Beanstalk Farms Hack

The Beanstalk hack was a governance attack that exploited the protocol's on-chain voting system. Here's how it was executed:

1. The attacker created a malicious governance proposal (BIP-18) that would drain all protocol funds to their address, disguised as a donation to Ukraine
2. They took out a flash loan of nearly $1 billion in assets (approximately $900M in various cryptocurrencies)
3. Using these borrowed assets, they acquired enough governance tokens to gain a 67% voting majority
4. They executed their proposal, which passed immediately due to Beanstalk's governance design
5. The protocol's funds were drained to the attacker's wallet
6. They repaid the flash loan and kept about $76 million in profits

The vulnerability was in Beanstalk's governance mechanism, which allowed:

• Immediate execution of proposals without time delay
• Voting power directly proportional to token holdings, even if recently acquired
• No protection against flash loan governance attacks

// Simplified representation of the vulnerable governance code
function executeProposal(uint256 proposalId) public {
    Proposal storage proposal = proposals[proposalId];
    
    // Check if proposal has enough votes (67% majority)
    require(
        proposal.forVotes > (totalVotes * 2) / 3,
        "Proposal doesn't have enough votes"
    );
    
    // Execute proposal immediately without time delay
    (bool success, ) = proposal.target.call(proposal.data);
    require(success, "Proposal execution failed");
    
    emit ProposalExecuted(proposalId);
}