Governance Attack

DeFi protocols use governance tokens to decentralize decision-making: token holders vote on protocol upgrades, parameter changes, and treasury spending. A governance attack occurs when an adversary acquires enough voting power to pass a proposal that benefits them at the expense of other users.

The most dramatic example is the Beanstalk attack in April 2022. The attacker used a flash loan to borrow $1 billion in assets, acquired enough BEAN governance tokens to reach the proposal threshold, passed a malicious proposal to drain the protocol's funds, and repaid the flash loan — all in a single transaction. According to Rekt.news, the attack resulted in approximately $182 million in losses.

Governance attacks can also be slower: an entity gradually accumulates tokens to control voting, then pushes through favorable proposals. The Compound governance scare in 2024, where a group accumulated enough COMP to pass a controversial treasury allocation, demonstrated that even established protocols are vulnerable.

Defenses include: timelocks (delay between proposal approval and execution, giving users time to exit), vote escrow mechanisms (requiring tokens to be locked for voting weight, increasing attack cost), quorum requirements, and guardian multisigs that can veto malicious proposals. For investors, evaluating a protocol's governance security is as important as auditing its smart contracts — a perfectly coded protocol with weak governance can still be drained.