Token of Power Governance Attack Mints 10 Billion TOP and Drains $1.58 Million From Balancer Pool

An attacker exploited Token of Power’s Aragon DAO governance configuration to mint 10 billion TOP tokens and drain about $1.58 million from a Balancer pool. According to NS3.AI, security firm Blockaid said the incident appeared to be a governance-takeover attack rather than a smart-contract coding flaw. Blockaid attributed the exploit to the Aragon Voting app being configured without a timelock, which allowed the attacker to create a proposal, vote on it, and execute it within a single transaction.