⚔️ Governance Attacks: Defend Your DAO
Learn attack vectors and defense strategies for DAOs
Your Progress
0 / 5 completed⚔️ When Governance Gets Hacked
DAO governance sounds democratic: one token = one vote. But this creates exploitable attack vectors. Flash loans let attackers borrow millions of tokens for a single transaction. Whales accumulate massive voting power. Proposal spam blocks legitimate governance. When billions are at stake, attackers will exploit every weakness.
💀 Real Governance Exploits
- • Beanstalk 2022: Attacker used $1B flash loan to pass malicious proposal, drained $182M in seconds (67% quorum reached)
- • Build Finance 2021: Attacker bought 20% of tokens, passed proposal to mint 25M tokens to themselves
- • Tornado Cash 2023: Attacker accumulated 1.2M votes via cheap token purchases, took over governance completely
🎮 Interactive: Flash Loan Attack Simulator
Model a governance attack using borrowed tokens. See how loan size, quorum requirements, and voting periods affect attack feasibility.
SECURE: Attacker only achieves 10.0% power, well below 20% quorum requirement. Even with 10M borrowed tokens, attack fails. Quorum requirement effective.
🎯 Why Governance is Vulnerable
- • Flash loans: Borrow millions of tokens for one block
- • Whale accumulation: Buy voting power slowly
- • Proposal spam: Flood governance with junk
- • Vote buying: Pay holders to delegate power
- • Token = voting power (plutocracy, not democracy)
- • Low quorums (easy to manipulate)
- • Short voting periods (flash loan window)
- • No identity verification (anonymous attackers)
💡 Key Insight
Governance attacks aren't theoretical—they're proven and profitable. Beanstalk lost $182M in 2022 to a flash loan attack that took 13 seconds. The attacker borrowed $1B in tokens, voted through a malicious proposal, and drained the treasury before anyone could react. One token = one vote sounds fair until someone borrows a billion tokens. Understanding these attacks is the first step to defending against them.