What happened
Beanstalk's Ethereum governance system was exploited on April 17, 2022 through temporary voting power funded with flash liquidity. Security analyses estimated roughly $181 million in gross protocol-value impact, while Beanstalk's own disclosure described about $77 million in non-BEAN user assets taken. Those figures use different measures and are not added together.
Beanstalk derived emergency governance power from current deposits and allowed emergency execution once a two-thirds threshold was reached, without an independent snapshot or execution delay after that voting state was acquired. Flash liquidity could therefore create enough temporary voting power to authorize attacker-supplied proposal logic. Governance systems must make voting power time-aware and apply independent delay and review controls to privileged execution paths.
Case & protocol details
Attack Timeline
The attacker prepared governance proposals in advance, then borrowed more than $1 billion in temporary liquidity within one transaction. They created BEAN3CRV-f and BEAN3LUSD-f LP positions, deposited them into Beanstalk's Silo, and obtained more than two-thirds of Stalk voting power. With that temporary voting weight, the attacker called GovernanceFacet.emergencyCommit(BIP-18).
The proposal's supplied logic executed through the Diamond contract's delegatecall and initialization path, enabling withdrawal of treasury and Silo assets. The attacker then unwound the positions to repay the flash loans.
Evidence & learning
Attack pattern
Compare incidents →Proof of concept
1 availableSources and on-chain records
- report Post-mortem rekt.news
- report Post-mortem medium.com
- report Report twitter.com
- report Governor DAO Beanstalk governance exploit post-mortem docs.governordao.org
- transaction Transaction etherscan.io
- transaction Transaction etherscan.io
- analysis Twitter/X Alert twitter.com
- analysis Website reference bean.money
- analysis Blog reference blog.defiyield.app
- analysis Website reference twitter.com
- analysis Beanstalk disclosures docs.bean.money
- analysis Immunefi Beanstalk governance attack analysis immunefi.com
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.