The leaks · 50 / 86 · 2 min
Governance attacks
If voting power is a token, someone can buy or borrow enough votes to pass a proposal that sends them the treasury. The vote was valid. The outcome was a theft.
The vote followed the rules. The outcome was still a theft.
A worked case
A treasury looks protected because it requires a vote. An attacker borrows voting tokens for a day, passes a payment to themselves, and returns the tokens. The vote was valid under the rules they wrote.
How the vote gets bought
They borrow the token, vote, pass a transfer, and return the token. Or they simply buy a tired, low-turnout vote. Quorum was met. Holders who were not looking paid for it.
The check
Who can propose. How long a vote must wait before it executes. Whether borrowed tokens can vote. A treasury with no delay is a wallet with extra steps.
A governance token is not a parliament. It is a key that can be rented.
A valid vote
If voting power is a token, the person who can borrow the most tokens for a day can pass a proposal. In April 2022 Beanstalk, a protocol that held a treasury and governed itself with a token, lost on the order of 180 million dollars after a proposal passed and sent the funds out. Contemporary reporting described borrowed votes. The vote followed the rules the protocol had published. The outcome was a theft. This page will not say how the borrowing was arranged.
The DAO had already shown the softer version: a lot of money, a rule people did not weight, a loss the chain recorded. Governance tokens sold in later years often promised ownership. Ownership that can be rented for an afternoon is not a lock on the treasury. It is a suggestion, priced by whoever needs it today.
Before you call a token a share, read how fast a proposal can pass and whether the treasury moves in the same transaction as the vote. If it can, the delay you wanted does not exist.
Read it yourself
These links are the record. They are not a recommendation, and they are not instructions. A news story or a court paper can still be wrong about a detail. The check does not change because a famous name is in the story.
Apply the check
Open a question. The line is about this topic. It is not a verdict that anything is safe.
The proposer who receives the treasury.
Whoever can buy or borrow enough votes.
That proposal, once it passes. The voters who sold or lent their votes helped.
Check yourself
If a vote passed, was the treasury safe?
Not if the voters could be borrowed for an afternoon and the transfer was immediate.
After this you can look for a delay between a vote and the movement of the treasury.