A flash loan governance attack is a malicious action where an attacker borrows a massive amount of assets via a flash loan—a loan that must be borrowed and repaid within a single blockchain transaction—to gain a controlling or influential share of a protocol's governance tokens. This temporary voting power is then used to pass a malicious governance proposal, such as one that drains the protocol's treasury, changes critical parameters, or mints new tokens for the attacker. The entire exploit, including loan repayment, is executed atomically, leaving the attacker with a profit and the protocol compromised, while the lender's funds are returned.
LABS
Glossary
Flash Loan (Governance Attack)
A flash loan governance attack is a DeFi exploit where an attacker borrows a large sum via a flash loan to temporarily acquire governance tokens and sway a DAO vote, repaying the loan within the same transaction.
Chainscore © 2026
definition
DEFINITION
What is a Flash Loan Governance Attack?
A flash loan governance attack is a sophisticated exploit where an attacker uses uncollateralized flash loans to temporarily acquire enough voting power to manipulate a decentralized autonomous organization (DAO) or protocol's governance system.
The attack exploits the core mechanics of on-chain governance, where voting power is directly proportional to the number of governance tokens held. By not requiring collateral, flash loans allow attackers to bypass the enormous capital typically needed for such an attack. Common tactics include: borrowing governance tokens directly, borrowing assets to swap for governance tokens on a decentralized exchange (DEX), or using borrowed funds to provide liquidity and receive liquidity provider (LP) tokens that also carry voting rights. The proposal is crafted to execute the theft or manipulation immediately upon passing, before the loan is repaid.
A canonical example is the 2020 bZx protocol attack, where an attacker used flash loans to manipulate oracle prices and drain funds, though not strictly a governance attack. A more direct governance example is the 2021 Beanstalk Farms exploit, where an attacker borrowed nearly $1 billion in assets, acquired over 67% of the governance tokens, and passed a proposal that siphoned $182 million from the protocol's treasury in a single transaction. These events highlight the vulnerability of governance systems that do not have safeguards against sudden, massive influxes of voting power.
To mitigate flash loan governance attacks, protocols implement defensive mechanisms. These include: a timelock on executed proposals, which delays implementation after a vote passes, allowing the community to react; a quorum requirement that mandates a minimum percentage of total tokens vote; and vote weighting formulas that reduce the impact of single large holders, such as using a square-root function. Some protocols also whitelist token addresses that can participate in governance or implement rage-quit mechanisms that allow users to exit with their funds if a malicious proposal passes.
For developers and auditors, understanding this attack vector is critical for secure protocol design. It underscores that governance security is financial security in DeFi. Security assessments must model scenarios where an attacker can temporarily control any amount of capital. Furthermore, this attack blurs the line between an economic exploit and a governance takeover, demonstrating how modular DeFi primitives like flash loans can be weaponized against other system components in unpredictable ways.
how-it-works
DEFINITION
How a Flash Loan Governance Attack Works
A flash loan governance attack is a sophisticated exploit where an attacker uses a large, uncollateralized flash loan to temporarily manipulate a decentralized protocol's governance system, often to pass a malicious proposal or gain control of its treasury.
A flash loan governance attack is a multi-step exploit that leverages the unique properties of flash loans—uncollateralized loans that must be borrowed and repaid within a single blockchain transaction—to temporarily acquire enough voting power to influence or control a Decentralized Autonomous Organization (DAO). The attacker's goal is not to steal the loaned funds, which must be returned, but to use the borrowed voting tokens to pass a proposal that benefits them, such as draining the protocol's treasury or altering its parameters. This attack vector exploits the economic design of many governance systems, where voting power is directly proportional to the number of governance tokens held, without safeguards against transient, debt-financed ownership.
The attack typically follows a specific sequence within one transaction: First, the attacker borrows a massive amount of a governance token (like COMP or AAVE) using a flash loan from a lending protocol. Second, they immediately use these borrowed tokens to vote on a malicious proposal they have previously created. Third, after the vote passes—often because the attacker's borrowed tokens represent a majority—they execute the proposal's payload, which might transfer funds or mint new tokens to an address they control. Finally, the attacker repays the flash loan with a portion of the stolen assets, keeping the remainder as profit, all before the transaction concludes.
A canonical example is the 2020 bZx protocol attack, where an attacker used a flash loan to manipulate oracle prices and subsequently governance mechanisms. More directly, the 2021 Beanstalk Farms exploit saw an attacker use flash loans to borrow enough BEAN tokens to pass a "governance emergency" proposal that transferred $182 million from the protocol's treasury to their wallet. These attacks highlight a critical vulnerability: governance systems that rely purely on token-weighted voting, without time locks on newly acquired tokens or a quorum requirement high enough to resist sudden, large swings in voting power, are susceptible to this form of financial engineering.
