{"investigation":{"slug":"dough-finance","entity_name":"Dough Finance","trust_score":12,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"Dough Finance was an Ethereum-based DeFi lending and margin-trading protocol co-founded by Chase Herro and Zachary Folkman. On July 12, 2024, the protocol was exploited via a flash loan attack that drained approximately $2.1–2.5 million in user funds due to unvalidated calldata in its ConnectorDeleverageParaswap smart contract. The protocol's website is shut down, the vast majority of the approximately 2,700 affected users have received no meaningful compensation, and the co-founders have since launched World Liberty Financial alongside Donald Trump, earning an alleged $65 million in revenues from that new venture.","sections":[{"content":"Dough Finance was an open-source, non-custodial DeFi protocol built on Ethereum that integrated with AAVE V3 infrastructure to offer lending, borrowing, leveraged margin trading, and asset swapping via DeFi Smart Accounts (DSAs). Users could supply and borrow assets, execute leveraged 'looping' strategies, and hold DOUGH governance tokens that conferred treasury profit-sharing rights. The protocol was co-founded by Chase Herro and Zachary Folkman. As of 2025 the protocol's website is shut down and its total value locked (TVL) has collapsed to approximately $1,689 according to DeFiLlama.","heading":"Protocol Overview","sources":[{"url":"https://docs.dough.finance/","name":"docs.dough.finance","type":"other","credibility":3},{"url":"https://defillama.com/protocol/dough-finance","name":"defillama.com","type":"other","credibility":3},{"url":"https://www.cryptotimes.io/2025/05/20/trumps-crypto-allies-leave-dough-investors-high-and-dry/","name":"cryptotimes.io","type":"other","credibility":3}],"severity":"medium"},{"content":"On July 12, 2024, Dough Finance suffered a flash loan exploit in which an attacker stole approximately 608 ETH (valued at roughly $1.8–2.1 million at the time) across eight victim DoughDSA contracts. CertiK's post-incident analysis identified the root cause as a lack of calldata validation in the ConnectorDeleverageParaswap contract's deloop call chain. The attacker exploited this flaw by crafting malicious calldata that enabled arbitrary external calls from the vulnerable contract, allowing unauthorized transferFrom() operations to redirect WETH collateral to the attacker's wallet. The attacker then swapped stolen WETH to USDC. Some reporting placed total losses, including USDC drained, at approximately $2.5 million. The attacker's initial funds were sourced via Railgun, a zero-knowledge privacy protocol. By July 13, 2024, approximately 600 ETH of stolen funds had been deposited into Tornado Cash. The protocol acknowledged the exploit and urged users to withdraw remaining funds. A white-hat wallet (0xcDd9E99dA30f790b9A73fAB23581000aC7753F76) returned 69.12 ETH, and MEV bot c0ffeebabe.eth returned an additional 7.05 ETH, yielding a total recovery of approximately 76.17 ETH (roughly $281,000). An on-chain ultimatum was issued to the attacker with a July 15, 2024 deadline, threatening criminal, legal, and administrative action; the attacker did not comply.","heading":"July 2024 Flash Loan Exploit","sources":[{"url":"https://www.certik.com/resources/blog/3SMOuGMCSttY4pQW6I49W2-dough-finance-incident-analysis","name":"certik.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/dough-finance-loses-1-8m-flash-loan-attack","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://bitcoinist.com/defi-protocol-dough-finance-exploit-swipes-1-96-million-in-user-funds/","name":"bitcoinist.com","type":"other","credibility":3},{"url":"https://medium.com/@dehacker_security/dough-finance-incident-analysis-04db15c22552","name":"medium.com","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/?id=dough-finance-hack","name":"web3isgoinggreat.com","type":"other","credibility":3},{"url":"https://safe-edges.medium.com/dough-finance-1-8-m-hack-analysis-d83bcb6b3500","name":"safe-edges.medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the exploit, Dough Finance pledged to make affected users whole. Approximately 2,700 users were impacted. A governance vote passed with 99.5% support to reimburse token holders. In August 2024, the team announced plans to issue proprietary DOUGH tokens convertible to ETH as compensation. Of the $281,000 recovered, approximately $180,000 was distributed to a select group of addresses. The