Worked example · 2021-03

True Seigniorage Dollar (TSD) hostile-vote mint flooding — Binance Smart Chain — 2021-03-13

Loss: ~11.8 billion TSD minted by the attacker via a malicious governance-Implementation proposal and dumped into the PancakeSwap TSD/BUSD pool; realised attacker proceeds approximately $16,600 in BUSD-equivalent (the on-chain liquidity could not absorb the supply flood at any meaningful price). The realised-vs-nominal gap is the canonical observation of the case: nominal mint was >10⁴× pre-event circulating supply; realised extraction was bounded by PancakeSwap pool depth, not by anything the protocol could do at the smart-contract layer once the proposal had executed.
OAK Techniques observed: OAK-T16.002 (Hostile-Vote Treasury Drain — direct-market-accumulation sub-shape: attacker accumulated >33% of staked DAO voting power via legitimate on-chain purchases over a multi-week window during the protocol's "long Debt phase" when other holders had unbonded) + OAK-T9.003 (Governance Attack — the generic-class anchor preserved on every T16.002 example) + OAK-T9.004 (Access-Control Misconfiguration — the malicious Implementation contract, once installed via the routine governance-upgrade path, gained mint authority by design of the underlying ESD-fork governance pattern). T16.001 (flash-loan vote takeover) does not apply: the attacker held the position across a multi-week accumulation window and across the full proposal lifecycle, never inside a single block.
Attribution: pseudonymous; no public named-individual attribution. The attacker address received and dumped TSD against PancakeSwap TSD/BUSD liquidity; on-chain trace published by CertiK identifies the attacker wallet but no real-world identity has been linked.
Key teaching point: TSD is the cleanest pre-Mango-Markets T16.002 case on the public record, predating the canonical Mango Markets October 2022 anchor by 19 months and demonstrating the direct-market-accumulation sub-shape (vs Mango's post-T9.001 settlement-vote sub-shape) before the T16.002 class had a name. The case also pre-dates Beanstalk April 2022 by 13 months and is the earliest worked example of "the governance contract did exactly what it was designed to do" as the load-bearing failure — no smart-contract bug, no oracle manipulation, no flash loan; the governance design itself was the attack surface.

Summary

True Seigniorage Dollar was a Binance-Smart-Chain-deployed algorithmic-stablecoin protocol forked from the Empty Set Dollar (ESD) governance-stablecoin design, launched late-2020 / early-2021. The protocol's value-stabilisation mechanism oscillated between an Expansion phase (when TSD trades above peg, the protocol mints new supply and distributes to bonded DAO stakers as expansion rewards) and a Debt phase (when TSD trades below peg, the protocol auctions debt-coupons against TSD-burns and pauses expansion rewards). DAO voting power was computed against bonded TSD balances — to vote on governance proposals, holders had to bond their tokens into the DAO contract, which simultaneously made them eligible for expansion rewards but exposed them to the unbonding lockup window.

Through January-March 2021, TSD spent extended periods in the Debt phase as the peg deteriorated, which produced two compounding effects: (a) bonded holders, no longer earning expansion rewards, unbonded to exit the protocol or redeploy capital, draining the DAO's voting-power base; and (b) the TSD spot price collapsed, making it cheap to accumulate TSD on PancakeSwap and bond it. The attacker exploited both: over the multi-week window preceding the attack, they accumulated TSD on the open market at low prices and bonded it into the DAO until their stake exceeded 33% of total DAO voting power. The CertiK post-event analysis specifically observes that the attacker accumulated more than 33% of the DAO — sufficient to single-handedly pass a proposal under TSD's quorum and approval-threshold settings — while paying near-zero real cost because the unbonded-holder cohort had self-selected out of the voting base.

