Governance Manipulation and Referenda Attacks

Polkadot's OpenGov system replaces the older Governance V1 council model with a decentralized, multi-track referendum structure that gives every token holder direct voting power. This design intentionally removes centralized gatekeepers, but it also exposes the treasury and protocol upgrade mechanisms to a broader attack surface. Governance manipulation in this context refers not to a single exploit vector, but to a class of attacks where an adversary leverages the rules of the system—proposal submission, conviction voting, delegation, and referendum scheduling—to extract value, disrupt operations, or erode confidence in the network's decision-making process.

The most prominent attack patterns include proposal spamming, where an attacker floods a governance track with low-quality or duplicate proposals to exhaust voter attention and potentially sneak a malicious one through; conviction voting exploits, where an attacker uses extreme conviction multipliers to amplify voting power on a self-serving referendum without bearing proportional economic risk; and treasury draining, where a carefully crafted proposal attempts to transfer significant treasury funds to an attacker-controlled account, often disguised as a legitimate infrastructure or marketing spend. Each of these vectors exploits the tension between permissionless access and collective security.

The social layer remains the ultimate defense. When technical parameters like submission deposits or decision periods prove insufficient, the community must coordinate to counter malicious proposals through information sharing, counter-voting, and, in extreme cases, emergency governance interventions. Post-incident analysis of these events has driven parameter adjustments—such as increasing submission deposits on specific tracks or modifying conviction voting curves—that harden the system without requiring a full governance redesign. For governance participants, understanding these failure modes is essential to protecting both the treasury and the legitimacy of the OpenGov process itself.

Governance manipulation in Polkadot targets the economic and social-layer assumptions of OpenGov, not the cryptographic integrity of the runtime. The most common attack vectors exploit the permissionless nature of referendum submission and the delegated, conviction-weighted voting model. A primary mechanism is referendum spamming, where an attacker floods multiple governance tracks with technically valid but malicious or frivolous proposals. This aims to exhaust voter attention, cause decision fatigue, and allow a dangerous proposal to pass unnoticed. A more direct economic attack involves treasury draining, where a proposal is crafted to approve a massive transfer of funds from the treasury to an attacker-controlled account, often disguised within a complex batch call or a seemingly legitimate infrastructure spending request.

A sophisticated technical vector is the conviction voting exploit. OpenGov allows token holders to voluntarily lock their tokens for a multiplier that amplifies their voting power. An attacker with a significant stake can lock tokens with a high conviction on a malicious proposal, creating an overwhelming economic weight that honest but uncoordinated voters cannot easily counter. This is particularly effective on tracks with lower decision-deposit requirements. Another mechanism involves decision-deposit manipulation. An attacker can place a very high decision deposit immediately after a proposal is created, causing the referendum to skip the normal decision period and proceed directly to the confirmation period, catching the community off-guard and preventing adequate time for social-layer coordination and opposition to mobilize.

The social-layer response to these attacks often involves the Fellowship or Technical Committee invoking fast-track or cancellation mechanisms, which themselves can become a point of governance controversy. Technical parameter changes, such as increasing the minimum decision deposit or adjusting the conviction multiplier curve, are the standard remediation. For integrators, treasury custodians, and large token holders, modeling these attack vectors requires continuous monitoring of the referendum queue, deposit patterns, and conviction-weighted voting power distribution. Chainscore helps governance participants build this monitoring infrastructure and review referendum integrity to detect manipulation attempts before they reach enactment.