Governance Attack

An exploit where an attacker accumulates enough governance-token voting power to pass a malicious proposal — typically draining the protocol's treasury, minting unlimited tokens, or upgrading contracts to attacker-controlled addresses. The Beanstalk Farms attack in April 2022 ($182 million) used a flash loan to borrow enough BEAN governance tokens to push an emergency proposal that transferred the protocol's treasury to the attacker, all within a single transaction. Defences include token-holding timelocks on voting power, mandatory delay between proposal and execution, and emergency veto mechanisms held by a multisig.