Unit 4 · Level 4 · DAOs & governance
Attacking the vote
In April 2022, the DeFi project Beanstalk was robbed by democracy. An attacker used a flash loan to borrow a mountain of governance tokens, voted through a proposal that sent treasury funds to their own wallet, and repaid the loan, all in a single transaction. The protocol lost roughly $180 million; the attacker walked with about $76 million. The vote was perfectly valid. That's the scary part.
Free to play. No ads, no token, no account needed to start.
What you get asked
How did the Beanstalk attacker win the governance vote?
Flash loans grant anyone millions for the length of one transaction. If voting power can be borrowed and used instantly, the treasury is for rent.
What is 'whale capture' in DAO governance?
Token-weighted voting means governance mirrors the holder chart. If three wallets hold a majority, the 'community vote' is a courtesy.
When only a tiny fraction of tokens actually vote, low ___ lets small groups decide for everyone.
Single-digit turnout is common even in big DAOs. Whoever bothers to show up governs, a rule as true on chain as in city elections.
Reconstruct the flash-loan governance attack
Beanstalk's fatal flaw was letting proposals execute immediately. Borrowed conviction met instant execution.
Why do well-designed DAOs put a timelock between a vote passing and executing?
A delay turns a 13-second heist into a public warning: honest holders can exit, veto, or fork before the code moves the money. In governance, speed is a vulnerability. 🐜
The rest of this unit
Token votes, treasury raids, and finding out who really holds the keys.