Voting power is read from a token's current balanceOf (or totalSupply) at execution time instead of a historical snapshot/checkpoint. An attacker flash-borrows the governance token, votes with the borrowed weight, and returns it in the same transaction.
// 1. flashloan 1M GOV // 2. governance.castVote(proposalId, FOR) // weight = balanceOf now = 1M // 3. repay flashloan (all in one tx) -> proposal passes with borrowed votes
// snapshot voting power at proposal creation (ERC20Votes / getPastVotes)
uint256 weight = token.getPastVotes(voter, proposal.startBlock);
Incidents this entry cites by name:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0136 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.