defirisk.co
rubric v1.7.0

Quorum achievable via single-entity flash loan

A governance & admin factor in the v1.7.0 rubric. Measured per protocol on a s cadence.

Methodology how we score#

What this measures
This factor evaluates whether the total quorum required for a governance vote is achievable by a single entity using a flash loan in the governance token. The assessment compares the governance quorum threshold (in token units) against the maximum single-transaction borrowable depth in the governance token across all major flash loan venues (Aave, Uniswap, Balancer) at the reference block. If the largest flash-loanable notional exceeds the quorum threshold, the flash-loan attack is theoretically viable from a capital standpoint.

Why it matters
Even when voting power requires a balance snapshot rather than a spot balance (which is assessed under RD-F-036), quorum achievability via flash loan identifies a second-order risk: a protocol where quorum is denominated in a token that is deeply liquidity-pooled may face governance attacks that are cheap enough to be economically viable for a well-capitalized attacker. This factor is subordinate to RD-F-036 — it is most relevant for protocols that use snapshotted voting but have a quorum threshold that is very low relative to flash loan depth.

Green / Yellow / Red
Green is assigned when the quorum threshold exceeds the maximum flash-loanable notional in the governance token by at least 5x, or when the governance token is not flash-loanable on any major venue. Yellow covers cases where the threshold is 2–5x the maximum flash loan depth. Red is assigned when the quorum threshold is achievable or nearly achievable (within 120% of) via a single flash loan transaction.

Common gray cases
This factor is grayed when the governance token is not listed on any venue offering flash loans, or when quorum is denominated in a non-transferable token (vote-locked positions, time-weighted balances).

Notable historical examples
No cross-hacked incidents currently linked in database for this factor.

Measurement what to look for#

Determine whether the governance quorum threshold is ≤ the largest available flash-loan notional in the governance token at reference DEX depth.

Data & output #

Data source
Governance contract `quorumNumerator()` or equivalent + governance token total supply + Uniswap/Aave/Balancer flash-loan pool depth via subgraph
Output format
Green / Yellow / Red
Evidence artifact
Quorum threshold % + token supply + flash-loan depth (USD) + derived comparison
Confidence signal
green = quorum materially exceeds max flash-loan depth; yellow = quorum within 2× of flash-loan depth; red = flash-loan alone can reach quorum; gray = no on-chain governance or governance token not flash-loanable

Scored protocols 0 carry this factor#

No protocols have been scored for this factor yet.

Linked hacks no historical incidents linked#

No historical incidents are linked to this factor.
rubric_version v1.7.0factor RD-F-037category 2carried 0critical no