Tip for `kkalii` and `Bitcoin_Army` for identifying malicious referenda

Proposal Context

Incident Overview

The attack consisted of two interconnected proposals, strategically designed to mislead governance participants and hide malicious intent:

1️⃣ First FAKE Proposal – Referendum 149 (View Proposal)
The attacker inserted blank spaces in the proposal text, making it difficult to identify the real purpose of the extrinsic/call function.

This proposal contained a hidden Sudo.setKey function, which would have granted full control over Kintsugi’s governance.
The formatting trick bypassed casual review, as the malicious function was camouflaged within seemingly harmless content.

2️⃣ Second FAKE Proposal – Referendum 150 (View Proposal)
After attempting to gain governance control, the attacker submitted a separate funding request for an apparently legitimate activity.
This second proposal was meant to reinforce credibility, making it seem like a standard governance request.

If both proposals had passed, the attacker could have diverted funds and manipulated governance without immediate suspicion.

Social Engineering & Deception Tactics

The attacker relied on human oversight by making Referendum 149 difficult to analyze at a glance.
The secondary proposal created a false sense of legitimacy, making it less likely that governance participants would question Referendum 149.
This was not a simple technical exploit—it was a highly coordinated attempt to manipulate decentralized governance using psychological tactics.
Response & Resolution

Bitcoin_Army immediately flagged the attack before execution.
Discussions with Kintsugi stakeholders took place to reinforce governance security.
This case triggered a reevaluation of governance monitoring and review processes in Kusama parachains.

I want to thank the user community for stopping the attack, as the reputational damage to Kintsughi—and even to Interlay—would have been significant. Even if the attacker had behaved correctly by returning control, it would have exposed the project. Instead, we stayed alert—great job to everyone involved.