Shaw Publishes Byte-Identical Daos.fun Reconstruction, Claims Critical Flaw

Developer Shaw, known on X as @shawmakesmagic, published on Oct. 24 what he says is a byte-identical reconstruction of daos.fun's closed-source Solana program, and claimed to have found a critical vulnerability in its mainnet code.

His public repository contains reconstructed Rust source, a captured copy of the program binary, build instructions, and a comparison record reporting identical SHA-256 hashes for the captured and rebuilt files. A GitHub Actions run for "Rebuild exact source" is marked successful. That setup follows the reproducible-builds practice: when recompiled source produces the same SHA-256 digest as a deployed binary, anyone can rerun the build and compare the hashes rather than taking the publisher's word for it.

What the Reconstruction Does and Does Not Prove

The repository's security review covers a captured executable, not a certification of the program's current mainnet state. It states that its local tests do not establish that a real-world attack occurred. Which live user positions, if any, are affected remains unconfirmed.

Loading post from X…

The reconstruction is also not necessarily the original author's source text. The README notes that historical comments and identifiers cannot be uniquely recovered from a binary; the claim is that the reconstructed code compiles into the same captured executable.

On Solana, a program's deployed bytecode is publicly retrievable through explorers such as Solscan even when its source stays closed, so a closed-source label conceals the human-readable code rather than the on-chain binary. That is the backdrop against which Solana co-founder Anatoly Yakovenko amplified Shaw's post, quoting "There is no security by obscurity anymore" and adding three target emojis. His post did not provide separate verification of the vulnerability claim.

Existing Tokens After the Shutdown

Daos.fun, an investment-fund launchpad, let communities pool $SOL in funds whose creators could trade the assets. Its creator documentation describes moving raised $SOL into a DAO wallet and launching a tradable DAO token. The reconstructed program's documented functions include treasury execution and $SOL and token redemptions.

The daos.fun website now says the platform is no longer maintained and that new DAO and token creation is no longer supported. According to the site, existing bonding curves and pools are on Meteora, and tokens can still trade through compatible clients. It also directs creators to manage existing tokens and claim fees.

Open Questions

Solscan's program page lists the program as upgradeable, and its last-deployment slot matches the captured deployment identified in the repository's audit. Upgradeability means the on-chain code can change after the fact, which makes the repository's captured hashes a fixed reference point: any future redeployment can be compared against the audited build.

Whether daos.fun received a private disclosure or acknowledged Shaw's claim could not be established from the public materials reviewed.

The repository publishes its audit material and local test scripts rather than withholding technical details. Its security policy says the reconstruction intentionally retains the reported vulnerabilities and provides no deployed remediation.