# BuildFinance: hostile governance takeover drains DAO treasury

Attacker acquired enough BUILD tokens to pass a governance proposal that approved their address to drain the BuildFinance DAO treasury.

- Payout: Real-world hack
- Severity: high
- Program: BuildFinance
- Analysis by: DeFiHackLabs
- Disclosed: 2022-02-14
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-02/BuildF_exp.sol
- Library page: http://bugbountylibrary.com/r/dhl%3A20220214-buildf
- Tags: area:web3 domain:web3 impact:funds-loss impact:integrity kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:governance

**Target:** BuildGovernance DAO contract on Ethereum mainnet
**Root cause:** Governance voting power was purchasable/borrowable on the open market, letting an attacker accumulate enough BUILD to pass an arbitrary proposal. The proposal executed an ERC20 approve() granting the attacker unlimited allowance over the DAO's BUILD holdings.
**Steps:**
1. Acquire ~101.5e18 BUILD tokens (attacker address 0x562680a4dC50ed2f14d75BF31f494cfE0b8D10a1).
2. `build.approve(address(BuildGovernance), type(uint256).max)`.
3. Call `BuildGovernance.propose(0x6e36556B3ee5Aa28Def2a8EC3DAe30eC2B208739, 0, hex"095ea7b3...b4c79dab8f259c7aee6e5b2aa729821864227e84ffffffff...")` — an approve() of max allowance to attacker EOA 0xb4c79dab8f259c7aee6e5b2aa729821864227e84.
4. Vote yes on proposal 8 from a second address holding BUILD (0xf41c13f4E2f750408fC6eb5cF0E34225D52E7002).
5. Warp past the 2-day voting period until proposal state is executable.
6. Call `BuildGovernance.execute(8, ...)` with the same approve() calldata.
7. `build.transferFrom(address(BuildGovernance), address(this), build.balanceOf(address(BuildGovernance)))` to drain the treasury.
**Exploitation:** Attacker accumulated BUILD tokens (likely bought/borrowed on market), submitted a proposal whose target was the BUILD token itself with calldata approving the attacker's EOA for uint256.max, voted it through with a second controlled address, waited out the timelock, executed, then pulled the DAO's entire BUILD balance via transferFrom.
**Insight:** Low-float governance tokens are cheap to accumulate; check whether a proposal can target the governance token itself (approve/transfer) and whether voting power can be flash-borrowed or bought below treasury value.