Governance Attack

A governance attack is a class of exploit where an adversary manipulates a protocol's on-chain voting system to pass malicious proposals — treasury drains, parameter changes, or contract upgrades — using the protocol's own legitimate governance mechanics rather than exploiting software bugs.

Unlike traditional smart contract vulnerabilities (reentrancy, overflow, access control bypass), governance attacks operate within the deterministic rules of the protocol. The attacker follows the correct proposal and voting procedures; the exploit lies in acquiring disproportionate voting power through economic or technical manipulation.

Primary attack vectors

Flash loan governance attacks use uncollateralized flash loans to borrow massive quantities of governance tokens, vote on or execute a malicious proposal, and repay the loan — all within a single atomic transaction. The attacker risks zero capital. The $182 million Beanstalk exploit (2022) is the canonical example.

Quorum exhaustion exploits low voter participation. When a protocol's quorum threshold is set relative to circulating supply rather than total supply, or when historical participation is low, an attacker can accumulate enough tokens to single-handedly meet quorum and pass proposals that the majority of holders never see.

Bytecode injection combines social engineering with EVM opcode manipulation. The Tornado Cash exploit (2023) used selfdestruct and CREATE2 to swap a benign contract for a hostile one at the same address after governance approval.

Vote buying and bribery operate through platforms like Votium or Hidden Hand, where attackers pay token holders to vote in their favor. While not always illegal, this financializes governance into pure economic transactionism.

Defenses

The primary defenses are temporal separation (timelocks), retrospective vote weight calculation (N-1 block checkpointing via ERC20Votes), quorum thresholds calibrated against total supply, and dual governance structures that give at-risk stakeholders veto power. See also DAO for governance architecture patterns.