~$647K |
| WETH | 243.45 | ~$612K |
| 1INCH | 4,650,219 | ~$433K |
| WBTC | 1.92 | ~$150K |
| DAI | 128,520 | ~$129K |
| USDT | 81,984 | ~$82K |
| Other (67 tokens) | — | — |
| Total | ~$4.76M |
The 5 transaction hashes in wave3-drain are opaque — SafeSnap commits to the hash without revealing the operations until execution. What they target (token approvals, transfers, or something else) is not publicly visible.
The attack economics
| Item | Cost |
|---|---|
| ChangeNOW funding | 0.1977 ETH (~$497) |
| Second funding | 0.0036 ETH (~$9) |
| Gas (4 transactions) | |
| Total spent | ~$507 |
| Bonds (refundable if YES wins) | 0.2 ETH (~$502) |
| Non-refundable cost | ~$6 (gas + ChangeNOW fee) |
If wave3-drain passes unchallenged, the attacker spends $6 in gas to gain execution rights over ~$4.76M.
How to block wave3-drain right now
Post a "NO" bond on the Reality.eth question. The question ID is
0x03b47cdd30ffa3f228f186bf7123ab6e73671c5b0c36bed8006eb84249e79f7don RealityETH_v3_0 at0x5b7dD1E86623548AF054A4985F7fc8Ccbb554E2c(Ethereum mainnet). Minimum bond: 0.1 ETH. This resets the 72-hour clock.Safe signers: Even if the question finalizes, you have 72 hours of cooldown before execution is possible. During that window, you can remove the RealityModuleETH from the Safe or move assets.
Longer term: Raise the minimum bond. 0.1 ETH for a $4.76M treasury means the cost of an attack attempt is $6 in gas. Consider restricting who can call
addProposalor requiring a minimum token balance.
Pattern recognition
This is the same vulnerability class as Term Finance ($8.5M, August 2026), which I analyzed previously. Different mechanism — Term was token-weighted voting, 1inch is an optimistic oracle — but the same root cause: governance security that depends on human attention fails when nobody is paying attention.
Term Finance: $951 bought 90.66% of the vote. Nobody else voted. 1inch DAO: $6 in gas submitted a drain proposal. Nobody disputed it yet.
The wave numbering tells the story. Wave 1 through wave 4 were apparently blocked. Each time, someone noticed and disputed. The attacker keeps trying because the cost is near zero and they only need to succeed once.
The code is correct. The parameters are configured. The 72+72 hour design gives the signers time. The question is whether anyone is watching the clock.
On-chain references
Attacker: 0x6f25Cc4d6bD161e7F4514948AF1aE1B8bafF5AE1
Treasury Safe: 0x7951c7ef839e26F63DA87a42C9a87986507f1c07
RealityModule: 0xa62d2a75eb39c12e908e9f6bf50f189641692f2e (enabled)
RealityModule: 0xa7456392eb978a756264d54968f55baf227fcbcf (NOT enabled)
Reality Oracle: 0x5b7dD1E86623548AF054A4985F7fc8Ccbb554E2c (Ethereum)
wave3-drain questionId:
0x03b47cdd30ffa3f228f186bf7123ab6e73671c5b0c36bed8006eb84249e79f7d
wave5-accumulation-001 questionId:
0xf84299c435bfe991936dfdfec377cc4e700a70b7fddd465385cbe832d786dae1
Every value in this post was read from Ethereum mainnet via eth_call or transaction receipt parsing. No transactions were submitted.
