Why Time-Locked Governance Is No Match for a Flash Loan Attack

An attacker uses a flash loan to temporarily borrow governance tokens, often from Aave or Compound, to surpass the proposal threshold. This costs only the gas fee.

• Zero Capital Risk: The attacker never owns the tokens, only controls their voting power for one block.
• Market Manipulation: The borrowed position can be used to pass a malicious proposal that directly enriches the attacker, repaying the loan.

The entire attack—borrow, propose, vote, execute—occurs within a single transaction. Time-locks are irrelevant because the malicious state change is proposed and approved instantly.

• No Time for Defense: The community has zero blocks to react or form a counter-proposal.
• Composability is Key: Protocols like MakerDAO and Uniswap are vulnerable because their governance logic is on-chain and composable with flash loans.

The passed proposal typically triggers a treasury drain or a privileged function call. The profit is captured and the flash loan is repaid, all before the transaction ends.

• Direct Treasury Access: Proposals can upgrade contracts to mint new tokens or transfer funds.
• Protocol Death Spiral: Successful attacks, like the 2020 bZx incident, can destroy protocol credibility and cause a >90% TVL drop.

Many protocols use Snapshot for gas-less voting, separating the vote from execution. This creates a critical delay attackers exploit.

• Delegation Lag: Token delegations are often stale. An attacker can borrow tokens and instantly delegate them to a malicious address to vote.
• Execution Window: The time between a Snapshot vote passing and its on-chain execution is a new attack surface for flash loan-based proposal hijacking.

Mitigation requires moving beyond time-locks. Solutions include rage-quitting (like in DAOhaus), whitelisted execution contracts, or bonding curves for proposal submission.

• LayerZero's OApp: Configurable execution layers can enforce pre-and-post conditions.
• Governance Minimization: Reducing the power of on-chain governance, as seen in Liquity, limits the attack surface.

The future defense is economic. MEV searchers can be incentivized to monitor governance pools and front-run malicious proposals, turning attack profits into protection rewards.

• Flashbots SUAVE: Could enable a marketplace for democratic transaction ordering to block attacks.
• PBS (Proposer-Builder Separation): Allows validators to outsource block building to entities that filter bad governance txs.

A flash loan borrows $100M+ in governance tokens for a single block, allowing an attacker to pass a malicious proposal before the lock expires. The attack cost is only the transaction gas.

• Borrow: Acquire majority voting power instantly.
• Vote & Execute: Pass a proposal to drain treasury or mint tokens.
• Repay: Return the loan in the same transaction, leaving no trace.

These DeFi pioneers established the vulnerable pattern: delegated voting with time-locks. Their massive TVL made them prime targets, forcing reactive fixes like Governor Bravo's proposal threshold and Maker's Governance Security Module.

• Historical Precedent: The $80M+ Mango Markets exploit was a governance attack.
• Reactive Patching: Security is an afterthought, not a first principle.
• Legacy Risk: $10B+ TVL remains exposed in similar architectures.

Mitigation requires moving critical security parameters off-chain and into the protocol's immutable logic. This prevents governance from touching core economic safeguards.

• Hard Caps: Code-enforced limits on treasury withdrawals per block.
• Timelock Escalation: Multi-sig or decentralized watchdogs can veto malicious proposals.
• Architecture Shift: Adopt models from Olympus DAO (gOHM) or Frax Finance (veFXS) that separate governance from asset control.

A governance proposal's typical 3-7 day timelock is an eternity on-chain. A malicious actor can use a flash loan to acquire >50% voting power, pass a malicious proposal, and repay the loan—all within a single block. The treasury is drained long before honest voters can react.

• Attack Cost: Only the gas fees for the flash loan transaction.
• Defense Cost: The entire protocol treasury.

In 2020, a governance attack on Maker was narrowly averted. An attacker borrowed 80,000 MKR via a flash loan (controlling ~$7B in collateral at the time) to vote for a malicious proposal. The community's manual intervention and a GSM Pause were the only defenses.

• TVL at Risk: $7B+
• Key Flaw: Voting power was directly for sale on the open market.

Mitigation requires moving critical security parameters outside the standard governance flow. This isn't about faster voting; it's about removing the attack vector entirely.

• Governance Security Module (GSM) Delay: A hard-coded, extended delay (e.g., 72 hours) for specific, high-risk functions like treasury drains.
• Whitelisted Emergency Multisigs: A non-upgradable set of trusted actors with veto power over catastrophic proposals.
• Separation of Powers: Decouple token-weighted voting for monetary policy from absolute control over core contract upgrades.

If a token's voting power can be rented, its governance is a fiction. Projects like Compound and Uniswap are perpetually one flash loan away from collapse. The market cap of the governance token becomes the ceiling for the cost of attack, not a measure of security.

• Real Cost: Attack cost <<< Protocol TVL.
• False Security: High token price creates complacency, not safety.