# StrongBlock: governance takeover via cheap vote-buying drains reserve

Abandoned StrongBlock Governor captured by buying cheap STRNGR votes, passing a proposal to seize the ProxyAdmin, then upgrading StrongPoolV5 to drain ~$72K reserve.

- Payout: Real-world hack
- Severity: critical
- Program: StrongBlock
- Credited: DeFiHackLabs
- Disclosed: 2026-08-05
- Write-up quality: 8/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-08/StrongBlock_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260805-strongblock
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:recon technique:source-review vuln:access-control vuln:business-logic vuln:governance

**Target:** Compound GovernorAlpha-style Governor + ProxyAdmin (Upgrader) + StrongPoolV5 proxy
**Root cause:** Governor is admin of the Upgrader (ProxyAdmin for all StrongBlock proxies) and quorum was only 200,000 votes; StrongPoolV5.mineForVotesOnly credits staked STRNGR to vote weight 1:1, so voting power was cheaply purchasable on the open market after the DAO was abandoned.
**Steps:**
1. Swap 22 ETH -> ~200,984 STRNGR on Uniswap V2 STRNGR/WETH pair
2. Call `StrongPoolV5.mineForVotesOnly(200984e18)` to credit minerVotes 1:1
3. Call `Governor.propose([Upgrader],[0],["setPendingAdmin(address)"],[attacker],"1")`
4. Call `Governor.castVote(1,true)` — forVotes ~200,984 > quorum 200,000
5. Call `unmineForVotesOnly` and swap STRNGR back to ETH
6. After voting period, `Governor.queue(1)` then `Governor.execute(1)` sets Upgrader.pendingAdmin=attacker
7. Call `Upgrader.acceptAdmin()` to become admin
8. Call `Upgrader.upgrade(service, malImpl)` then `service.run()` to sweep STRONG+STRNGR
**How found:** Recognized the Governor was the Upgrader's admin and that quorum (200,000) was low relative to cheaply purchasable STRNGR vote weight via mineForVotesOnly; abandoned DAO meant no community to contest the proposal.
**Exploitation:** Self-funded: buy STRNGR on Uniswap V2, mine for votes, submit proposal targeting Upgrader.setPendingAdmin(attacker), vote, wait out voting period, queue, execute. Governor (as Upgrader.admin) sets pendingAdmin; attacker accepts admin, upgrades StrongPoolV5 proxy to malicious implementation, calls run() which transfers the proxy's STRONG and STRNGR balances to the caller. ~32,695 STRONG + ~383,447 STRNGR (~$72K) drained.
**Escalation:** Governor being admin of the ProxyAdmin for every StrongBlock proxy means one proposal grants upgrade rights over all proxies, not just the service.
**Insight:** On abandoned/low-liquidity DAOs, check whether the Governor is the ProxyAdmin of live proxies and whether vote weight can be minted 1:1 from a cheaply purchasable token; compare quorum to the cost of buying that weight on the open market.