DCDAO Marketing Budget Safety Discussion

[Cindy884]

Background

I wanted to send the Galex Campaign rewards last week but found an 18W Ring stolen after checking my Metamask wallet. After that, I asked Nada and Echo for help.

This experience had to be tracked on the first time my wallet leaked.

I was trying to find support from the Galex team in Discord and there was a guy who DMed me and told me he was the official staff and sent me a website to input my private password in this website.

When I realized this guy was a liar, I found some of my token was empty. (Sorry I was very angry so I deleted that guy’s chat history.)

But then why was the new wallet stolen? I recalled carefully that it was most likely because I was clicking on that scammer's website on Discord when I accidentally connected to my new wallet address and entered my private key.

My old wallet address:0xc2B59Ecd40b8B54Bc23Bc395EefA0DEC3CCC6c5F(stolen)

My new wallet address: 0xf11D5D94d41ffd0339104A74d3E33f808A27c54E(stolen)

Review

1. Don't click on links that strangers send you on Discord or telegram!
2. Create your new wallet in a new device or google account.
3. Others. (welcome to leave your idea in the comments area.)

Solution

1. Create a new meta mask wallet in this way: https://support.metamask.io/hc/en-us/articles/360052511372-I-ve-been-hacked-scammed-unauthorized-transactions-on-my-account-
2. Create a multi-sig wallet in gnosis safe wallet.
   Here is the new multi-sig address (DCDAO Marketing Fund）
   Eth:0x7AC72B45E72dAa1CA2a26FB543E7B096570d1BCd
3. Put the Darwinia marketing budget in this multi-sig wallet and set related procedures to make sure the fund is safe.
   As the Q3 budget was gone, I will apply this fund again in the snapshot.

[1022ranji]

3. Put the Darwinia Treasury in this multi-sig wallet and set related procedures to make sure the fund is safe.

The third point raised regarding the "Solution" appears to be ambiguous. The DCDAO Treasury itself is managed through multisig accounts, which can be viewed at https://snapshot.org/#/darwiniacommunitydao.eth/proposal/0x045f364dcbc7c1d41d51d78fe85473e4a5aa49018aecc2b3bee0d97496d04921.

@Cindy884 In your text, when you mention "Darwinia Treasury," it should actually refer to the active marketing budget account. As per the proposal at https://snapshot.org/#/darwiniacommunitydao.eth/proposal/0x89fd47338ba6cd4fff1a4200d9e0339c20e43539cc311d2400cf032eca58aa34, this account was previously managed by the stolen account(0xf11D5D94d41ffd0339104A74d3E33f808A27c54E), with a quarterly allocation of 180,000 RING. I kindly request that you rectify this name to avoid any misunderstandings.

[Cindy884]

Thks for your reaching out. Re-edited.

[1022ranji]

Furthermore, adopting the multisig approach necessitates clear disclosure of the individuals involved in the multi-signature process and the roles they fulfill within it. For reference, please consult the following link: https://snapshot.org/#/darwiniacommunitydao.eth/proposal/0x045f364dcbc7c1d41d51d78fe85473e4a5aa49018aecc2b3bee0d97496d0492.

[1022ranji]

The quarterly activity budget was disbursed on July 28th, covering the months of August, September, and October. As per the planned schedule, the next round of funding is scheduled for the end of October, encompassing November, December, and January 2024.

Clearly, this schedule would leave the DCDAO lacking sufficient funds for activities in September and October. In light of this situation, it is hoped that @Cindy884 can propose a solution during this discussion.

[SasoLithops]

Hi!

@Cindy884 I would recomend to never connect with this valuable community account to any site other then Darwinia related.

To keep it transparent if you want to deal with other sites ask team first or any of us in TG chat first. We have all been scamed and had done many research on security. But as said if I had to deal with community funds, only send and receive would be my advice.

And another word of advice ALWAYS delete sites in your private wallet that have access to your wallet funds.

[SasoLithops]

And you are absolutely right:

• Never trust anyone DM you pretending to help

• If one does sound legit still always check him if he is active in chats and ask him there if he DM you(but am sure it was scammer)

• Never give any personal information(OTP, seed phrase, passwords, ID information...)

• Best to always check admin tag and tag active admin in chat and DM him and before hand inform her/him in chat you will DM them.

• Never click on any links from strangers

I am really sorry this thing happened to you.But you are not alone. I lost three times more when I got scammed. Was really upset but money gone, nothing I could do... I honestly don't know anyone that hasn't been scamed in crypto... That is why crypto has so many enemies....wild west if you active...Some regulations are needed before this goes mainstream or industry will crumble in dust.

[hackfisher]

https://snapshot.org/#/darwiniacommunitydao.eth/proposal/0x95793bc8a68392481c26c4d4e649fb1fc19b070696a83a80ac862cefa6bcee1b

[Cindy884]

DCDAO Marketing Fund Multi-sig Wallet Address Update
Background
I wanted to send the Galex Campaign rewards last week but found an 18W Ring stolen after checking my Metamask wallet. After that, I asked Nada and Echo for help.

This experience had to be tracked on the first time my wallet leaked.

