Vulnerabilities

Flash Loan Governance Attack

A flash loan governance attack uses borrowed voting power to influence or execute governance actions before the loan is repaid.

An attacker borrows votes for a moment and uses them to push through a harmful decision.

Flash Loan Governance Attack Explained in Detail

In a flash loan governance attack, the attacker borrows governance tokens, uses them to vote or trigger a governance action, and repays the loan quickly. The attack works when governance measures voting power at the wrong time or has weak timing controls.

Snapshots, voting delays, and timelocks are common defenses.

Smart contract example

borrow votes -> vote or execute -> repay loan

If all steps can happen in one transaction or short window, governance is exposed.

Flash Loan Governance Attack in Auditing

Governance power should usually reflect durable economic stake, not momentary borrowed balances. If current balances decide voting, flash liquidity can distort control.

Auditors test whether voting power can be borrowed, delegated, and used before users can react.

Red flags in code

  • Voting uses current token balances instead of snapshots.

  • There is no voting delay.

  • There is no timelock before execution.

  • Quorum is low relative to available liquidity.

  • Governance token transfers and delegation can be abused around votes.

How to test or review it

  • Borrow or simulate a large temporary token balance.

  • Try propose, vote, queue, and execute in the shortest allowed path.

  • Check snapshot block behavior.

  • Test delegation timing.

  • Verify timelock delay gives users time to exit or respond.

Flash Loan Attack

A flash loan attack uses same-transaction borrowing to amplify an existing DeFi vulnerability, usually in pricing, collateral, governance, or accounting.

Governance Attack

A governance attack is an exploit where an attacker gains or abuses proposal, voting, execution, or admin power in a governance system.

DAO Governance

DAO governance is an on-chain or hybrid decision process where token holders, delegates, multisigs, or members control protocol actions.

Practice this in real audit scenarios

Definitions help, but auditors need reps. SCH turns concepts like Flash Loan Governance Attack into exploit labs, code review habits, and report-writing practice.

Start the free trial or see the full smart contract auditing course.

Sources