majority of affected users reported receiving either nothing or negligible quantities of DOUGH tokens, which had lost substantially all market value by 2025. Co-founders Herro and Folkman ceased communication on official channels by mid-August 2024. The protocol's website was subsequently shut down. Multiple affected users publicly reported receiving no meaningful reimbursement as of mid-2025.","heading":"Compensation Failures and Alleged Abandonment","sources":[{"url":"https://www.bitget.com/news/detail/12560604094777","name":"bitget.com","type":"other","credibility":3},{"url":"https://coinalertnews.com/news/2025/05/20/07d92e9b5e866f706e03d55df60db506","name":"coinalertnews.com","type":"other","credibility":3},{"url":"https://www.cryptotimes.io/2025/05/20/trumps-crypto-allies-leave-dough-investors-high-and-dry/","name":"cryptotimes.io","type":"other","credibility":3},{"url":"https://www.ainvest.com/news/dough-finance-clients-await-compensation-2-5m-hack-2505/","name":"ainvest.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Investor Jonathan Lopez, who had invested approximately $1 million in Dough Finance in May 2024 — paying a 5% fee to Herro and being encouraged by Herro to employ leveraged 'looping' strategies — filed a lawsuit in Florida against Chase Herro. Lopez alleges fraud, misrepresentation, breach of financial duties, and violations of Florida securities laws. The complaint alleges that after the hack Herro personally promised Lopez reimbursement of approximately 300 ETH but subsequently reneged on that promise. The trial is scheduled for April 2026. Legal experts cited in coverage note that platform disclaimers typically do not shield crypto companies from liability when courts examine why and how a hack occurred and what obligations were undertaken to secure user assets.","heading":"Litigation: Lopez v. Herro","sources":[{"url":"https://beincrypto.com/wlfi-founders-sued-dough-reimbursement-hack/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://blocktribune.com/florida-man-sues-crypto-founder-for-fraud-over-lost-investment/","name":"blocktribune.com","type":"other","credibility":3},{"url":"https://www.cryptotimes.io/2025/05/20/trumps-crypto-allies-leave-dough-investors-high-and-dry/","name":"cryptotimes.io","type":"other","credibility":3},{"url":"https://www.dglaw.com/reuters-how-trumps-crypto-business-partners-left-their-old-clients-in-the-lurch/","name":"dglaw.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Chase Herro and Zachary Folkman launched World Liberty Financial (WLFI) in September 2024, alongside Donald Trump, his sons, and the Witkoff family. WLFI has reportedly generated approximately $550 million in token sales, with Herro and Folkman together earning an alleged $65 million in revenues from the venture. Critics and investor advocates have highlighted the contrast between the founders' profiting from a well-funded new project while leaving Dough Finance investors uncompensated. CoinTelegraph described this pattern as the 'playbook of recycled crypto founders.' Herro was described as 'a dirtbag of the internet' in a DL News profile of the WLFI operator team, referencing his pre-crypto social media persona.","heading":"Founders' Transition to World Liberty Financial","sources":[{"url":"https://cointelegraph.com/explained/from-25m-loss-to-65m-gain-inside-the-playbook-of-recycled-crypto-founders","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://www.dlnews.com/articles/defi/meet-the-operators-of-donald-trump-world-liberty-financial/","name":"dlnews.com","type":"other","credibility":3},{"url":"https://coinalertnews.com/news/2025/05/20/07d92e9b5e866f706e03d55df60db506","name":"coinalertnews.com","type":"other","credibility":3},{"url":"https://en.wikipedia.org/wiki/World_Liberty_Financial","name":"en.wikipedia.org","type":"other","credibility":3}],"severity":"medium"},{"content":"Blockchain investigator ZachXBT flagged Dough Finance in connection with the July 2024 exploit. According to reporting, ZachXBT hypothesized that the attack may have originated from a private key leak, though this specific hypothesis was not confirmed by subsequent technical analyses, which attributed the exploit to calldata validation failures in the smart contract. ZachXBT's flagging of the entity has been cited as an indicator of elevated risk for users of the protocol.","heading":"ZachXBT Flagging and On-Chain