I was trying to find support from the Galex team in Discord and there was a guy who DMed me and told me he was the official staff and sent me a website to input my private password in this website.

When I realized this guy was a liar, I found some of my token was empty. (Sorry I was very angry so I deleted that guy’s chat history.)

But then why was the new wallet stolen? I recalled carefully that it was most likely because I was clicking on that scammer's website on Discord when I accidentally connected to my new wallet address and entered my private key.
My old wallet address:0xc2B59Ecd40b8B54Bc23Bc395EefA0DEC3CCC6c5F(stolen)
My new wallet address: 0xf11D5D94d41ffd0339104A74d3E33f808A27c54E(stolen)
Here is the discussion: https://github.com/orgs/dcdao/discussions/39

Solution
To ensure the campaign continues successfully, I would like to apply for the Q3 Marketing again and create multi-sig wallets to ensure the fund is safe.
Here are more details.

Budget details
Budget: 180,000 Ring for Q3
DCDAO Marketing Multi-sig Address:
ETH:0x7AC72B45E72dAa1CA2a26FB543E7B096570d1BCd
Polygon:0xbaCd8aBCf84a1ED6B4daB676489f420163e3625b
Multi-sig wallet members' address:

ETH Multi-sig wallet members
0x0f9B66CB13f9f429C352005AB2b1255e2Dbe4Ab8(Cindy)
0x1144b859947Fa80314e8D6bd6766f6e67201662a(Laki）

Polygon Multi-sig wallet members
0x0f9B66CB13f9f429C352005AB2b1255e2Dbe4Ab8(Cindy)
0x1144b859947Fa80314e8D6bd6766f6e67201662a(Laki）
0x048C592C8FDcCE21ff6AF18365D37208a9954f95(David)

[SasoLithops]

Please Cindy create extra account with funds only for fees and connect with it to sites if you must. NEVER enter your private keys! And remember most of people DM you are scammers,so be cautious. Especialy now we let then know to DM you.

I found this in one chat from a person I trust. Hope it helps.

NEVER, under any circumstances, write your seed phase online or on any device. The only scenario where you would need to write it is on your browser extension wallet in case you are NOT using a hardware (e.g. ledger, trezos...), and even this is dumb if you manage a considerable amount of funds. If you have a ledger your seed phrase should never be on any device.
ALWAYS download your browser extension wallets from official sources.

FAQ:

• Is connecting my wallet to any site safe?
  Yes, connecting your wallet doesn't sign any transactions, you are just allowing the site to have access to your public key, which, as the name indicates, is already public. Connecting your wallet can NEVER be harmful because you are not even interacting with the blockchain. It shouldn't even be called "connecting" in the first place.

• A site is asking for my seed phrase when connecting my wallet. Is this a scam?
  Yes, as you can read above, you should NEVER share your seed phrase, if you do it you will lose your funds. This site is probably a fake and instead of "connecting" it's just doing something else.

• Can executing a Smart Contract drain my wallet?
  NO, executing a Smart Contract can not drain your wallet. A smart contract doesn't have access to your funds unless you:

1. Are sending the funds to the contract in the first place
2. Granted Authz permissions to the contract in the past (which is not done with a smart contract interaction).
3. Granted CW20 authorization to a contract (this only applies for CW20, which follow the same pattern as tokens in ethereum).
   So NO, executing a smart contract by itself can not drain your funds because it doesn't have access to them in the first place.

• How can my funds be in danger?
  If you follow the basic rule of never sharing your seed phrase your funds should never be in danger unless you do something very stupid, therefore it comes to one basic rule: READ WHAT YOU SIGN.

1. If a transaction is asking you to send your tokens somewhere, well obviously you are going to lose access to those funds because you are sending them somewhere (either a contract or a regular address), no need to be a genius to see this. Some transactions require you to send funds (e.g. adding funds to a liquidity pool, performing a trade ...). As long as what you are doing makes sense it shouldn't put your funds in danger.
2. AUTHZ TRANSACTIONS: These are probably the most tricky ones, but don't worry, they are not that hard to understand and wallets nowadays warn you when you are about to do something stupid:

In summary, authz transactions are used to grant rights to other people to act in your behalf. If you sign a transactions allowing Address X to undelegate tokens in your behalf, well, that address can do this for you. If you sign a transaction allowing address X to send your tokens, well obviously, the moment you sign this the scammer (if he has half a brain and knows what he's doing) will instantly send your tokens to his wallet. SO, when your wallet is asking you to sign an Authz transaction, read it 3-4 times to make sure that what you are doing is not something stupid.
If you've been baited into signing an authz transaction and the scammer is as dumb as you and doesn't have things automatized, you might be able to revoke it in time, but just don't get to this point in the first place because there might not be a UI handy to revoke it. Understanding these 2 basic concepts (sending funds attached to your transaction and grant authorizations) is all you need to know to avoid losing money.

• But ser, I've visited this scam site and I'm scared, are my funds in danger?
  Again, if you didn't sign any transactions, you didn't interact with the blockchain and that's where your assets are in the first place, so no, your funds should not be in danger.