Governance systems controlling substantial funds are targets, and several attacks have followed essentially the same sequence.
The basic attack
Acquire enough voting power to pass a proposal transferring protocol assets to the attacker.
Which is straightforward where voting power is purchasable and the treasury exceeds the acquisition cost.
The arithmetic is the whole vulnerability.
When it becomes viable
Where the market value of the tokens needed to pass a proposal is less than what the proposal can extract.
Which occurs when a token's value falls while the treasury holds other assets.
Protocols with large treasuries and low token valuations are structurally exposed.
Borrowed voting power
Lending markets allow temporary acquisition of governance tokens.
Which reduces the capital required to a borrowing cost.
This has been used in documented attacks, and it is why snapshot mechanisms and lock-up requirements exist.
Flash loan considerations
Same-transaction borrowing cannot generally be used where voting power is measured at a past block.
Which is why snapshot-based voting is standard.
Systems measuring voting power at the time of the vote are vulnerable in a way that snapshot systems are not.
Low turnout
Where most tokens do not vote, a small holding decides outcomes.
Which lowers the acquisition threshold substantially.
Quorum requirements address this and can be set too low to help.
Social engineering
Proposals presented as beneficial that contain harmful code.
Which relies on voters not reading the actual transaction being authorised.
Independent review of proposal code before voting is the defence and is inconsistently practised.
Defences
Snapshot voting, lock-up requirements, meaningful quorums, timelocks and a veto mechanism.
Which each address part of the problem.
Timelocks are the most important, since they allow the community to react and users to exit.
Assessing a protocol
Compare the cost of acquiring a controlling stake against what the treasury holds.
If the first is smaller, the arrangement depends on nobody bothering.
Historical cases
Several protocols have suffered governance takeovers with treasury extraction.
Which are documented publicly with the transaction sequence visible.
Reading one of these case studies makes the mechanism concrete.
Delegate concentration
Where a small number of delegates hold most active voting power.
Which means compromising or coordinating a few parties controls outcomes.
Delegate distribution is publicly measurable and varies enormously between protocols.
Proposal review culture
Whether anyone independently reads proposal code before voting.
Which is the practical defence against malicious payloads.
Protocols with active technical communities catch these; those without do not.
Guardian mechanisms
A designated party able to veto malicious proposals.
Which is centralised protection against a decentralised failure mode.
The trade-off is explicit and several protocols have accepted it deliberately.
Assessing exposure
Token market capitalisation against treasury value, turnout, quorum and timelock duration.
Parameter manipulation
Rather than direct theft, changing risk parameters to enable a profitable position.
Which is subtler and has been attempted.
Collateral factor changes and oracle configuration are the parameters most exploitable this way.
Progressive accumulation
Building a position over time rather than acquiring it at once.
Which avoids the price impact of a sudden purchase and is harder to detect.
Delegate accumulation is publicly observable for anyone monitoring it.
Legal exposure
Governance attacks have resulted in prosecution.
Which addresses the argument that acting within a protocol's rules is permissible.
Courts in several jurisdictions have not accepted that reasoning.
Insurance and mitigation
Some protocols hold reserves specifically against governance failure.
Which is a treasury decision that must be made in advance.
What users can do
Delegate voting power rather than leaving it idle, and monitor proposals affecting funds you have deposited.
The design tension
Distributing control creates the attack surface; concentrating it removes the property that distribution was meant to provide.
Which is a genuine trade rather than a solvable problem.
Timelocks and guardians are compromises rather than solutions.
What to check before depositing
Treasury value against token market capitalisation, quorum, timelock and who holds emergency powers.
The monitoring habit
Governance forums and proposal queues are public for every major protocol.
Which means a malicious proposal is visible before it executes, assuming somebody is looking.
Several attacks were spotted in the timelock window and averted, which demonstrates that the defence works when it is used.
Beyond treasuries
Governance also controls parameters affecting deposited user funds, not only the treasury.
Which means the attack surface extends past the protocol's own assets.
Collateral parameters, oracle configuration and fee destinations are all governable in many protocols.
The summary
Compare acquisition cost against extractable value, then look at the timelock.
A last note
The attack is arithmetic rather than technical sophistication: acquire more voting power than it costs, then vote. Protocols that fell to it generally had the numbers visible to anyone who cared to look.
Summary
Snapshot voting, meaningful quorums, lock-ups and above all a timelock long enough to react.
Which are the defences that have actually worked in practice.