Observations","sources":[{"url":"https://www.web3isgoinggreat.com/?id=dough-finance-hack","name":"web3isgoinggreat.com","type":"other","credibility":3},{"url":"https://www.certik.com/resources/blog/3SMOuGMCSttY4pQW6I49W2-dough-finance-incident-analysis","name":"certik.com","type":"other","credibility":3}],"severity":"medium"},{"content":"As of mid-2025, Dough Finance's website is offline. The protocol's on-chain TVL is approximately $1,689 according to DeFiLlama, indicating effective abandonment. The DOUGH governance token has negligible market value. No regulatory action by the SEC, CFTC, or other government bodies against Dough Finance specifically has been publicly reported. The civil lawsuit (Lopez v. Herro) remains the primary active legal proceeding, with trial scheduled for April 2026. Affected users continue to report no meaningful compensation.","heading":"Current Protocol Status","sources":[{"url":"https://defillama.com/protocol/dough-finance","name":"defillama.com","type":"other","credibility":3},{"url":"https://beincrypto.com/wlfi-founders-sued-dough-reimbursement-hack/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://www.ainvest.com/news/dough-finance-clients-await-compensation-2-5m-hack-2505/","name":"ainvest.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2024-05","event":"Jonathan Lopez invests approximately $1 million in Dough Finance, allegedly guided by Chase Herro to use leveraged looping strategies and paying a 5% fee.","source":"","date_original":"2024-05-01"},{"date":"2024-07-12","event":"Flash loan exploit drains approximately $1.8–2.5 million from Dough Finance's ConnectorDeleverageParaswap contracts due to missing calldata validation. Attacker funded via Railgun.","source":""},{"date":"2024-07-12","event":"Dough Finance acknowledges exploit, urges users to withdraw funds, and posts on-chain message demanding return of stolen assets by July 15, 2024.","source":""},{"date":"2024-07-13","event":"Approximately 600 ETH of stolen funds deposited into Tornado Cash by the attacker. White-hat wallet returns 69.12 ETH; MEV bot c0ffeebabe.eth returns 7.05 ETH.","source":""},{"date":"2024-07-15","event":"Dough Finance's ultimatum deadline to the attacker passes with no compliance. Founders announce intent to pursue criminal, legal, and administrative remedies.","source":""},{"date":"2024-08","event":"Dough Finance announces compensation plan: proprietary DOUGH tokens convertible to ETH for affected users. Approximately $180,000 of recovered $281,000 distributed to select addresses.","source":"","date_original":"2024-08-01"},{"date":"2024-08-15","event":"Co-founders Herro and Folkman cease communication on official Dough Finance channels.","source":""},{"date":"2024-09","event":"Chase Herro and Zachary Folkman launch World Liberty Financial (WLFI) alongside Donald Trump, his sons, and the Witkoff family.","source":"","date_original":"2024-09-01"},{"date":"2024-09","event":"Governance vote on Dough Finance reimbursement passes with 99.5% approval; no meaningful additional compensation follows.","source":"","date_original":"2024-09-01"},{"date":"2024-12","event":"Dough Finance website goes offline. Protocol effectively abandoned.","source":"","date_original":"2024-12-01"},{"date":"2025-05","event":"Jonathan Lopez files civil lawsuit against Chase Herro in Florida, alleging fraud, misrepresentation, breach of financial duties, and securities law violations over the $2.5M hack and unkept reimbursement promises.","source":"","date_original":"2025-05-01"},{"date":"2025-05-20","event":"Multiple news outlets (CryptoTimes, CoinAlertNews, Malay Mail) report on Dough Finance investors remaining uncompensated while Herro and Folkman have earned an alleged $65 million from WLFI.","source":""},{"date":"2026-04","event":"Trial in Lopez v. Herro scheduled; outcome pending as of research