Beanstalk Stablecoin protocol loses $182 million in governance exploit
Stablecoin protocol Beanstalk farms lost $182 million in collateral due to a malicious attack via its own governance proposal system
Image: Shutterstock
Beanstalk Farms, the credit-based stablecoin protocol, was robbed of $182 million worth of collateral caused by a security breach involving two malicious governance proposals and a flash loan attack. Beanstalk Farms is built on the Ethereum network as a decentralised algorithmic stablecoin issuing platform.
The exploit happened due to two governance proposals, BIP-18 and BIP-19, which were issued to urge the protocol to donate funds to Ukraine on April 16, 2022. A malicious rider attached to these governance proposals led to Beanstalk losing all its collateral funds in the exploit. The security breach happened around 12:24 pm UTC [5:54 PM, IST].
The exploiter first took out $1 billion in flash loans from the AAVE protocol. The flash loan amount was denominated in Tether (USDT), USD Coin (USDC), and Dai (DAI). They then used these funds to attain a majority vote share of 67 percent in the platform’s governance, and vote for their own proposals. Flash loans have been used in the past to facilitate such hacks and exploits on other protocols. A Flash loan requires different smart contracts to compete with each other for the loan to be issued, and the transaction must be initiated and repaid within a single block.
Beanstalk Farms Twitter handle post said, “We’re engaging all efforts to try to move forward. As a decentralised project, we are asking the DeFi community and experts in chain analytics to help us limit the exploiters’ ability to withdraw funds via CEXes. If the exploiter is open to discussion, we are as well.”
The exploit cannot be technically called a hack [but we are calling it a hack in the headline?] as there was no lapse in the governance procedures and smart contracts functioned as designed. There were flaws in the design that the attacker exploited. Beanstalk's spokesperson ‘Publius’ in a April 18, 2022, meeting said, “It’s unfortunate that the same governance procedure that put Beanstalk in a position to succeed, was ultimately its undoing.”
