Ledger LandISSUE #81 of 90

governance attacks · vote buying · proposals

BlockyVSDouble-Spend Dan

Blocky saysGovernance attacks exploit voting — vote-buying, flash-loan votes, and malicious proposals.

On-chain voting has its own attack surface. An attacker can borrow voting tokens via a flash loan to pass a proposal in one transaction, buy votes, or sneak a malicious proposal past inattentive voters (e.g. to drain the treasury). Defenses: voting delays/timelocks, snapshot-based voting power, quorums, and vote-escrow (locking tokens). Governance is a security domain, not just politics.

Power-ups you unlock

Flash-loan votes pass proposals in one tx
Vote-buying and malicious proposals
Drains often target the treasury
Defenses: timelocks, snapshots, quorums, vote-escrow

Double-Spend Dan attacks — common mistakes

Voting power read live (flash-loan exploitable)
No timelock between passing and executing
Low quorum letting tiny groups decide

Boss battleExplain how snapshot voting power blocks a flash-loan governance attack.

Example code

<!doctype html><html><head><meta charset="utf-8"></head>
<body style="background:#06040d;color:#e6e0ff;font-family:monospace;padding:20px"><pre>flash-loan tokens → vote → repay, all in 1 tx
defense: snapshot power at an earlier block
         + timelock before execution</pre></body></html>

▶ Open the interactive comic issue

‹ Dao Governance · Token-Weighted · Quadratic Tokenomics · Supply · Vesting · Incentives ›