Dear Community Members, Especially the Participants of This Proposal:
On behalf of the DAO Funds Management Committee, I am releasing the following investigation and arbitration results regarding the voting outcome of this proposal.
I. Background
After the proposal voting concluded, the community received multiple complaints about the fairness of the voting process. Public discussions can be found in this thread: https://talk.nervos.org/t/community-fund-dao-v1-1-web5-recommendation-for-a-revote-on-the-community-fund-dao-v1-1-web5-optimization-proposal/9655/1 In addition, several members raised similar concerns through private channels.
The main focus of the complaints was: The last five digits of the voting weights for accounts BroAllen and Mod were identical, raising suspicions that the same NervosDAO address was reused for voting.
Upon receiving the complaints, the DAO Funds Management Committee deemed these suspicions reasonable and worthy of investigation. Although there was no direct evidence at the time, the clues were sufficient to initiate an investigation. We promptly launched a formal investigation procedure, with a duration of one week.
II. Investigation and Conclusion Summary (TL;DR)
Before the deadline, we obtained direct and verifiable evidence. The following are the main conclusions of the investigation and arbitration:
-
Bug Discovery We confirmed a vulnerability in Metaforo when calculating voting weights based on NervosDAO deposits: After binding a NervosDAO address to vote, users could unbind it and re-bind it to another account to vote repeatedly.
-
Vulnerability Exploited The investigation confirmed that this vulnerability was exploited in this vote. The duplicated addresses involved are:
ckb1qzda0cr08m85hc8jlnfp3zer7xulejywt49kt2rr0vthywaa50xwsq22vda73jzdlu3lf6luskzcjz7z5ksa58stp95p5 ckb1qzda0cr08m85hc8jlnfp3zer7xulejywt49kt2rr0vthywaa50xwsqwpcdzq3q7klvy9esgjlsy9vrapke97kgsqmwwrpTotal duplicated weight: 71,247,257 This weight was used for opposing votes.
-
No Other Anomalies Found No additional duplicate voting behavior was identified beyond the two addresses above.
-
Arbitration Decision: Correct the Voting Results Therefore, the Committee decided to remove the duplicated 71,247,257 weight and recalculate the results:
-
For: 343,524,829
-
Against (corrected): 184,348,409 - 71,247,257 = 113,101,152
-
New Ratio: 343,524,829 / (343,524,829 + 113,101,152) = 75.23%
Corrected Voting Result: The proposal passes with 75.2% in favor. -
III. Investigation Process Details
-
The investigation was more complex than anticipated. The reason was that Metaforo’s backend did not retain complete request logs, and the database did not record bind/unbind state changes.
-
We ultimately locked in evidence of duplicate voting by combining Metaforo frontend implementation details with CKB Explorer backend logs.
-
During the investigation, we unexpectedly contacted MOD (BroAllen) in person. He/she admitted to exploiting the vulnerability for repeated voting and provided some operational details and motives. For privacy reasons, personal information is not disclosed in this document. He/she stated they would respond personally to the incident after the arbitration results are announced.
IV. Acknowledgments
The investigation and final report were made possible with the assistance and support of the following teams and individuals:
-
App5 Team (CKB Explorer Team)
-
Metaforo Team
-
Community Member Yixiu
V. Investigation Report and Log Materials
Metaforo Voting Weight Retrieval Logic
-
When binding an address, it queries:
-
Whether the address has already been bound (internally on the Metaforo platform)
-
Whether there are NervosDAO Cells in “deposited” state under the address (obtained via the browser’s /api/v2/dao_events interface), and retrieves the capacity to determine if > 0
-
-
During voting, it:
-
Queries how many NervosDAO addresses are bound to the user
-
Sequentially requests the “deposited” NervosDAO Cells under these addresses (via the browser’s /api/v2/dao_events interface) and retrieves the capacity (weight)
-
Accumulates the weights of each address to obtain the user’s total voting weight
-
The weight retrieval code is as follows:
User “Mod” Voting Record Tracking
On Metaforo, Mod completed voting at 2025-10-28 08:18:27 (UTC+0):
On the CKB Explorer interface server, three addresses sequentially requested the /api/v2/dao_events interface during the same time period:
Table 1
The data in the image is grouped in pairs, recording the request entry, data return time (UTC+8), and requested address. The logs above show Metaforo’s backend requesting weights for the three CKB addresses currently bound to the account during voting. Combined with CKB Explorer data, the three addresses and their weights are:
Considering that Metaforo ignores weights after the decimal point, this cumulative weight matches “Mod”’s weight in the Metaforo proposal voting results. Further, we captured request records between Oct 28, 2025 @ 16:00:00.000 - Oct 28, 2025 @ 17:00:00.000 (detailed logs in Attachment 2):
Table 2 – Logs Before and After Mod’s Vote
Only requests related to the above three addresses were found. Since all Metaforo votes pass through this request, the possibility of other addresses participating in voting during this period can be ruled out.
–-
User “BroAllen” Voting Record Tracking
On Metaforo, BroAllen completed voting at 2025-11-03 19:44:05 (UTC+0):
Similarly, we captured CKB Explorer backend interface service logs and observed two addresses sequentially requesting the /api/v2/dao_events interface during this period (as marked in red in the image), consistent with Metaforo’s voting request behavior:
Table 3
Information for these two addresses is as follows:
Considering Metaforo ignores weights after the decimal point, this cumulative weight matches “BroAllen”’s weight in the Metaforo proposal voting results. Further, we captured request records between Nov 4, 2025 @ 03:00:00.000 → Nov 4, 2025 @ 04:00:00.000 (detailed logs in Attachment 3):
Table 4 – Logs Before and After BroAllen’s Vote
Only requests related to the two addresses above were found. Since all Metaforo votes pass through this request, the possibility of other addresses participating in voting during this period can be ruled out—meaning only BroAllen voted on Metaforo during this phase.
Analysis
By tracking the voting records and request logs of “Mod” and “BroAllen,” we found that the two accounts shared the following addresses for voting during the voting period:
-
ckb1qzda0cr08m85hc8jlnfp3zer7xulejywt49kt2rr0vthywaa50xwsq22vda73jzdlu3lf6luskzcjz7z5ksa58stp95p5
-
ckb1qzda0cr08m85hc8jlnfp3zer7xulejywt49kt2rr0vthywaa50xwsqwpcdzq3q7klvy9esgjlsy9vrapke97kgsqmwwrp
Cumulative weight: 71,247,257.
Appendices (Related Log Files):
-
https://dao.ckb.community/thread/64083 Request logs for the two addresses during the proposal voting period: log1, log2
-
Request logs before and after “Mod”’s vote: log3
-
Request logs before and after “BroAllen”’s vote: log4
-
All request logs during the proposal voting period (community members can refer to the above method for verification): log5