Preventing such attacks requires protocol designers to implement defensive mechanisms. Common solutions include introducing a time-weighted voting system, where voting power increases with the duration tokens are held, making borrowed tokens useless for immediate voting. Other measures are enforcing high quorum thresholds that are impractical to meet with transient capital, implementing governance delay (timelocks) on executed proposals to allow community reaction, or using multisig guardians or security councils as a final backstop. These designs aim to decouple raw capital from immediate governance power, ensuring long-term stakeholders, not transient lenders, control the protocol's future.
key-features
ATTACK VECTOR
Key Features of a Governance Flash Loan Attack
A governance flash loan attack is a sophisticated exploit where an attacker uses uncollateralized flash loans to temporarily acquire enough voting power to manipulate a decentralized autonomous organization (DAO) or protocol's governance system.
01
The Core Mechanism: Borrow, Vote, Repay
The attack hinges on the atomic nature of flash loans, which allow the borrowing of a massive amount of assets within a single transaction block, provided the loan is repaid by the block's end. The attacker uses these borrowed funds to:
- Acquire governance tokens (e.g., via a DEX swap).
- Cast a malicious vote or series of votes.
- Repay the flash loan, returning the governance tokens. The entire sequence is atomic—it either succeeds completely or fails and reverts, eliminating financial risk for the attacker.
02
Target: On-Chain Governance
This attack vector specifically exploits protocols with on-chain, token-weighted voting. The attacker's goal is to pass a proposal that benefits them, such as:
- Draining the treasury via a malicious proposal.
- Altering protocol parameters (e.g., fees, collateral factors) to enable other exploits.
- Minting tokens or granting special privileges to the attacker's address. The attack is viable because governance power is directly proportional to the number of tokens held at the snapshot time for a vote, regardless of how briefly they are held.
03
Key Prerequisites for Success
Several conditions must align for this attack to work:
- Low Governance Participation: The protocol's quorum (minimum votes needed) and the cost to acquire a voting majority must be low relative to the potential profit.
- Liquid Markets: Sufficient liquidity must exist to swap the flash-loaned capital for the governance token without excessive slippage.
- Immediate Execution: The malicious proposal's effects must be executable within the same block to realize profit before repaying the loan. This often requires pre-approved, arbitrary code execution via a timelock bypass or similar mechanism.
05
Common Defense Mechanisms
Protocols implement various strategies to mitigate this risk:
- Timelocks: A mandatory delay (e.g., 48-72 hours) between a proposal's passing and its execution, preventing instant exploitation.
- Quorum & Thresholds: Setting high quorum requirements and super-majority thresholds increases the capital cost of an attack.
- Vote Delegation: Encouraging passive token holders to delegate votes to trusted, active participants (delegates).
- Sybil Resistance: Implementing proof-of-personhood or proof-of-stake mechanics to make vote buying harder.
- Separation of Powers: Dividing governance into different houses (e.g., token holders, experts, stakers) to require consensus across groups.
06
Related Concepts & Attack Vectors
Governance flash loan attacks are part of a broader class of governance attacks and economic exploits:
- Vote Buying & Bribery: Colluding with voters or using bribery markets (e.g., Hidden Hand) to influence outcomes.
- Governance Tokenomics: Assessing how token distribution, vesting, and liquidty affect attack surface.
- Flash Loan Arbitrage: The legitimate use of flash loans for risk-free profit, which shares the same atomic mechanism.
- Price Oracle Manipulation: A separate but often related exploit where an attacker manipulates an asset's price to borrow excessively or liquidate positions.
examples
FLASH LOAN (GOVERNANCE ATTACK)
Historical Examples & Case Studies
These case studies illustrate how flash loans have been weaponized to manipulate on-chain governance, exploiting the temporary control of voting power to pass malicious proposals.
05
Common Attack Vectors & Defenses
Analysis of historical attacks reveals recurring patterns and the defenses developed in response:
- Oracle Manipulation: Using flash loans to distort price feeds. Mitigated by using time-weighted average prices (TWAPs) and more robust oracle networks.
- Governance Token Accumulation: Borrowing voting power to pass malicious proposals. Mitigated by introducing governance time-locks, quorum requirements, and delegated voting.
- Logic Exploits: Finding flaws in smart contract math (like the Euler attack). Mitigated through extensive audits, formal verification, and bug bounty programs.
