Renting a majority for one block
Beanstalk’s governance let token holders vote on proposals that could move protocol funds. Crucially, a proposal that reached the required support could be executed immediately.
Flash loans make voting power rentable. The attacker borrowed enough capital in a single transaction to buy a governance supermajority, executed a proposal they had submitted earlier, sent the protocol’s assets to themselves, and repaid the loans — all atomically. If any step had failed, the whole transaction would have reverted at no cost to them.
The fix is boring and effective
A timelock between a proposal passing and executing breaks the attack completely, because the borrowed voting power must be repaid within the same transaction and cannot persist for a delay period. Any protocol where governance can move funds without a delay has this exposure, and it is checkable: read the governance contract for a timelock.
Timeline
Append-only. Corrections are added as their own dated entry; earlier entries are never rewritten.
- The attacker acquires governance supermajority via flash loan and executes a malicious proposal in the same transaction. Beanstalk Farms
What to check
Beanstalk published an incident report and governance post-mortem on its own channels.
Conisec does not host or link recovery, revocation or "checker" tools. After a public incident, attackers routinely seed exactly those links using the names of publications covering the story. Use the affected project's own official channel, linked above, and nothing else.
Sources
- Beanstalk Farms, Incident report (17 Apr 2022)
Not advice. This is a summary of published facts, not legal, tax or security advice. Verify against the primary sources linked above.
Last verified by Conisec Staff.
