Curriculum·J308 Governance, DAOs, and Airdrop Economics·about 31 min
Governance as an attack surface
By the end of this lesson you can
- →Distinguish acquiring the votes from changing the payload, which are different attacks
- →Compute whether capturing a protocol costs less than the treasury it controls
- →Explain why a vote snapshot taken before submission defeats borrowed voting power
- →Identify the execution guarantee that makes an approved proposal the executed one
Junior · enrolled learners
This lesson opens with The Tornado Cash governance takeover, 20 May 2023.
- What happened
- A proposal was submitted that appeared to penalize participants who were cheating the protocol's rewards. The proposer had included an additional function in the proposal contract. After the vote passed, the attacker destroyed that contract and deployed different code at the same address, so that when governance executed the approved proposal by delegate call, the code that ran was not the code that had been reviewed. The executed code assigned 10,000 governance tokens to each of a set of addresses the attacker controlled, producing 1.2 million votes against an existing legitimate electorate of roughly 70,000 votes. The attacker drained 483,000 TORN, about $2,173,500, from the governance vaults. On 26 May they submitted a proposal restoring control to the original holders, which passed with 517,000 votes in favor and none against.
- The decision point
- Voters approved an address, and the contents of that address changed after the approval. That is a different attack from buying a majority, and it defeats every defense aimed at vote concentration, because the vote itself was legitimate. The guarantee a governance system needs is not only that the right people voted, but that the thing executed is the thing that was voted on, and an address is not a commitment to any particular code unless the system makes it one.
- Recorded loss
- $2,173,500
What you will be able to answer
- →What are the two governance attack classes?
- →When is capturing a protocol profitable?
- →Why does a pre-submission snapshot defeat flash loans?
- →What did the attacker's votes outnumber?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://www.halborn.com/blog/post/explained-the-tornado-cash-hack-may-2023
- https://www.theblock.co/post/231637/attacker-uses-malicious-proposal-to-take-over-tornado-cash-governance
- https://www.coindesk.com/tech/2023/05/21/attacker-takes-over-tornado-cash-dao-with-vote-fraud-token-slumps-40
- https://medium.com/immunefi/hack-analysis-beanstalk-governance-attack-april-2022-f42788fc821e
Confidence high·Volatility medium·Reviewed 2026-08-06·Owner unassigned
Contested
The restoration proposal passing unopposed is unusual and does not generalise. Per J301-05 recovery in this sector is a discretionary act by somebody else, and citing the cases where that went well is how the category acquires a reputation for recoverability it has not earned.
J306-02 covers upgrade authority and timelocks from the contract side. This lesson covers the governance process as a target. The two overlap at the timelock and are treated from different directions deliberately.