date.","source":"","date_original":"2026-04-01"}],"sources_used":[{"url":"https://docs.dough.finance/","name":"docs.dough.finance","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-job","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://defillama.com/protocol/dough-finance","name":"defillama.com","type":"other","archive_url":"http://web.archive.org/web/20260717041120/https://defillama.com/protocol/dough-finance","credibility":3,"archive_timestamp":"2026-07-17T04:11:20+00:00"},{"url":"https://www.cryptotimes.io/2025/05/20/trumps-crypto-allies-leave-dough-investors-high-and-dry/","name":"cryptotimes.io","type":"other","archive_url":"https://web.archive.org/web/20260829151315/https://www.cryptotimes.io/2025/05/20/trumps-crypto-allies-leave-dough-investors-high-and-dry/","credibility":3,"archive_timestamp":"2026-08-29T15:13:15+00:00"},{"url":"https://www.certik.com/resources/blog/3SMOuGMCSttY4pQW6I49W2-dough-finance-incident-analysis","name":"certik.com","type":"other","archive_url":"http://web.archive.org/web/20250512063042/https://www.certik.com/resources/blog/3SMOuGMCSttY4pQW6I49W2-dough-finance-incident-analysis","credibility":3,"archive_timestamp":"2025-05-12T06:30:42+00:00"},{"url":"https://cointelegraph.com/news/dough-finance-loses-1-8m-flash-loan-attack","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20260725213830/https://cointelegraph.com/news/dough-finance-loses-1-8m-flash-loan-attack","credibility":3,"archive_timestamp":"2026-07-25T21:38:30+00:00"},{"url":"https://bitcoinist.com/defi-protocol-dough-finance-exploit-swipes-1-96-million-in-user-funds/","name":"bitcoinist.com","type":"other","archive_url":"https://web.archive.org/web/20260830035835/https://bitcoinist.com/defi-protocol-dough-finance-exploit-swipes-1-96-million-in-user-funds/","credibility":3,"archive_timestamp":"2026-08-30T03:58:35+00:00"},{"url":"https://medium.com/@dehacker_security/dough-finance-incident-analysis-04db15c22552","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.web3isgoinggreat.com/?id=dough-finance-hack","name":"web3isgoinggreat.com","type":"other","archive_url":"http://web.archive.org/web/20260511091106/https://www.web3isgoinggreat.com/?id=dough-finance-hack","credibility":3,"archive_timestamp":"2026-05-11T09:11:06+00:00"},{"url":"https://safe-edges.medium.com/dough-finance-1-8-m-hack-analysis-d83bcb6b3500","name":"safe-edges.medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.bitget.com/news/detail/12560604094777","name":"bitget.com","type":"other","archive_url":"http://web.archive.org/web/20260829144353/https://www.bitget.com/news/detail/12560604094777","credibility":3,"archive_timestamp":"2026-08-29T14:43:53+00:00"},{"url":"https://coinalertnews.com/news/2025/05/20/07d92e9b5e866f706e03d55df60db506","name":"coinalertnews.com","type":"other","archive_url":"http://web.archive.org/web/20260805081608/https://coinalertnews.com/news/2025/05/20/07d92e9b5e866f706e03d55df60db506","credibility":3,"archive_timestamp":"2026-08-05T08:16:08+00:00"},{"url":"https://www.ainvest.com/news/dough-finance-clients-await-compensation-2-5m-hack-2505/","name":"ainvest.com","type":"other","archive_url":"http://web.archive.org/web/20251016190822/https://www.ainvest.com/news/dough-finance-clients-await-compensation-2-5m-hack-2505/","credibility":3,"archive_timestamp":"2025-10-16T19:08:22+00:00"},{"url":"https://beincrypto.com/wlfi-founders-sued-dough-reimbursement-hack/","name":"beincrypto.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://blocktribune.com/florida-man-sues-crypto-founder-for-fraud-over-lost-investment/","name":"blocktribune.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.dglaw.com/reuters-how-trumps-crypto-business-partners-left-their-old-clients-in-the-lurch/","name":"dglaw.com","type":"other","archive_url":"http://web.archive.org/web/20260521101225/https://www.dglaw.com/reuters-how-trumps-crypto-business-partners-left-their-old-clients-in-the-lurch/","credibility":3,"archive_timestamp":"2026-05-21T10:12:25+00:00"},{"url":"https://cointelegraph.com/explained/from-25m-loss-to-65m-gain-inside-the-playbook-of-recycled-crypto-founders","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20251208230649/https://cointelegraph.com/explained/from-25m-loss-to-65m-gain-inside-the-playbook-of-recycled-crypto-founders","credibility":3,"archive_timestamp":"2025-12-08T23:06:49+00:00"},{"url":"https://www.dlnews.com/articles/defi/meet-the-operators-of-donald-trump-world-liberty-financial/","name":"dlnews.com","type":"other","archive_url":"http://web.archive.org/web/20260626103142/https://www.dlnews.com/articles/defi/meet-the-operators-of-donald-trump-world-liberty-financial/","credibility":3,"archive_timestamp":"2026-06-26T10:31:42+00:00"},{"url":"https://en.wikipedia.org/wiki/World_Liberty_Financial","name":"en.wikipedia.org","type":"other","archive_url":"http://web.archive.org/web/20260812201143/https://en.wikipedia.org/wiki/World_Liberty_Financial","credibility":3,"archive_timestamp":"2026-08-12T20:11:43+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:31.225894+00:00","updated_at":"2026-08-30T05:14:07.393298+00:00"}}