🚨 rarible.com (RARI Foundation DAO) - Attempted governance takeover (2026-09-20)

Token: $RARI @ $0.1066
Network: Ethereum

Type: Access Control (malicious governance proposal / DAO takeover)

Attacker "Falcon" (0x94223fcC…F04Ca, ~132.5K veRARI votes, above the 5,000 proposalThreshold) submitted proposal 3648869205…835338 to RariGovernor (0x859e1c00…2edca). The single action calls the DAO's delegatecall-executor 0xb23BCD4F…C5b5 with execute(0x36224b869…a722, write(slot,1)). Contract 0x36224 is a 4-line backdoor whose only function e2e52ec1 (write(uint256,uint256)) does a raw SSTORE; invoked via the executor's DELEGATECALL it writes 1 into an AccessControl role slot of the executor — granting Falcon a privileged role and full control of the DAO. The proposal text openly states YES "grants full control of the DAO to the activist investor group Falcon." No funds moved yet (vote open); execution would hand the DAO/treasury to the proposer.

TX: https://etherscan.io/tx/0xeaef75813cd1d89d681669b687d838a0e3e16b1cd4292c566e411697759763fa
Attacker: https://etherscan.io/address/0x94223fcC4705CF0EBcE95d79072616A2A74F04Ca
Victim: https://etherscan.io/address/0x859e1c00ed6d4b4e649c7a38918e982653b2edca
X: https://x.com/rarible

@defimon_subscription_bot