Skip to content
critical Governance No SWC entry CWE-284

Governance Takeover via Flash-Loaned Voting Power

SAFE-0060 Governance Checked automatically by the scanner
1

What goes wrong

Voting power is read from current token balance, so an attacker flash-borrows governance tokens, creates and/or votes on a proposal, and returns the loan — capturing governance in one block.

2

How to fix it

the pattern that is safe
// ERC20Votes: weight = getPastVotes(voter, proposalSnapshotBlock)
uint256 w = token.getPastVotes(msg.sender, proposals[id].snapshot);
tally[id] += w;
Beanstalk (2022). Use snapshotted voting + timelock.
3

Where this has happened

Incidents this entry cites by name:

Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0060 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs