If a DAO's treasury is worth more than the cost of acquiring enough votes to control it, an attacker has an incentive to try. Governance security is therefore an economic problem as much as a technical one.
Flash-loan governance attacks
A flash loan lets anyone borrow a very large amount of capital within a single transaction, as long as it's repaid by the end of that transaction. If a governance system counts voting power at the current block and can execute immediately, borrowed tokens can pass a proposal and drain funds before the loan is repaid.
The best-known example is the Beanstalk incident in April 2022. According to public post-mortems, an attacker used flash-loaned assets to obtain a supermajority of voting power and pass an emergency proposal that transferred protocol funds, causing losses reported at roughly $180 million in value.
Hostile takeovers
Attackers don't always need flash loans. In small DAOs with low participation, simply accumulating tokens can be enough. In early 2022, Build Finance DAO suffered a takeover in which an actor gathered enough voting power to pass a proposal granting themselves control over the token contract and treasury.
Vote buying and bribery markets
Some platforms openly pay holders to vote a certain way, especially in vote-escrow systems where votes direct token emissions. This isn't always malicious, but it means outcomes can reflect who pays most rather than what benefits the protocol.
Defensive design
| Defence | What it prevents |
|---|---|
| Past-block voting power | Using tokens acquired after a proposal is created |
| Voting delay | Instant proposal-and-vote attacks |
| Timelock | Immediate execution; gives users time to exit |
| Meaningful quorum & thresholds | Cheap takeovers in low-turnout DAOs |
| Guardian / security council veto | Clearly malicious proposals (with its own trust trade-off) |
| Staking or lock-ups for voting | Borrowed or short-term voting power |
Monitoring as a community
Tokenholders are the last line of defence. Watch for proposals submitted with little discussion, unusual calldata, sudden large delegations and votes scheduled during holidays. Alerting tools that track new proposals make this much easier.
A governance system is only as secure as the cheapest path to controlling it. Good design makes that path expensive, slow and visible.
This article is for educational purposes only and is not financial or legal advice. Quorum Lens is an independent publication and is not affiliated with any project mentioned.