defirisk.co
rubric v1.7.0

Flash-loanable voting weight

mETH Protocol's assessment for RD-F-036 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

No on-chain Governor contract exists. COOK governance token introduced November 2024 but no binding on-chain Governor deployed as of 2026-05-16. Governance is via Snapshot (off-chain, bitdao.eth) plus multisig execution. Flash-loanable voting weight vulnerability does not exist in current architecture — no on-chain vote-weighted execution path.

Sources #

  • Docs
    mETH Protocol COOK tokenomics documentationdocs.mantle.xyz/meth/governance/tokenomics: COOK token exists but no on-chain Governor contract deployed; governance is multisig+Snapshotretrieved 2026-05-16
  • Internal
    mETH Protocol profile §6 governance topologyProfile §6: no on-chain Governor contract exists at profile time; COOK token governance not yet live as binding on-chain mechanismretrieved 2026-05-16

Methodology #

Determine whether governance voting power is a function of current token balance of a transferable token with no lock or checkpoint, making it flash-loan susceptible.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol meth-protocol factor RD-F-036 score green collected_at 2026-05-16 02:17:50