06
The Role of MEV Bots
Maximal Extractable Value (MEV) bots often use flash loans as a core tool, creating a complex ecosystem:
- Arbitrage Bots: Use flash loans to capitalize on price differences across DEXs without capital, a legitimate use case.
- Liquidation Bots: Use flash loans to fund large liquidations of undercollateralized positions.
- Sandwich Attacks: Bots use flash loans to front-run and back-run user transactions, extracting value. While not always malicious, MEV activity demonstrates the dual-use nature of flash loan technology for both efficient market operations and predatory strategies.
security-considerations
FLASH LOAN (GOVERNANCE ATTACK)
Security Considerations & Vulnerabilities
A flash loan governance attack is a sophisticated exploit where an attacker uses uncollateralized flash loans to temporarily acquire enough voting power to manipulate a decentralized protocol's governance system.
01
Core Attack Vector
The attack exploits the fungibility of governance tokens. An attacker borrows a massive quantity of a protocol's governance token via a flash loan, uses those tokens to cast a malicious vote (e.g., to drain the treasury or change critical parameters), and repays the loan—all within a single transaction block. The attack is feasible because governance voting power is often calculated as a simple snapshot of token holdings at voting time, without mechanisms to prevent borrowed capital from influencing decisions.
02
Famous Example: MakerDAO (2020)
In a landmark case, an attacker borrowed 80,000 ETH via flash loans, converted it to MKR governance tokens, and used the voting power to pass a malicious executive vote. The proposal aimed to install a dysfunctional price oracle that would have allowed the attacker to steal collateral. The attack was ultimately thwarted by the Governance Security Module (GSM) delay, a 24-hour timelock that gave the community time to identify and neutralize the threat before execution.
03
Key Vulnerability: Vote Snapshotting
The primary technical vulnerability enabling these attacks is instantaneous vote snapshotting. Many governance systems determine voting power based on a token balance snapshot taken at the moment a vote is cast. Since flash loans exist within one block, the borrowed tokens appear as legitimate holdings. Mitigations include:
- Vote Delegation with Lock-up: Requiring tokens to be locked (e.g., via veToken models) to gain voting power.
- Time-Weighted Voting: Basing power on the average token balance over a period, not an instant snapshot.
- Quorum & Proposal Thresholds: Setting high thresholds that make flash loan attacks economically unfeasible.
04
Defensive Mechanisms
Protocols implement several layers of defense to mitigate flash loan governance attacks:
- Governance Delay (Timelock): A mandatory waiting period (e.g., 24-72 hours) between a vote passing and execution, allowing for emergency intervention.
- Whitelisted Oracles & Critical Parameter Guards: Protecting core functions (like oracle updates) from being changed via a single governance vote.
- Minimum Vote Duration: Ensuring votes last multiple blocks, far longer than a flash loan's lifespan, though this doesn't prevent the initial malicious proposal.
- Separation of Powers: Implementing a multi-sig or security council with veto power over certain high-risk governance actions.
05
Economic & Game Theory Considerations
These attacks highlight a game theory flaw: temporary capital can subvert long-term governance. The cost of the attack is only the flash loan fee (often ~0.09%), while the potential profit is the entire value of the manipulated protocol. Defenses must make the attack cost-prohibitive or impossible, not just difficult. This involves ensuring the capital required to pass a malicious vote exceeds the available liquidity for flash loans or designing governance where borrowed capital cannot acquire meaningful influence.
06
Related Vulnerability: Flash Loan Oracle Manipulation
While distinct from governance attacks, flash loan oracle manipulation is a closely related exploit often used in conjunction. An attacker uses a flash loan to dramatically shift an asset's price on a DEX that serves as a price oracle for a lending protocol. This can create false liquidations or allow borrowing against inflated collateral. Governance attacks sometimes aim to disable oracle safeguards, demonstrating how these vectors can intersect to compromise a protocol's entire security model.
