★Flash-loanable voting weight
A governance & admin factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score#
What this measures
This factor tests whether a protocol's governance system allows current token balance — rather than a snapshotted or time-locked balance — to determine voting weight. When voting power is calculated at the moment of the vote using a transferable token with no minimum lock period and no historical-balance checkpoint, any holder of a flash loan facility can borrow enough tokens to achieve quorum, pass a malicious proposal, and repay the loan within a single transaction.
Why it matters
Flash loan governance attacks represent one of the most structurally dangerous attack patterns in DeFi because they convert a temporary capital position into a permanent governance outcome. A timelock "doesn't stop transactions from being confirmed — it simply broadcasts the action prior to its execution," per OpenZeppelin, meaning that even a timelock can be circumvented if voting power is not locked before the proposal is cast. Beanstalk's $182M loss in 2022 remains the canonical case: the attacker borrowed governance tokens via a flash loan, passed a malicious proposal granting themselves full treasury access, and executed the drain — all within one Ethereum block. The attack was architecturally certain once the protocol chose spot-balance voting with no lock requirement.
Green / Yellow / Red
Green is assigned when governance voting power is determined by a balance snapshot taken at a block prior to proposal submission (ERC20Votes/Compound-style checkpoint), or when tokens must be locked for a minimum period before counting toward quorum. Yellow covers protocols that use checkpoints but with a window of less than one block, or where checkpointing can be bypassed via delegation. Red is assigned when voting weight is determined by current token balance at the time of the vote, with no lock, no snapshot, and a transferable governance token accessible via flash loans.
Common gray cases
This factor is grayed when governance is off-chain (Snapshot-only) with no on-chain execution, or when the governance token is not listed on any venue that offers flash loans at meaningful depth.
Notable historical examples
- Sonne Finance ($20M, 2024): Permissionless governance execution window with insufficient delay enabled attacker to front-run market activation after proposal passed.
- Radiant Capital (1st incident) ($4.5M, 2024): Governance-activated empty market with a 6-second execution window exploited via front-running.
★ Critical factor
This factor alone is sufficient to trigger a D or F grade under rubric v1.5 — a single red assessment here overrides all other category scores. Flash-loanable voting weight eliminates the economic cost of a governance takeover, reducing the attack to a single-block transaction regardless of the protocol's TVL or audit history.
Measurement what to look for#
Determine whether governance voting power is a function of current token balance of a transferable token with no lock or checkpoint, making it flash-loan susceptible.