# $500 vs the 1inch DAO Treasury — Anatomy of a Live Governance Attack

On September 14, 2026, a fresh wallet with six transactions submitted two governance proposals against 1inch DAO's treasury Safe. One of the two can actually execute. This post breaks down exactly what happened, what can happen next, and what the on-chain parameters say about the timeline.  
Every value in this post was read directly from Ethereum mainnet via `eth_call` or transaction receipt logs. No assumptions, no docs-only claims.

The attacker  
Address: `0x6f25Cc4d6bD161e7F4514948AF1aE1B8bafF5AE1`  
Total lifetime transactions: 6. All on September 14, 2026.  
Funding: 0.197702 ETH from `0x3f3e...0207b` (ChangeNOW deposit address — anonymous instant exchange, no KYC) plus 0.0036 ETH from a second address. Total received: 0.2013 ETH. After posting two 0.1 ETH bonds and paying gas, the wallet holds 0.000913 ETH.

What 1inch uses  
1inch DAO's treasury is a Gnosis Safe multisig at `0x7951c7ef839e26F63DA87a42C9a87986507f1c07` (7-of-12 threshold).  
The Safe has a Zodiac RealityModuleETH enabled as a module. This module can execute transactions on the Safe without requiring multisig signatures — that is the entire point of SafeSnap governance. Proposals go through Reality.eth as an optimistic oracle: if no one disputes the answer within the timeout, the module can execute.

Two proposals, one live  
The attacker submitted two proposals to two different RealityModuleETH contracts. Only one of them is actually connected to the treasury Safe.  
Proposal 1 — "wave3-drain" (THE LIVE ONE)

### Proposal 1 — "wave3-drain" (THE LIVE ONE)

| Field | Value |
| --- | --- |
| Module | [`0xa62d2a75eb39c12e908e9f6bf50f189641692f2e`](https://etherscan.io/address/0xa62d2a75eb39c12e908e9f6bf50f189641692f2e) |
| Module enabled on Safe | **YES** (verified via `isModuleEnabled()`) |
| proposalId | `wave3-drain` |
| questionId | `0x03b47cdd30ffa3f228f186bf7123ab6e73671c5b0c36bed8006eb84249e79f7d` |
| txHashes | 5 batched operations |
| Submitted | Sep 14, 15:31:47 UTC |
| YES bond | 0.1 ETH at 15:34:23 UTC |
| Proposal TX | [`0x4db430aa...`](https://etherscan.io/tx/0x4db430aa9f5679fa3514f5e957157257156e95637a973fd56cbd2c4fd46d2f8e) |
| Bond TX | [`0x47a4c2f6...`](https://etherscan.io/tx/0x47a4c2f6c989793aea3fba8e260368b24a984ef469ecdd8a494ced86d8561145) |

This module is enabled on the treasury Safe. If the Reality.eth question finalizes as "YES" and the cooldown passes, `executeProposal` can run 5 transaction batches against the Safe.

The name "wave3-drain" is not subtle.

### Proposal 2 — "wave5-accumulation-001" (CANNOT EXECUTE)

| Field | Value |
| --- | --- |
| Module | [`0xa7456392eb978a756264d54968f55baf227fcbcf`](https://etherscan.io/address/0xa7456392eb978a756264d54968f55baf227fcbcf) |
| Module enabled on Safe | **NO** (verified via `isModuleEnabled()`) |
| proposalId | `wave5-accumulation-001` |
| questionId | `0xf84299c435bfe991936dfdfec377cc4e700a70b7fddd465385cbe832d786dae1` |
| txHashes | 1 batched operation |
| Submitted | Sep 14, 16:37:35 UTC |
| YES bond | 0.1 ETH at 16:37:59 UTC |
| Proposal TX | [`0xeb8e7593...`](https://etherscan.io/tx/0xeb8e7593be0a29610a0df44270977241bfe182f06522ff8a33d5e04a8912b699) |
| Bond TX | [`0xb3ecad6e...`](https://etherscan.io/tx/0xb3ecad6ea2a4de1bd697082134a0cfb5efb154b8522281290aa5a68464549dfc) |

This module is **not enabled** on the treasury Safe. Even if the Reality question finalizes as "YES," `executeProposal` will revert because the Safe will reject the call. This proposal is either a decoy, a mistake, or aimed at a different Safe.

* * *

## On-chain parameters (RealityModuleETH 0xa62d)

These values were read via `eth_call` against the live contract on Ethereum mainnet, cross-verified on two independent RPC endpoints.

| Parameter | Value | What it means |
| --- | --- | --- |
| `questionTimeout` | 259,200 seconds = **72 hours** | Time for the Reality.eth answer to be challenged. Each dispute resets the clock. |
| `questionCooldown` | 259,200 seconds = **72 hours** | Delay after the answer finalizes before `executeProposal` is allowed. This is the veto window. |
| `answerExpiration` | 604,800 seconds = **7 days** | Finalized answers expire after 7 days. Execution must happen within this window. |
| `minimumBond` | 100,000,000,000,000,000 wei = **0.1 ETH** | Minimum bond to post an answer on Reality.eth. |
| `oracle` | `0x5b7dD1E86623548AF054A4985F7fc8Ccbb554E2c` | RealityETH\_v3\_0 on Ethereum mainnet |
| `avatar` | `0x7951c7ef839e26F63DA87a42C9a87986507f1c07` | The treasury Safe this module controls |

