A treasury proposal promises a routine grant, but its encoded calls also approve an unfamiliar contract to spend every treasury token. Voters must diagnose whether the danger comes from malicious code, misleading presentation, weak review, or concentrated execution power. A governance attack manipulates a decision process or privileged control to produce an unintended outcome, sometimes by using formally valid rules after their economic or procedural assumptions fail.
Defense begins by mapping what an attacker must control at each stage. Proposal creation, voting snapshots, quorum, counting, timelock queues, multisig execution, upgrades, and emergency cancellation all have distinct failure modes. Layered safeguards aim to increase attack cost, improve detection, and create response time without making legitimate governance so slow or exclusive that it stops functioning.
What you will learn
- Classify attacks against voting power, proposal content, execution authority, and social process
- Explain how snapshots, proposal thresholds, timelocks, and constrained emergency powers interact
- Assess defenses through both security value and governance tradeoffs
Temporary power can become permanent control
If a system measures balances at a manipulable time, an attacker may borrow, purchase, or aggregate enough tokens to pass a valuable proposal, then unwind the position after execution. Flash loans are one dramatic source of temporary capital, but ordinary lending, derivatives, and coordinated custody can create similar exposure. The core issue is whether decision power requires durable economic commitment.
Historical snapshots, delegation checkpoints, proposal deposits, voting delays, and longer holding periods can make rapid acquisition harder. Each has costs. Early snapshots prevent participants from responding to new information, deposits can exclude smaller proposers, and long commitments reduce capital flexibility. A defense should address the identified path rather than adding friction without a threat model.
The proposal itself can be the exploit
A proposal may hide harmful calldata behind reassuring prose, combine a popular action with an unrelated transfer, or exploit a governance contract's permission to upgrade critical components. Complex batch transactions are difficult for voters to inspect. Interface summaries can also omit delegate calls, approvals, or parameter interactions that change the practical effect after execution.
Defenses include standardized templates, independent code review, simulations, decoded calls, test results, and a requirement that executable payloads remain stable during the voting window. Material changes should restart review rather than appear near the deadline. Human-readable intent and machine-readable actions must be reconciled, because either one alone gives an incomplete security picture.
Execution keys and emergency powers are targets
Multisig signers, timelock administrators, guardians, and upgrade councils may control routes around ordinary voting. Attackers can compromise devices, deceive signers, exploit weak thresholds, or pressure a small group. Even without compromise, insiders can exceed a vague emergency mandate. Effective security inventories every privileged role and tests whether one coalition can control several supposedly independent layers.
Controls include hardware-backed keys, signer separation, transaction simulation, rate limits, narrow permissions, onchain monitoring, rotation, and rehearsed incident procedures. Emergency authority should define eligible events, action scope, duration, reporting, and removal. A guardian that can indefinitely replace governance may reduce technical risk while creating political capture, so the defense itself needs governance constraints.
Common misconceptions
“Governance attacks always exploit a bug in smart-contract code.”
Attackers can follow valid rules while exploiting temporary voting power, low turnout, opaque proposals, bribery, or concentrated execution authority.
“A timelock prevents a malicious proposal from causing harm.”
A timelock creates time for detection and response, but harm proceeds if nobody monitors, users cannot react, or cancellation authority is ineffective.
Risks and limitations
- Borrowed or rapidly assembled voting power can pass an extraction proposal when snapshots and execution timing are poorly designed.
- Opaque calldata can perform approvals, upgrades, or transfers that voters did not understand from the proposal summary.
- Compromised or colluding signers can use emergency or treasury permissions outside the ordinary governance path.
- Anti-attack controls can entrench incumbents by making proposals too expensive, slow, or technically demanding for ordinary participants.
Key takeaways
- Model attacks across proposal, vote, queue, execution, and privileged-control stages.
- Require readable specifications, decoded calldata, simulations, and independent review for consequential actions.
- Use timelocks with active monitoring and a constrained, accountable response path.
- Separate privileged keys and test whether the same people control multiple defenses.
- Evaluate security friction for its effect on legitimate access and incumbent power.
Primary and further reading
Test your understanding
Score at least 2 out of 3 to complete this lesson. Explanations appear after you submit.