Developer Reconstructs Daos.fun Code and Claims Security Flaw
Shaw releases rebuilt Daos.fun program
On October 24, a developer known as Shaw published a reconstruction of the closed-source code for daos.fun, a Solana-based platform for launching investment funds. Shaw claims this rebuild is byte-identical to the original program and identified a critical vulnerability in the mainnet code.
The project is hosted in a public GitHub repository that includes the reconstructed Rust source code and a captured program binary. Shaw's automated build tests report that the rebuilt file matches the captured executable with identical SHA-256 hashes, confirming the code produces the same output.
Technical details of the reconstruction
- The repository contains a security review of the captured executable file.
- The audit notes that local tests do not prove a real-world attack has occurred, leaving the number of affected users unconfirmed.
- The reconstruction is not the original author's source text, as historical comments and specific naming identifiers cannot be fully recovered from a binary file.
- The repository intentionally retains the reported vulnerabilities and does not provide a deployed fix for them.
Platform status and community reaction
Daos.fun previously allowed communities to pool Solana (SOL) coins into funds and launch tradable tokens. The platform's website currently states it is no longer maintained and does not support the creation of new DAOs or tokens. Existing bonding curves and token pools are hosted on Meteora, a liquidity protocol on Solana, and remain tradable through compatible clients.
Despite the platform's shutdown, the program on the Solana blockchain is listed as upgradeable, meaning the code can technically still be changed. Solana co-founder Anatoly Yakovenko amplified Shaw's findings on X, stating that there is no longer such thing as security by obscurity. However, Yakovenko did not provide independent verification of the specific vulnerability claims.
What is confirmed
- The developer successfully rebuilt the Daos.fun source code to match the deployed binary.
- The daos.fun website confirms the platform is no longer maintained.
- The security review identifies a potential flaw in the captured code.
What remains unclear
- It is unconfirmed whether any live user positions were actually exploited by the identified vulnerability.
- It is not established from public materials whether the Daos.fun team received a private disclosure of the flaw before the public release.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.
Related Posts
