Beanstalk: it borrows the weight necessary to vote its own case

On April 17, 2022, Beanstalk suffered an attack on its governance. The system allows holders of certain rights to vote on executable decisions. The attacker therefore seeks less to force a lock than to gather enough voices for the protocol to open the door itself.

It temporarily obtains significant voting power through borrowed capital. A malicious proposal is approved and then executed under conditions that do not adequately protect against this sudden concentration. The loan is repaid during the operation.

The analysis estimates the assets and guarantees lost by the protocol at around $182 million. The profit actually gained by the attacker is lower: the costs and capital required for the operation must be distinguished from the hole left in the system.

Public movements make the attack visible to observers. The project interrupts its operation and reviews its governance rules. A collection to recapitalize the protocol is organized; the restart is not proof that all the damage has disappeared.

The identity of the author is not established in the selected sources. The fact that the operation used the functions provided for in the program does not, in itself, give it legitimacy to appropriate the assets of other people.

The question that Beanstalk asks is frighteningly simple: Can a financial democracy protect itself if someone can rent enough ballots for a single decision and then return them right after the vote?