defirisk.co
rubric v1.7.0

Flash-loanable voting weight

Balancer (v2 + v3)'s assessment for RD-F-036 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

veBAL (0xC128a9954e6c874eA3d62ce62B468bA073093F25) uses vote-escrow with checkpoint-based historical balance via balanceOfAt(address, block). Voting power is time-locked, decays linearly. Smart contract depositors are explicitly disallowed. Governance is Snapshot off-chain — no on-chain governor contract that could be flash-loan attacked. Flash-loan voting attack is architecturally impossible.

Sources #

Methodology #

Determine whether governance voting power is a function of current token balance of a transferable token with no lock or checkpoint, making it flash-loan susceptible.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol balancer factor RD-F-036 score green collected_at 2026-05-05 12:41:36