* * *

## Timeline (wave3-drain, undisputed scenario)

```plaintext
Sep 14, 15:34 UTC — Attacker posts YES bond (0.1 ETH)
                     72-hour question timeout starts

Sep 17, 15:34 UTC — If undisputed, Reality answer finalizes as YES
                     72-hour cooldown starts
                     Safe signers can veto during this window

Sep 20, 15:34 UTC — Cooldown ends, executeProposal becomes callable
                     5 transaction batches run against the treasury Safe

Sep 21, 15:34 UTC — Answer expires (7-day answerExpiration)
                     Execution no longer possible after this point
```

If someone posts a "NO" bond at any time during the question timeout, the clock resets. The escalation continues until one side stops bonding. The last answer standing after 72 hours of silence wins.

During the 72-hour cooldown, the 7-of-12 Safe signers can intervene — remove the module, move funds, or otherwise prevent execution.

* * *

## The treasury

Safe: [`0x7951c7ef839e26F63DA87a42C9a87986507f1c07`](https://etherscan.io/address/0x7951c7ef839e26F63DA87a42C9a87986507f1c07)

Verified holdings at time of writing (Etherscan):

| Asset | Amount | Value |
| --- | --- | --- |
| Aave Ethereum USDC | 2,712,464 | ~$2.71M |
| ETH | 257.53 | ~$647K |
| WETH | 243.45 | ~$612K |
| 1INCH | 4,650,219 | ~$433K |
| WBTC | 1.92 | ~$150K |
| DAI | 128,520 | ~$129K |
| USDT | 81,984 | ~$82K |
| Other (67 tokens) | — | — |
| **Total** |  | **~$4.76M** |

The 5 transaction hashes in wave3-drain are opaque — SafeSnap commits to the hash without revealing the operations until execution. What they target (token approvals, transfers, or something else) is not publicly visible.

* * *

## The attack economics

| Item | Cost |
| --- | --- |
| ChangeNOW funding | 0.1977 ETH (~$497) |
| Second funding | 0.0036 ETH (~$9) |
| Gas (4 transactions) | ~0.0003 ETH (~$0.75) |
| **Total spent** | **~$507** |
| Bonds (refundable if YES wins) | 0.2 ETH (~$502) |
| **Non-refundable cost** | **~$6** (gas + ChangeNOW fee) |

If wave3-drain passes unchallenged, the attacker spends $6 in gas to gain execution rights over ~$4.76M.

* * *

## How to block wave3-drain right now

1.  **Post a "NO" bond** on the Reality.eth question. The question ID is `0x03b47cdd30ffa3f228f186bf7123ab6e73671c5b0c36bed8006eb84249e79f7d` on RealityETH\_v3\_0 at [`0x5b7dD1E86623548AF054A4985F7fc8Ccbb554E2c`](https://etherscan.io/address/0x5b7dD1E86623548AF054A4985F7fc8Ccbb554E2c) (Ethereum mainnet). Minimum bond: 0.1 ETH. This resets the 72-hour clock.
    
2.  **Safe signers:** Even if the question finalizes, you have 72 hours of cooldown before execution is possible. During that window, you can remove the RealityModuleETH from the Safe or move assets.
    
3.  **Longer term:** Raise the minimum bond. 0.1 ETH for a $4.76M treasury means the cost of an attack attempt is $6 in gas. Consider restricting who can call `addProposal` or requiring a minimum token balance.
    

* * *

## Pattern recognition

This is the same vulnerability class as Term Finance ($8.5M, August 2026), which I analyzed [previously](https://mehvetero.com/term-finance-governance-exploit). Different mechanism — Term was token-weighted voting, 1inch is an optimistic oracle — but the same root cause: governance security that depends on human attention fails when nobody is paying attention.

Term Finance: $951 bought 90.66% of the vote. Nobody else voted. 1inch DAO: $6 in gas submitted a drain proposal. Nobody disputed it yet.

The wave numbering tells the story. Wave 1 through wave 4 were apparently blocked. Each time, someone noticed and disputed. The attacker keeps trying because the cost is near zero and they only need to succeed once.

The code is correct. The parameters are configured. The 72+72 hour design gives the signers time. The question is whether anyone is watching the clock.

* * *

## On-chain references

```plaintext
Attacker:      0x6f25Cc4d6bD161e7F4514948AF1aE1B8bafF5AE1
Treasury Safe: 0x7951c7ef839e26F63DA87a42C9a87986507f1c07
RealityModule: 0xa62d2a75eb39c12e908e9f6bf50f189641692f2e (enabled)
RealityModule: 0xa7456392eb978a756264d54968f55baf227fcbcf (NOT enabled)
Reality Oracle: 0x5b7dD1E86623548AF054A4985F7fc8Ccbb554E2c (Ethereum)

wave3-drain questionId:
0x03b47cdd30ffa3f228f186bf7123ab6e73671c5b0c36bed8006eb84249e79f7d

wave5-accumulation-001 questionId:
0xf84299c435bfe991936dfdfec377cc4e700a70b7fddd465385cbe832d786dae1
```

*Every value in this post was read from Ethereum mainnet via eth\_call or transaction receipt parsing. No transactions were submitted.*