<story><title>DeFi protocol BadgerDAO exploited for $120M in front-end attack</title><url>https://www.theblockcrypto.com/post/126072/defi-protocol-badgerdao-exploited-for-120-million-in-front-end-attack</url></story><parent_chain><item><author>deweller</author><text>It is important to note that this was not a smart contract exploit.  The point of failure here was the website UI.  Users were sent to a malicious website due to a stolen Cloudflare API key.&lt;p&gt;What can DAOs do to prevent the single point of failure that is the web front end?  Is there a reliable second level of security to ensure you are at the site you intended?  The SSL certificate didn&amp;#x27;t work because Cloudflare was still terminating the SSL connection.</text></item></parent_chain><comment><author>Stevvo</author><text>DAOs nearly always have their front-end in a public repository so you can run it locally, but this is also convenient for the Cloudfare hijacker.&lt;p&gt;One defence is ENS. If your DAO&amp;#x27;s contract is registered for example as &amp;quot;BadgerDAO.eth&amp;quot;, and your users wallet software shows that every time they make a transaction then it will be a red flag when the contract has been swapped out in the compromised front-end.&lt;p&gt;Unfortunately many wallets don&amp;#x27;t support ENS, and in those that do the experience could be better. So better wallets are part of the solution.</text></comment>
<story><title>DeFi protocol BadgerDAO exploited for $120M in front-end attack</title><url>https://www.theblockcrypto.com/post/126072/defi-protocol-badgerdao-exploited-for-120-million-in-front-end-attack</url></story><parent_chain><item><author>deweller</author><text>It is important to note that this was not a smart contract exploit.  The point of failure here was the website UI.  Users were sent to a malicious website due to a stolen Cloudflare API key.&lt;p&gt;What can DAOs do to prevent the single point of failure that is the web front end?  Is there a reliable second level of security to ensure you are at the site you intended?  The SSL certificate didn&amp;#x27;t work because Cloudflare was still terminating the SSL connection.</text></item></parent_chain><comment><author>root_axis</author><text>&amp;gt; &lt;i&gt;It is important to note that this was not a smart contract exploit.&lt;/i&gt;&lt;p&gt;I disagree that this is an important detail. Even though the smart contract code wasn&amp;#x27;t exploited directly (this time), this type of massive theft is only possible because the smart contract ecosystem thrives on a lack of accountability.</text></comment>