# TOPBPool: governance vote mints 10B TOP, drains Balancer pool

Attacker used a historical TOP snapshot balance to pass an Aragon vote minting 10B TOP, then dumped into Balancer BPool for 944 WETH.

- Payout: Real-world hack
- Severity: critical
- Program: TOPBPool
- Credited: DeFiHackLabs
- Disclosed: 2026-06-09
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-06/TOPBPool_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260609-topbpool
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity vuln:access-control vuln:business-logic

**Target:** Aragon Voting + TokenManager + Balancer BPool
**Root cause:** Voting power was based on a historical snapshot balance, allowing an address with a pre-attack TOP balance to pass a malicious proposal in the same transaction. TokenManager.mint was callable via governance execution without additional checks.
**Steps:**
1. Attacker contract at 0x25c68c44... holds 8,192 TOP from snapshot supply of 16,384 TOP.
2. Call `ITokenManager.forward(buildNewMintVoteScript())` to create a vote whose execution script calls `mint(address(this), 10_000_000_000 ether)` on TokenManager.
3. Call `IVoting.vote(voteId, true, true)` to vote yes and execute immediately, using the snapshot balance to meet quorum.
4. Approve BPool for max TOP and loop: `amountIn = getBalance(TOP)/2` (capped by balance), call `swapExactAmountIn(TOP, amountIn, WETH, 0, max)` until TOP balance is zero.
5. Transfer all WETH from attack contract to attacker EOA.
**How found:** Likely identified that voting power was snapshot-based and that a single address held enough historical TOP to pass a proposal, then crafted a governance transaction to mint tokens and dump them into the Balancer pool.
**Exploitation:** Attacker deployed a contract that created an Aragon vote to mint 10 billion TOP to itself, voted it through using a historical snapshot balance, then sold the minted TOP into the Balancer BPool in repeated swaps, draining 944.20 WETH.
**Insight:** Check if governance voting power uses historical snapshots and whether a single holder can pass a proposal in one transaction; also look for mint functions callable via governance execution without timelock or quorum checks.