Governance risk
how token voting systems can be attacked
Governance attacks do not require code exploits. Flash loan votes, concentrated token distribution, and absent timelocks are all governance design failures that allow a protocol to be drained or redirected without touching a single contract bug.
Analyse a protocolGovernance structure · timelock detection · token distribution · EVM
Every scan is powered by the XemaS Semantic Intelligence Platform · answers carry their evidence and coverage state
Governance is an attack surface separate from code
On-chain governance gives token holders the power to change protocol parameters, upgrade contracts, and direct treasury assets. A well-designed governance system distributes this power and protects against unilateral actions. A poorly designed one hands an attacker the keys to the protocol once they accumulate enough tokens.
Governance attacks are distinct from smart contract exploits. The attacker does not need to find a code bug. They need to acquire voting power and propose an action that benefits themselves. Flash loans can make this temporarily possible for protocols that do not use snapshot voting. Accumulated tokens make it permanently possible for protocols with concentrated distributions.
The governance structure of a protocol determines whether users have any recourse after a malicious vote passes. A timelock creates a window for exit. A protocol with no timelock and no guardian can be drained before anyone can react.
Six governance security indicators
| Dimension | Strong indicator | Weak indicator |
|---|---|---|
| Timelock delay | Timelock with 48-hour or longer delay on all governance actions | No timelock - governance decisions execute immediately after a vote |
| Token concentration | Top 10 holders hold less than 40% of voting supply | A single address or team controls enough tokens to pass votes unilaterally |
| Flash loan protection | Voting power measured at a snapshot block before the proposal | Voting power measured at execution time (manipulable with flash loans) |
| Quorum threshold | Quorum requires meaningful participation (>5% of supply) | Low quorum threshold allows a small fraction of supply to pass proposals |
| Proposer access | Proposal threshold requires skin-in-the-game (tokens at risk) | Anyone can submit proposals with no stake requirement |
| Executor separation | Proposer and executor roles are separated; execution requires separate confirmation | The proposer can also execute - removing one check in the governance flow |
Five-step governance risk assessment
Verify timelock presence and delay length
A governance system without a timelock can execute decisions immediately after a vote passes. This removes any window for users to react to a malicious proposal. Verify the timelock contract address and read the minimum delay. Delays under 24 hours provide limited protection.
Check when voting power is measured
If a governance contract measures voting power at the time of vote submission rather than at a pre-proposal snapshot, an attacker can borrow a large amount of the governance token via flash loan, vote on an existing proposal, and repay the loan - all within a single transaction. Verify whether snapshot blocks are used.
Assess token concentration and top holders
What does the top-10 holder distribution look like? A governance token where the top holder controls 30% of the voting supply can effectively veto any proposal. A team that controls a concentrated position can pass self-serving proposals without community approval.
Review recent governance proposals and voting patterns
Have any proposals passed with low participation? Were there any contested proposals where a single large holder determined the outcome? The historical governance record is evidence of how the system actually operates, not just how it is designed.
Check what governance can change
Not all governance is equally powerful. Governance that controls fee parameters is low-risk. Governance that can upgrade protocol contracts, drain the treasury, or change the oracle is high-risk. Identify the scope of what governance can change and whether those changes go through a timelock.
Free · No sign-up required
What analysts get wrong about governance risk
Treating any governance as good governance
The existence of on-chain governance does not mean the governance is secure. A governance system with a 0-second timelock, no quorum requirement, and a team controlling 51% of the voting supply is less secure than no governance at all.
Ignoring governance scope
The risk of governance depends on what governance can do. A protocol where governance can upgrade any contract in the system - including the contract that holds user funds - gives governance holders the practical ability to drain the protocol. The scope of governance power matters as much as its structure.
Treating delegation as distribution
A token that appears to have many token holders may have highly concentrated voting power if most holders have delegated to a small number of addresses. Voting power distribution, not token holder count, determines how centralised governance actually is.
Not accounting for low-turnout governance attacks
Most governance votes attract low participation. An attacker who accumulates enough tokens to meet quorum during a low-interest period can pass a malicious proposal without exceeding the typical vote count of contested proposals. Timing a vote for a holiday period or during a market crisis is a known attack pattern.