On 2021-03-13, the attacker submitted a governance proposal under TSD's standard ESD-fork "Implementation upgrade" flow. The proposal payload swapped the protocol's Implementation contract for an attacker-deployed contract whose only meaningful difference from the canonical Implementation was the addition of a function that minted 11.8 billion TSD to a hardcoded attacker address. The attacker voted their accumulated stake in favour of the proposal; quorum was met (the voting cohort had collapsed to a small number of bonded holders, most of whom did not vote in time); the proposal passed; the malicious Implementation was installed; the attacker called the malicious mint function; 11.8 billion TSD landed at the attacker address. The attacker then dumped the entire mint against the PancakeSwap TSD/BUSD pool, extracting approximately $16,600 in BUSD before the pool was effectively drained of BUSD-side liquidity. CertiK published the forensic write-up the following day (2021-03-14) framing the case as the canonical "exploiting a smart contract without security vulnerabilities" pattern — the contracts behaved exactly as designed; the design was the vulnerability.

The TSD protocol did not recover from the event. The peg never re-established and the protocol was effectively abandoned over the subsequent weeks. No bounty negotiation, no compensation pool, no operator-side response that recovered material funds; the attacker retained the realised $16,600 and the protocol's reputational position was unrecoverable.

Timeline (UTC)

When	Event	OAK ref
late 2020 / early 2021	TSD launches on BSC as an ESD-fork algorithmic-stablecoin protocol; DAO voting power = bonded TSD; standing Implementation-upgrade governance flow with quorum-but-not-time-locked proposal lifecycle	(standing T9.003 / T16.002 surface deployed)
Jan–March 2021	TSD spends extended periods in Debt phase; bonded holders unbond and exit; voting-power base collapses	T16.002 pre-condition (voting-cohort thinning)
Jan–March 2021 (same window)	Attacker accumulates TSD on PancakeSwap at depressed prices and bonds into the DAO; stake crosses 33% of total bonded supply	T16.002 setup (direct-market-accumulation sub-shape)
2021-03-13	Attacker submits Implementation-upgrade governance proposal; proposal Implementation includes a mint-to-attacker function	T9.003 + T16.002 (proposal payload)
2021-03-13 (same window)	Attacker votes accumulated stake in favour; quorum met against thinned voting base; proposal passes	T16.002 vote-passage
2021-03-13 (same window)	Malicious Implementation installed; attacker calls mint function; 11.8 billion TSD minted to attacker address	T16.002 extraction (T9.004 access-control surface)
2021-03-13 (same window)	Attacker dumps 11.8B TSD against PancakeSwap TSD/BUSD pool; realised proceeds approximately $16,600 BUSD; pool effectively drained	T7-broadly (monetisation; thin-liquidity-bounded)
2021-03-13 ~T+1h	TSD team publishes Twitter thread acknowledging the exploit and walking through the Debt-phase / unbonding / voting-power-collapse mechanics	(operator response)
2021-03-14	CertiK publishes forensic write-up framing the case as "exploiting a smart contract without security vulnerabilities" — governance-design itself as the attack surface	(forensic record)
weeks following	TSD peg fails to re-establish; protocol abandoned; no compensation, no recovery	(post-event collapse)

