2026-11-06 –, Lotus Stage 2
DAO treasuries sit behind governance contracts, and governance is an attack surface like any other. This talk catalogs ten ways onchain governance gets taken over or ground to a halt: flash-loaned voting power, decaying quorums, proposal spam, timelock capture, delegation markets, and more. Each is grounded in a real incident or disclosed vulnerability, and each ends with the mitigation that now exists. If your protocol has a governor and a treasury, this is the threat model you inherited.
Onchain governance concentrates the two things attackers love: authority and money. Yet many governance systems are configured at launch and never threat modeled again.
Drawing on maintaining the governance contracts behind many of the largest DAOs, and on the public incident record, this talk walks through ten takeover and griefing patterns, including:
- Voting power from nowhere: flash loans, and why checkpointing exists
- Quorum decay in aging DAOs, where yesterday's safety margin becomes a rubber stamp
- Proposal spam and frontrunning as denial of governance
- Timelock role hygiene, from open executors to admin capture
- Delegation markets and vote buying
- Cross-chain execution, where a message bridge quietly joins your trust model
Every pattern is paired with a real incident or disclosed vulnerability and a concrete mitigation: parameters, role setup, monitoring, and the escape hatches users should demand.
Attendees leave with a checklist to run against any live governor.
Luiz is an Open Source Developer at OpenZeppelin, working on solidity libraries, such as the main openzeppelin-contracts and the Open Intents Framework.