DAO Governance Attacks: The New Weak Link in Web3 Security
Governance attacks on decentralized autonomous organizations (DAOs) are becoming increasingly common, and can have devastating consequences. Unlike traditional smart contract hacks, governance attacks often don't involve exploiting coding flaws but rather manipulating voting power to influence outcomes.
According to a recent incident involving BonkDAO, an attacker acquired $4.4 million worth of BONK tokens before submitting a proposal that transferred approximately $20 million in treasury assets to their wallet. The proposal passed with only seven wallets participating in the vote, and the attacker's voting weight accounted for 99.878% of the total.
Experts warn that this type of attack can be particularly difficult to detect, as it doesn't involve a conventional code defect. Monitoring changes in voting power concentration and examining proposals that could affect treasury assets may be necessary to identify potential governance takeovers before they occur.