ATTACK VECTOR COMPARISON
Flash Loan Attack vs. Other Governance Attacks
A comparison of key characteristics distinguishing flash loan-based governance attacks from other common governance attack vectors.
| Feature | Flash Loan Attack | Token Whale Attack | Voter Collusion / Bribery |
|---|---|---|---|
Primary Capital Source | Borrowed (uncollateralized) | Self-owned or staked | Coordinated voter stakes |
Capital Requirement | Effectively $0 (repaid in same tx) | Very High (must own large stake) | Moderate (cost of bribery) |
Attack Preparation | Minutes (script deployment) | Months (accumulation period) | Weeks (coordination & proposal) |
Execution Speed | < 1 block (instantaneous) | Slow (across voting period) | Slow (across voting period) |
On-Chain Footprint | Single, complex transaction | Series of votes/token moves | Multiple voting transactions |
Key Vulnerability Exploited | Price oracle / governance math | Pure token weight dominance | Voter apathy / economic incentives |
Capital at Risk for Attacker | Only gas fees + potential premiums | Entire staked token position | Bribe payouts (may be conditional) |
Post-Attack Asset Trail | None (loan repaid, profits extracted) | Large, identifiable token holdings | Bribe payments to voters |
mitigation-strategies
MITIGATION STRATEGIES & DEFENSES
Flash Loan Governance Attack
A flash loan governance attack is a malicious exploit where an attacker uses uncollateralized, instant loans to temporarily acquire enough voting power to manipulate a decentralized autonomous organization's (DAO) governance decisions, often to drain its treasury.
A flash loan governance attack exploits the composability of DeFi by using a flash loan—a loan that must be borrowed and repaid within a single blockchain transaction—to amass a large quantity of governance tokens. The attacker uses these tokens to propose and vote on a malicious proposal, such as one that grants them control of the protocol's treasury. Because the loan is repaid before the transaction ends, the attacker requires no upfront capital, making this a form of economic abstraction where voting power is rented, not owned. The attack vector was first demonstrated in the 2020 bZx and subsequent Harvest Finance exploits.
Mitigating these attacks requires a multi-layered defense strategy. Core technical measures include implementing a timelock on executed governance proposals, which introduces a mandatory delay between a vote's passage and its execution. This delay provides a grace period for the community to identify malicious proposals and execute an emergency shutdown or fork. Another key defense is vote delegation with a cooldown period, which prevents newly acquired tokens from being used for voting immediately, neutralizing the "rented" voting power from a flash loan.
Beyond technical controls, governance parameters must be carefully tuned. Setting a high proposal threshold—the minimum token amount required to submit a proposal—can deter casual attacks. Implementing quorum requirements ensures a minimum level of voter participation is met for a vote to be valid, though this can be gamed. Some protocols adopt conviction voting models, where voting power increases the longer tokens are locked, favoring long-term stakeholders over transient attackers. Multisig guardians or security councils with the power to veto clearly malicious proposals act as a final circuit breaker.
Proactive monitoring and community vigilance are critical non-technical defenses. Using on-chain analytics and governance dashboards to track unusual spikes in token accumulation or voting patterns can provide early warnings. Establishing clear emergency response procedures allows for rapid community coordination in the event of an attack. Furthermore, moving towards minimally extractable value (MEV) resistant designs and considering fee-on-transfer mechanisms for governance tokens can increase the economic cost of executing such an attack, making it less profitable.
FLASH LOAN ATTACKS
Common Misconceptions
Flash loan attacks are often misunderstood as exploits of the loan mechanism itself. This section clarifies the technical realities behind these high-profile governance and market manipulation incidents.
A flash loan governance attack is a manipulation of a decentralized autonomous organization (DAO) where an attacker uses a flash loan to temporarily borrow a massive amount of governance tokens, use that voting power to pass a malicious proposal, and repay the loan—all within a single transaction block. The attack exploits the protocol's governance mechanisms, not the flash loan contract. The core vulnerability is that the protocol's governance system measures voting power at a specific snapshot in time (e.g., the proposal creation block), without considering the transient nature of the borrowed tokens. This allows the attacker to meet a quorum or voting threshold they could never afford legitimately.
FLASH LOAN GOVERNANCE ATTACKS
Frequently Asked Questions (FAQ)
Flash loan governance attacks exploit the ability to borrow large amounts of capital without collateral to manipulate decentralized governance votes. These attacks highlight a critical intersection of DeFi mechanics and protocol security.
A flash loan governance attack is a malicious exploit where an attacker uses a flash loan to temporarily borrow a massive amount of a governance token, uses that voting power to pass a self-serving proposal, and repays the loan within the same transaction. The attacker's goal is to gain control of a Decentralized Autonomous Organization (DAO) treasury or change protocol parameters without any upfront capital. This attack vector exploits the economic design of many governance systems, where voting power is directly proportional to token holdings, without adequate safeguards against transient, borrowed capital.
ENQUIRY
Get In Touch
today.
Our experts will offer a free quote and a 30min call to discuss your project.
NDA Protected
Confidentiality24h Response
Time to ValueDirectly to Engineering Team
No Sales Fluff10+
Protocols Shipped
$20M+
TVL Overall