Governance Attack Surface Review: Sky Lending

Sky Lending is a high-value, permissionless lending platform that has rapidly grown to a multi-billion-dollar TVL across Ethereum mainnet and several L2 roll‑ups. Governance on Sky Lending is governed by the SKY ERC‑20 token, a timelocked Governor contract, and an upgradeable proxy architecture for core market contracts. Our review focused specifically on the governance attack surface, examining any pathway by which an adversary could manipulate, subvert, or compromise the protocol’s decision-making processes, parameter changes, or contract upgrades.

Key findings revealed several critical issues:

1. Insufficient quorum & voting power concentration – High risk (7/10). The current quorum is set to 0.5% of total SKY supply. This allows a single address, such as the protocol treasury, to control a significant portion of voting power (~12%). If an adversary acquires approximately 0.6% of the supply (~$30M), they could push proposals through without broader community consent.

2. Timelock bypass via re‑entrancy in execute – Critical risk (9/10). The GovernorTimelockControl contract calls timelock.execute without sufficient safeguards. If a malicious contract re‑enters the Governor before the proposal state is set to "Executed," an attacker could execute arbitrary actions multiple times, bypassing the timelock delay.

3. Upgradeability controlled solely by Governor – Critical risk (9/10). Core market contracts are transparent proxies with the ProxyAdmin contract as its admin, owned by the Governor. This single point of failure means that a successful governance takeover grants the attacker the ability to point proxies to malicious implementations, potentially leading to asset theft or protocol freezes.

4. Flash‑loan‑driven parameter manipulation – High risk (7/10). Attackers can exploit the snapshot mechanism by borrowing a large amount of SKY via a flash loan, inflating voting power, and executing parameter changes (such as lowering collateral factors or raising borrow caps) within a single transaction before the community can react.

5. Cross‑chain governance message relay – Medium risk (5/10). The L2 governance proposals are relayed to L1 via a custom “MessageBridge” contract that trusts relayer signatures. A compromised relayer can forge L1 execution messages, causing unauthorized state changes such as upgrades or parameter alterations.

6. Vote delegation without re‑entrancy guard – Medium risk (5/10). The delegation mechanism does not use a re‑entrancy lock, leaving it vulnerable to delegation loops that could inflate voting power, similar to previous governance attacks on other platforms.

7. Proposal execution ordering & front‑running – Medium risk (4/10). Proposals are executed in the order they reach the execute function, lacking atomic batch execution. This creates opportunities for front‑running, where an attacker submits a malicious proposal with a slightly earlier eta to execute before a benign one, altering critical parameters or rendering the benign proposal ineffective.

8. Insufficient event logging – Low risk (3/10). Important state changes such as quorum updates and timelock delay changes are not logged in events, making it harder to monitor on-chain governance activities and respond promptly to potential threats.