OAK — OnChain Attack Knowledge

Worked example · 2022-04

Beanstalk Farms flash-loan governance attack — Ethereum — 2022-04-17

Loss
approximately $182 million in total protocol treasury value drained (~$76M net profit to the attacker after repaying the $1B+ flash loan and associated fees). The drained assets included BEAN, ETH, USDC, USDT, DAI, and other protocol-owned liquidity — effectively the entire liquid treasury of Beanstalk at the time of the attack. The attacker's net extraction was reduced by ~$106M in flash-loan fees (Aave origination fee + Curve LP withdrawal slippage + gas), making the gross drain $182M and the net profit ~$76M — the largest flash-loan-enabled governance attack on record measured by both gross extraction and net profit.
OAK Techniques observed
OAK-T16.001 (Flash-Loan Governance Vote Manipulation — primary; the attacker acquired ~70% of Beanstalk governance voting weight via flash-loaned BEAN/ETH Curve LP tokens through Aave, created and passed BIP-18 — a malicious governance proposal — within a single transaction). OAK-T9.002 (Flash-Loan-Enabled Exploit — structurally co-occurring; the ~$1B+ flash loan from Aave was the capital base that enabled governance-token acquisition at the scale required to pass a proposal unilaterally). OAK-T9.003 (Governance Attack — the governance-capture outcome; the attacker exploited the governance mechanism's lack of a voting-power snapshot to pass a treasury-draining proposal). OAK-T16.001 (Vote Takeover via Flash Loan — the flash-loan-as-voting-power-primitive at the largest scale on the public record: the attacker acquired ~70% of governance voting weight via a ~$1B Aave flash loan within a single block, created and passed the malicious proposal, and repaid the loan in the same transaction). OAK-T7.001 (Mixer-Routed Hop — the post-extraction laundering surface; the net proceeds were routed through Tornado Cash in the hours following the attack, consistent with the canonical T7.001 extraction-to-mixer chain). OAK-T6.001 (Source-Verification Mismatch — the attacker's BIP-18 proposal presented itself as a Ukraine humanitarian-aid donation in response to the Russo-Ukrainian war, exploiting real geopolitical context to create social-pressure cover against governance scrutiny).
Attribution
pseudonymous attacker; no public named-individual attribution at v0.1. The attacker's on-chain address (0x1c5d…) and the contract that executed BIP-18 are publicly identifiable, but the address has not been linked to a named individual or a known operator-cluster.
Key teaching point
Beanstalk Farms is the largest flash-loan governance attack on the public record and the canonical T16.001 anchor at scale. The attack demonstrates that flash-loan governance attacks are constrained not by governance-mechanism complexity but by treasury size relative to flash-loan cost: a protocol with a $182M treasury and governance voting power derived from DEX liquidity-pool tokens is structurally vulnerable to a single-transaction governance capture when the profit ceiling ($182M) exceeds the flash-loan cost (~$106M) by a sufficient margin. The attacker's use of a Ukraine-donation facade — exploiting real-world humanitarian context to lower governance-scrutiny defenses — is a T6.001 layer atop the T16.001 core, demonstrating that governance-attack proposals can exploit real-world social context to reduce voter suspicion. The structural mitigations are identical to Fortress Protocol (T16.001): (1) snapshot-based voting power measured at a block prior to proposal creation, (2) a minimum governance-token holding period, and (3) a quorum threshold that exceeds the DEX liquidity depth of the governance token. Beanstalk had none of these at the time of the attack.

Summary

Beanstalk Farms was a decentralized stablecoin protocol on Ethereum that issued BEAN, an algorithmic stablecoin pegged to $1 via a supply-adjustment mechanism inspired by the Seigniorage model. Governance of the protocol was controlled by holders of BEAN3CRV-f Curve LP tokens — liquidity-provider tokens representing a share of the BEAN/USDC/USDT/DAI Curve liquidity pool. The number of LP tokens held determined a voter's governance weight. The governance contract used the current LP-token balance of each voter (balanceOf), with no snapshot mechanism to measure voting power at a prior block height, no minimum holding period, and no delegated-voting delay — the same structural vulnerabilities as Fortress Protocol (T16.001 canonical BNB Chain case).

