# Flash-loan governance takeover

Can voting weight be acquired and used to execute a proposal in one transaction or block?

_Area: DeFi oracles, liquidations and flash loans. Seen in 5 disclosed reports; latest 2024-09-16. Updated 2026-10-23._

## How it works
Governance assumes voting power reflects durable, at-risk ownership. That assumption breaks when weight can be acquired and spent inside a single transaction or block: a flash loan supplies the capital, the attacker votes or finalizes, executes, and repays from the proceeds before the loan must be returned. The root cause is the absence of a time or snapshot boundary between acquiring weight and using it.

## Where it shows up
- Vote-weight snapshot and execution reachable in the same block/transaction.
- Emergency or fast-path commit functions that count votes and execute immediately.
- Execution paths that delegatecall proposal-supplied targets or calldata.
- Finalization triggered automatically when a contribution cap is exceeded.
- Treasury distribution callable with no cooldown after finalization.
- Weight getters that read per-token state without the same-block transfer guard used elsewhere.

## How to review
The invariant: weight used to vote or execute must have been held before the current block, and execution must not be repayable from the same transaction's proceeds. Check every getter feeding governance for a same-block acquisition guard, and confirm snapshotting happens at a block strictly prior to execution. Verify no execute path delegatecalls attacker-controlled targets. Confirm distribution or withdrawal has a delay separating it from finalization.

## Variants seen
- Emergency commit counts a flash-loaned supermajority and executes a malicious proposal in one transaction, with delegatecall to attacker code [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-hack-analysis-beanstalk-governance-attack-april-2022.md).
- Flash-loaned crowdfund contribution exceeds the cap, finalizes instantly, grants majority power, and is repaid from same-block distribution [E2](https://bugbountylibrary.com/r/c4%3A2023-04-party%3AH-02.md).
- Voting-power getter omits the same-block ownership check present in the balance getter, so a flash-loaned NFT votes immediately [E3](https://bugbountylibrary.com/r/cantina%3Azerolend_jan2024%3A3.2.11.md).

## Impact and severity
Critical: E1 drained ~$181M via arbitrary execution; E2 and E3 grant full governance control. Severity rises with treasury size, instant finalization, and delegatecall execution. Missing same-block guards on any one getter are enough to defeat protections added elsewhere [E3](https://bugbountylibrary.com/r/cantina%3Azerolend_jan2024%3A3.2.11.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-hack-analysis-beanstalk-governance-attack-april-2022.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-04-party%3AH-02.md
- E3: https://bugbountylibrary.com/r/cantina%3Azerolend_jan2024%3A3.2.11.md