Skip to content
THREATWIRE

DeFi Security · Vulnerability class

Governance takeover

An attacker acquires enough voting power, cheaply or by exploiting thin participation, to pass a proposal that hands over contracts or funds.

DatabaseIncidentsChainsProtocolsVulnerabilities

The concept

A vote is only as strong as the cost of winning it. Thin tokens, low participation, short timelines and governance that can reach contracts it does not own turn voting power into a root key.

Defensive lessons

  • Price the attack: what does it cost to win a vote versus what the vote controls.
  • Add delays and veto windows after a vote passes.
  • Limit what governance may touch.
  • Watch for last-minute large stakes.

Stored incidents