An adversarial risk pass is the step where the team stops defending the model and attacks it. Someone takes the attacker's side, walks a specific exploit path through the mechanism, and records what the model does at each step. The output is a rated register of threat vectors with the residual risk that survives each mitigation, not a memo saying the design looks sound.
A design review asks whether the mechanism works. An adversarial pass asks what a well funded actor does with it on the worst day of the year, when depth is thin and the price feed is late. Those two questions produce different answers more often than teams expect.
Scroll to see the full diagram
Attacker economics, not a checklist
Each vector starts as a hypothesis: a rational, well capitalized actor wants to extract value here, so what does it cost them and what do they get. Both sides of that trade need numbers. Cost to acquire the position, cost of capital for the duration, gas and slippage in and out, against the value the mechanism hands over if the path completes.
Vague mitigations get rejected in this step. "Governance prevents this" is not a control until you state the quorum, the proposal-to-execution delay, and what it costs on the open market to buy or borrow enough voting weight to clear that quorum. If that number is smaller than the treasury the vote controls, the mitigation is decorative.
The classes a token model gets tested against
Seven recur across the work. Governance capture, where voting weight is bought or borrowed faster than the system can respond. Price and collateral manipulation, where the system trusts a number an attacker can move. Incentive gaming, where the cheapest way to earn the reward is not the behavior you were paying for. Liquidity attacks, covering pool draining, ordering games and exit cascades. Sybil inflation of any per-identity distribution. Privileged key compromise. And cross-mechanism interaction, where two individually safe components combine into something neither team modeled.
The last class is the one internal reviews miss most reliably, because it belongs to nobody. An emission rate that is fine alone becomes a problem next to a short cliff on a large allocation, and neither owner is looking at the pair.
Governance capture: what borrowed voting weight did to Beanstalk
Beanstalk's own post-mortem records the shape precisely. The protocol was attacked on 17 April 2022 at roughly 12:24pm UTC, resulting in the theft of approximately $77 million in non-Beanstalk user assets, and the perpetrator used a flash loan to exploit the protocol's governance mechanism.1
The design lesson is narrow and portable. Voting power that can be acquired and used inside a single transaction is not voting power, it is a purchase. The fix is not a higher quorum, because a higher quorum is just a larger loan. The fix is time: a delay between acquiring the stake and being able to vote it, and a second delay between a passing vote and execution.
Manipulating the number your own collateral depends on
The SEC's charges against Avraham Eisenberg state that beginning on 11 October 2022 he engaged in a scheme to steal approximately $116 million of crypto assets from Mango Markets by manipulating the price of the MNGO perpetual futures contract to inflate the value of his collateral, then borrowing and withdrawing against it.2 Nothing broke. Every contract did what it was written to do, against a price the attacker controlled.
Platypus Finance is the adjacent shape. Immunefi's analysis records a loss of about $8.5 million in stablecoin collateral on 16 February 2023 to a logic error: a flaw in the solvency check inside the collateral holding contract let the attacker borrow against flash loaned collateral and then withdraw it without repaying the debt.3
One test covers both. For every place your model reads a price or a balance and grants something in return, ask what it costs to move that number for one block, and compare it to what gets granted. If the second is larger, you have found a vector, and no amount of code review will find it because the code is correct.
What the pass hands to the rest of the work
A register, one row per vector: the exploit path, cost to the attacker, value extracted, gross rating, the control applied, the residual rating that survives it, a named owner, and the metric that would show the attempt happening in production. The last two columns are what make it operational instead of literary.
Those columns feed directly into the two documents that come after. The residual column becomes the honest statement of exposure for investors and counsel. The metric column becomes the post-launch monitoring framework, which is how a threat you accepted at design time gets watched rather than forgotten.
Common questions
What is the difference between an adversarial risk pass and a smart contract audit?
A smart contract audit checks whether the code does what it is written to do. An adversarial pass checks whether what it is written to do can be turned against the protocol. The Mango Markets case is the clean illustration: the contracts executed correctly against a price the attacker had manipulated.2 Both reviews are necessary and neither substitutes for the other.
Who should run an adversarial risk pass?
Someone who did not design the mechanism. A designer defends by reflex, and the reflex is the problem: the elements a team is proudest of are usually the ones carrying the most surface. If the pass is internal, assign the attacker role explicitly and give that person the authority to say the mitigation failed. Independent review is stronger, which is why it is normally scoped into a tokenomics audit.
Why do flash loans matter for tokenomics rather than just for code?
They remove capital as a barrier. Any mechanism whose safety rests on the assumption that no participant can command a large enough position for a moment is priced wrong, because for the length of one transaction anyone can. Beanstalk lost approximately $77 million in user assets to exactly that gap in its governance mechanism.1 Design against borrowed size, not owned size.
See Tokenomics Audit Services for how this applies in practice.
Sources
- Beanstalk Governance Exploit
Beanstalk Farms, 2022
The protocol's own post-mortem: attack on 17 April 2022 at roughly 12:24pm UTC, approximately $77 million in non-Beanstalk user assets stolen via a flash loan against the governance mechanism. First-party figure; higher totals circulate elsewhere measuring value destroyed rather than user assets taken. - SEC Charges Avraham Eisenberg with Manipulating Mango Markets' "Governance Token" to Steal $116 Million of Crypto Assets (2023-13)
U.S. Securities and Exchange Commission, 2023
Regulator's own figure of approximately $116 million, attack beginning 11 October 2022, via manipulation of the MNGO perpetual futures price to inflate collateral value. - Hack Analysis: Platypus Finance, February 2023
Immunefi, 2023
Loss of about $8.5 million in stablecoin collateral on 16 February 2023 to a solvency check flaw allowing borrowing against flash loaned collateral and withdrawal without repayment.
Last reviewed 2026-08
Know the terms but not sure how they apply to your project? That is what an engagement is for. We design, document, and stress-test the whole token economy inside the Tokenomics Data Room.
100+ projects advised. Complete tokenomics in 4 to 6 weeks.