PeopleDAO's Crypto Payroll Hacked for 76.5 ETH | Prevention Tips

How PeopleDAO lost 76.5 ETH earmarked for payroll

PeopleDAO, a group formed to buy a copy of the U.S. Constitution had their Community Treasury on Gnosis Safe, drained of 76.5 ETH ($120,000) to a hack in March 2023. The hack targeted the DAO’s monthly contributor payout form on Google Sheets.

The DAO collects monthly contributor reward information via Google Sheets, which was mistakenly shared with edit access in a public Discord channel. The hacker gained edit access to the spreadsheet via the link.

‍

‍

After gaining the access, the hacker inserted a 76 ETH payment to himself in the sheet. To cover his tracks, the hacker set the row to be invisible (the missing 80th row below).

Because the malicious data injected into the spreadsheet was hidden, neither the team leads, nor the DAO’s multi-sig wallet signers were able to spot the corrupted data. 

‍

‍

The corrupted .csv file was downloaded from Google Sheets, and uploaded to their DAO’s Gnosis Safe walletvia the CSV Airdrop tool to disburse the crypto payouts.

Given the long list of wallet addresses to be paid, 6 out of 9 multisig signers did not notice the malicious transfer, signed and executed the transaction, sending 76 ETH to the hacker's address.

Look at the image below - would you have been able to spot the erroneous entry in time?

‍

How to securely automate crypto payroll 

Processing payments like crypto payroll using spreadsheets creates an attack vector that allows malicious actors to inject themselves as beneficiaries. As the PeopleDAO hack showed - this can have devastating consequences for crypto treasuries.

But with the right tools like Request Finance, DAO treasury managers  and Web3 CFOs can securely automate their crypto payroll processing.

For starters, in Request Finance’s crypto payroll application, all employees’ billing information like names, roles, and wallet addresses are uploaded by an admin manager. This cannot be changed by other team members, or external parties whose roles do not grant them edit access.

‍

Additionally, beneficiaries wallet addresses are stored in a contact database, and correlated to names, and email addresses. This makes it easy to identify duplicate entries, or non-existent team members. It would have been difficult to inject a bare wallet address, and if it were done, the anomaly would be spotted easily.

‍

‍

Also in the app, finance and operations teams must review and click the “approve” button for each payout claim - a crypto payroll, expense, or invoice. Only “approved” payment requests can be paid.

This enforces the practice of having teams to review each and every single claim item.

‍

‍

All approved payout claims are displayed in a human readable format. This makes it easy to review prior to being sent to a wallet for signing.

These are just some features in Request Finance that are designed to prevent phishing attacks that can compromise Web3 companies, and DAOs crypto payroll processes.

Concluding thoughts

When people talk about security in decentralized finance (DeFi), the spotlight is typically on more sophisticated attack vectors. These include smart contract vulnerabilities, corrupted oracles, bridges, or blockchain network security. 

But sometimes the simplest attack vectors can also be equally devastating. 

We’ve covered how even large companies like Amazon and Google have lost hundreds of millions of dollars to fake invoices - and how Request Finance helps prevent crypto invoice fraud. 

The PeopleDAO hack highlights how the common practice of using Excel spreadsheets, or Google Sheets to manage crypto payroll is a critical vulnerability for DAOs, and companies that pay their employees, contractors, and contributors in crypto.

‍

‍

However, with tools like Request Finance, DAO treasury managers, and Web3 CFOs can automate their crypto payroll processes without sacrificing good governance and data security.