# Flash loans can affect governance voting in DAO.sol

DAO.sol counts votes using current token balance, so a flash-loaned token balance inflates a voter's weight and can swing governance outcomes.

- Payout: Audit contest
- Severity: high
- Program: Vader Protocol
- Disclosed: 2021-06-14
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-04-vader-findings/issues/187
- Library page: https://bugbountylibrary.com/r/c4%3A2021-04-vader%3AH-05
- Tags: area:web3 domain:web3 kind:contest platform:code4rena sev:high tech:evm tech:solidity vuln:business-logic vuln:flash-loan vuln:governance

**Target:** DAO.sol governance voting (countMemberVotes)
**Root cause:** countMemberVotes() derives voter weight from the voter's token balance at vote time rather than a prior-block snapshot, so borrowed tokens count toward voting weight.
**Steps:**
1. Obtain a large quantity of governance tokens via flash loan within a single transaction.
2. Call the DAO vote function so countMemberVotes() reads the inflated balance as voting weight.
3. Cast the vote to deterministically influence the outcome, then repay the flash loan in the same transaction.
**How found:** Observed that countMemberVotes() uses live balances, recalled the prior MakerDAO flash-loan governance incident, and reasoned borrowed tokens could inflate a single voter's weight.
**Exploitation:** A voter borrows a large token quantity in one transaction, votes with the inflated weight to force the desired outcome, and repays the loan before the transaction ends; judge noted funds need not come from a pool—colluding members can pool funds in a flash-loan contract and borrow in turn to vote.
**Escalation:** Governance controls all critical protocol parameters, so a swung vote can alter protocol configuration.
**Insight:** When auditing DAO voting, check whether vote weight reads live balances or a prior-block snapshot; any same-transaction balance read is flash-loanable even if the protocol's own pools use slip-based fees, since attackers can source capital elsewhere.