What defenders observed

Pre-event (governance-design layer, ESD-fork-substrate): TSD inherited the ESD Implementation-upgrade governance flow verbatim. ESD's design assumed a healthy bonded-holder cohort across all market phases, but ESD itself had spent significant time in Debt-phase by early 2021 and the same voting-cohort-thinning effect had been observed and discussed in ESD-community forums weeks before TSD's exploit. The fork-substrate observation is canonical here: ESD's governance design was already known to thin under sustained Debt-phase, but TSD inherited the design without adapting the quorum / threshold settings to its smaller bonded-holder base. Pairs with the MakerDAO-fork-substrate vulnerability class observed at Curio (examples/2024-03-curio.md) and the Compound-v2-fork rounding-error class (Hundred → Midas → Sonne → Onyx) as a recurring "fork-substrate-vulnerability-not-mitigated-at-fork-time" framework-level pattern.
Pre-event (cohort-surveillance layer): the attacker's accumulation was visible on-chain in real time. A cohort-surveillance monitor — TSD bonded-stake-share by address, with alerting on any single address crossing 20% / 30% / 50% of total bonded stake — would have produced a high-confidence pre-event signal across the multi-week accumulation window. Tally / Boardroom-class governance dashboards did not yet exist at adequate maturity for BSC-deployed ESD-forks in March 2021; the v0.1 OAK observation is that the defender capability for T16.002 cohort-surveillance reached production maturity 18-24 months after this case, on Ethereum first and BSC second.
At-event (proposal-payload-vs-text divergence): the malicious proposal's text was the standard ESD-fork "Implementation upgrade" framing — the same framing used for routine non-malicious upgrades on ESD and its forks. Defender-side review at proposal-submission time would have required bytecode-level diff of the proposed Implementation against the canonical one to surface the mint-to-attacker function. This is mechanically the same defender control class as the OpenZeppelin proxy-upgrade-static-analysis pattern that became canonical post-2022; the v0.1 OAK observation is that bytecode-diff-at-proposal-submission was not a routine defender practice in March 2021.
At-event (vote-distribution signal): the proposal passed against a small voting cohort with a single dominant in-favour wallet — a clean cohort-level signal that would have surfaced in any DAO-analytics dashboard. The signal was observable but no defender stack was watching.
Post-event (no recovery channel): unlike Mango Markets (negotiated settlement), Beanstalk (Tornado-Cash laundering, zero recovery), or Curio (10% bounty negotiation), TSD's outcome was protocol abandonment. The attacker's realised proceeds were small (~$16,600) precisely because the protocol's own liquidity had thinned alongside its voting base; the attacker was bounded by the same Debt-phase dynamics that enabled the attack. The realised-vs-nominal-loss gap (>10⁴× nominal vs $16.6K realised) is a clean teaching observation but the user-side outcome was nonetheless total loss for remaining TSD holders.

What this example tells contributors writing future Technique pages

T16.002 has a pre-Mango-Markets historical record. The canonical T16.002 anchor is Mango Markets October 2022, but TSD March 2021 demonstrates the direct-market-accumulation sub-shape 19 months earlier, before the class had a name and before Tally / Boardroom-class governance instrumentation existed at adequate maturity. T16.002 contributions should include the historical-precedent observation: "the class was operationally feasible from 2021 onward; the public-record anchor sits in 2022 because that's when the dollar-magnitude crossed the forensic-coverage threshold, not because the class emerged in 2022."
Voting-cohort-thinning is a load-bearing T16.002 enabler distinct from quorum-threshold setting. Worked examples of T16.002 should explicitly enumerate the voting-cohort-population dynamic as a calibration variable. TSD's quorum threshold was static, but the bonded-holder population collapsed under sustained Debt-phase, which made the static quorum trivially achievable. The T16.002 mitigation surface includes governance-design that resists this dynamic — e.g., quorum computed as a fraction of circulating supply rather than bonded supply, or quorum-floor-on-active-voters rather than quorum-on-bonded-stake.
Fork-substrate vulnerability composes with T16.002. TSD inherited ESD's governance design; Curio (examples/2024-03-curio.md) inherited MakerDAO's; the Compound-v2-fork rounding-error cohort inherited Compound's. T9 / T16 contributions should treat fork-substrate-inheritance-without-adaptation as a recurring meta-class enabler that composes with whatever the proximate Technique is. The TSD case is the earliest clean ESD-fork-substrate-T16.002 case on the public record.
Realised-vs-nominal-loss gap reflects monetisation-side liquidity, not attack design. Like Curio's $16M nominal vs $1M realised, TSD's >10⁴× nominal vs $16.6K realised is the same observation: the attacker can mint or extract any nominal amount, but their realised proceeds are bounded by the downstream-liquidity of the monetisation-side venue. Contributors documenting flash-loan-funded mint-flooding (T16.001, T9.003), governance-mint extraction (T16.002, T9.003), or oracle-inflation extraction (T9.001) should report both loss measures and treat them as separate calibration variables.

