Governance Security
Governance security covers the protection of on-chain governance systems — voting, proposals, timelocks, and quorum mechanisms — against manipulation and unauthorized execution.
In Depth
On-chain governance lets token holders vote on protocol changes, but the mechanisms that enable decentralized decision-making also create attack surface. Flash loan voting is the most dramatic example: an attacker borrows millions of governance tokens in a single transaction, votes to pass a malicious proposal, and returns the tokens — all in one block. Proposal manipulation can sneak harmful code into what looks like a routine parameter change. Timelock bypasses let attackers skip the delay that's supposed to give the community time to react. Quorum gaming exploits low participation by passing proposals when most token holders aren't paying attention. Effective governance testing verifies that voting power can't be inflated within a single block, that proposal execution respects timelock delays, and that quorum thresholds can't be circumvented. Invariant testing can check these properties across millions of vote, propose, and execute sequences. For related patterns, see smart contract security and access control.
Frequently Asked Questions
What are common governance attacks?
The most common attacks are flash loan voting (borrowing tokens to pass a malicious proposal in one transaction), proposal manipulation (hiding harmful code in routine upgrades), timelock bypasses that skip the safety delay, and quorum gaming that exploits low voter turnout to pass proposals that wouldn't survive full participation.
How do you test governance contracts?
We write invariant tests that verify properties like 'voting power can't change within a single block,' 'proposals can't execute before the timelock expires,' and 'quorum can't be reached with flash-borrowed tokens.' The fuzzer then runs millions of propose-vote-execute sequences with different actors and timing to break these properties.