Three DAO Governance Takeovers in One Week: Your Vote Is a Key

Over the past week, outsiders took control of governance at three DeFi projects. On October 24, X100's three-seat governance "senate" lost two seats to an attacker using flash-loaned funds, and proposals executed almost immediately, with reported losses of about $4.85M. On October 26, Yapeswap's zero quorum was used to drain about $22K. On October 28, according to security researchers, a Hifi Finance proposal passed in the final minutes on votes from four addresses, with none against. It mints 25M governance tokens and moves about $1M in user collateral. The project has not commented publicly.

What the three share: the attackers did not bypass any permission. They used the governance process the projects wrote themselves.

Where small teams are exposed

Five things you can do now

• List what your governance contract can do: upgrades, minting, moving user funds, one by one
• Count votes from a snapshot at proposal creation and require a minimum holding period, so flash-loaned votes cannot be used on the spot
• Add an execution delay (timelock) with a multisig veto or security council that can stop a proposal during the delay
• Alert on new proposals, concentrated voting and timelock queueing, routed to a channel someone actually watches
• Before a product winds down, remove governance's power over user funds, or migrate the funds out

X100 and Yapeswap details and amounts come from public reports by security firms and media. The Hifi Finance proposal details come from security researchers; the project has not commented publicly, and whether the proposal has executed should be checked on-chain. This article does not cover attack details.