Public references

CertiK — Exploiting a Smart Contract without Security Vulnerabilities: Analysis of True Seigniorage Dollar Attack Event — primary forensic write-up; canonical source for the "no-vulnerability governance-design-itself" framing, the >33% bonded-stake threshold, the Implementation-upgrade mechanism, and the 11.8B TSD mint figure — [certiktsd2021].
True Seigniorage Dollar — Twitter announcement (March 13, 2021) — protocol-side acknowledgement and walkthrough of the Debt-phase / unbonding / voting-power-collapse dynamics — [tsdannouncement2021].
TokenPost — Stablecoin TSD Comes Under Attack With 11.8B Coins Minted And Sold By Hacker — contemporaneous reporting; cited for the 11.8B mint figure and the PancakeSwap dump path — [tokenposttsd2021].
[zhou2023sok] — academic taxonomy classifying TSD-class governance-design exploits in the broader DeFi-incident corpus.

Citations

[certiktsd2021] — CertiK forensic post-mortem; canonical source for the governance-design-as-attack-surface framing.
[tsdannouncement2021] — TSD operator-side acknowledgement on Twitter.
[tokenposttsd2021] — contemporaneous press reporting.
[zhou2023sok] — academic taxonomy entry.

Discussion

TSD March 2021 is the earliest clean T16.002 case on the public record and demonstrates the direct-market-accumulation sub-shape of T16.002 19 months before Mango Markets October 2022 established the class's canonical anchor. The structural lesson is that T16.002 was operationally feasible from at least early 2021, but the defender stack required to detect or prevent it (Tally / Boardroom-class governance dashboards, cohort-surveillance against bonded-stake-share-by-address, bytecode-diff-at-proposal-submission) reached production maturity 18-24 months later, and reached BSC even later than that. The case fits the recurring "fork-substrate-vulnerability-not-mitigated-at-fork-time" meta-class observation alongside Curio (MakerDAO-fork) and the Hundred → Midas → Sonne → Onyx (Compound-v2-fork) cohort: TSD was an ESD-fork that inherited ESD's governance design without adapting the quorum / threshold settings to its smaller and more fragile bonded-holder base, and the same voting-cohort-thinning dynamic that had been observed in the ESD community weeks earlier was the load-bearing T16.002 enabler.

Attribution-strength is pseudonymous-unattributed — the attacker address is identified in the CertiK trace but no real-world identity has been linked. The attribution-strength contrast with Mango Markets (Eisenberg, publicly self-identified, regulatory-and-criminal record albeit subsequently vacated on venue grounds) and Indexed Finance October 2021 (Andean Medjedovic, indicted by US prosecutors) is informative: T16.002 attackers occupy the full attribution-strength spectrum, and the cohort-level OAK observation is that pseudonymous-unattributed T16.002 attackers tend to operate at smaller dollar-magnitude (TSD: $16.6K) than named / indicted T16.002 attackers (Mango: $110M nominal, $47M retained), consistent with the broader observation that attribution risk scales with dollar magnitude.

The realised-vs-nominal-loss gap (>10⁴× nominal mint vs ~$16.6K realised proceeds) is the canonical TSD teaching observation. The attacker's design ceiling was effectively infinite (they could mint any nominal amount), but their realised ceiling was bounded by PancakeSwap pool depth, which had already collapsed alongside the bonded-holder cohort. This pattern recurs across Curio, Beanstalk, and most governance-mint-flooding cases: nominal extraction is design-bounded; realised extraction is liquidity-bounded; the two should be tracked as separate calibration variables in any T16 / T9.003 dataset. Future Technique-page contributions should make the loss-measurement convention explicit per-incident.