Contrato daosfun · Disclosed

Researcher claims critical vulnerability in daosfun contract on Solana mainnet

Oct 24, 2026 · 1 min read

Researcher @shawmakesmagic claims to have reverse engineered the daosfun contract from on-chain data and found a critical vulnerability in the program running on Solana mainnet. The claim includes no technical details, fix, or signs of exploitation. Protocol users should monitor official channels and use caution with new interactions with the contract.

By HIFY Radar newsroom Updated 10/26/2026 02:36 PM Get this every day →← Back to the feed 1 source

HighVulnerabilityDisclosedFix unconfirmed

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A researcher claims to have reverse engineered the daosfun contract from the Solana blockchain and found a critical vulnerability in the program running on mainnet. The claim was posted on social media with no technical details. No fix or signs of exploitation have been disclosed.

Why it matters

If the flaw is real, funds or operations tied to the mainnet contract could be at risk. The case also shows that contracts without public source code can be rebuilt by outsiders, widening exposure of hidden flaws.

What to do

Monitor the protocol's official channels. Treat new interactions with the daosfun contract with caution until an official statement or fix.

For the technical team

Affected: Contrato daosfun (programa Solana em produção na mainnet) · daosfun program deployed on Solana mainnet.
Exploitation: No exploitation reported in the sources. The vulnerability is a claim by researcher @shawmakesmagic, with no technical details.
Fix: No fix or mitigation disclosed in the sources.
Vector: daosfun program on Solana mainnet. Flaw type and exploitation conditions not disclosed. The researcher pulled the code from the program's on-chain bytes, with no public source code available.
More details: The researcher says he produced a byte-identical open source version of the contract and concludes any smart contract can be reverse engineered, ending security by obscurity. Disclosure was via tweet, with no CVE, version, or technical details.