[Applause]
they only voted option okay so it is
normal operation what does the attack
work so I'll show you an example where
we really want to buy sell so what we do
is find a combination of proposals that
has not been voted before right a
specific combination when we compute the
hash of chain when we have this revolved
for a hash and what this will do a
signal that doesn't have the Association
I told you about in storage and what we
will do is it will record my vote but it
won't produce any approvals for the
options because it doesn't know what
options these are and so this was
brought some sort of corresponds so then
we see the way for other users to vote
for the actual proposals that were in my
original goal and once I have enough
support for these options what I do we
say actually vote for the option I
really want support right and so what
this will do it will reduce the
approvals for the other options as the
approvals are not mine because in my
first vote there were no you should know
what rules issued but will do is reduce
the approval from other voters and of
course it will increase approval for my
know he chosen option so with this what
I'd like to do is to steal votes from
other users
okay and the second consequence of this
issue is that say another yellowish user
was to and withdraw their funds from the
contract so will do is this is the
picture at home and they say okay I call
the free function to freedom maker but
the contract has a different picture in
mind where if things
there's no approval and afterwards for
the option did the yellow user voted for
so it tries to reduce those approvals it
would fail to do so I never got the
whole transaction through I log in the
pants of the use okay so there's two
attack fields one is for free if one
can't find that combination recent
proposals and with this I mean that
proposal that will be naturally voted
for so this is for free or if I can do
this I can always trade the new
proposals which is just said anything
matters and perform the attack at the
cost so we just of this to the maker
team and they quickly should apiece and
how to users migrating fund so
everything's good not ok so I invite you
to visit our blog where we have this and
many other vulnerabilities and we
recently Libra so we have the audit
reports for compound and inside we also
have this person's in the problem soon
please
[Applause]