On April 17, 2022, an attacker exploited this governance architecture. The attacker used a flash loan from Aave to borrow ~$1B+ in stablecoins (USDC, USDT, DAI), deposited them into the BEAN/USDC/USDT/DAI Curve pool to mint BEAN3CRV-f LP tokens, and used those LP tokens to acquire ~70% of Beanstalk's governance voting weight — all within a single transaction. With majority voting power, the attacker created and immediately passed BIP-18 (Beanstalk Improvement Proposal 18), which transferred the protocol's treasury — $182M in various assets — to a specified recipient address.

BIP-18 was crafted with a T6.001 source-verification-mismatch layer: the proposal's stated purpose was to donate Beanstalk treasury funds to Ukraine humanitarian aid, exploiting the real-world context of the February 2022 Russian invasion of Ukraine. The proposal text was designed to create social-pressure cover — a governance participant voting against a "Ukraine donation" would face reputation risk. However, the recipient address was not a verified Ukraine aid wallet; it was an attacker-controlled contract that routed the funds to the attacker's address after a brief holding period.

The attack was executed within a single Ethereum transaction. After the treasury drain, the attacker repaid the Aave flash loan ($1B+ principal + fees), converted the remaining assets to ETH, and routed the net proceeds ($76M) through Tornado Cash over the following hours — a canonical T7.001 extraction-to-mixer chain. The total elapsed time from flash-loan origination to mixer deposit was under 6 hours.

Beanstalk Farms paused protocol operations, conducted a post-mortem, and subsequently restructured governance to include a voting-power snapshot mechanism and a minimum holding period for governance tokens. The protocol relaunched later in 2022 with the patched governance architecture. The attack became a defining case study in DeFi governance security and is cited in audit-firm literature as the canonical example of governance-weight-measurement-at-current-block as a structural vulnerability. The Beanstalk case, combined with Fortress Protocol (May 2022, BNB Chain, ~$3M), establishes T16.001 as a cross-chain class: any governance system where voting power can be acquired and exercised within the same block, using capital that can be borrowed without collateral (flash loan), is structurally vulnerable regardless of chain.

Timeline (UTC)

When Event OAK ref
2021-08 Beanstalk Farms launches BEAN algorithmic stablecoin on Ethereum (protocol genesis)
2021–2022-Q1 BEAN3CRV-f Curve LP pool accumulates ~$180M+ in liquidity; governance voting weight proportional to LP-token holdings (standing governance architecture)
2022-04-17 ~07:00 UTC Attacker originates ~$1B+ flash loan from Aave (USDC, USDT, DAI) T9.002
2022-04-17 ~07:00 UTC Attacker deposits stablecoins into BEAN/USDC/USDT/DAI Curve pool, receives BEAN3CRV-f LP tokens (~70% of governance weight) T16.001
2022-04-17 ~07:00 UTC Attacker creates and passes BIP-18 (Ukraine-donation facade proposal) transferring $182M treasury to attacker-controlled address T16.001 + T6.001
2022-04-17 ~07:00 UTC Treasury assets drained; flash loan repaid; ~$76M net profit extracted T9.003
2022-04-17 ~07:00 to ~13:00 UTC Net proceeds routed through Tornado Cash T7.001
2022-04-17 afternoon UTC Beanstalk team publicly discloses the attack, pauses protocol operations (incident response)
2022-Q2–Q3 Beanstalk governance restructured with voting-power snapshot + minimum holding period (mitigation deployment)

Realised extraction

$182M gross treasury drain. $76M net profit to the attacker after flash-loan repayment ($106M in loan principal + Aave origination fee + Curve pool slippage + gas costs). The largest flash-loan-enabled governance attack on the public record measured by both gross extraction and net attacker profit. All net proceeds routed through Tornado Cash within ~6 hours of the attack.

Public references

  • Beanstalk Farms official post-mortem (April 2022)
  • Peckshield / BlockSec on-chain transaction analysis and tracing reports
  • CertiK incident analysis and governance-vulnerability advisory
  • See techniques/T16.001-flash-loan-governance-vote-manipulation.md for the Technique definition and mitigations

Techniques demonstrated (5)