Skip to content
Quantix Security Labs

Thessaly Governance

Token-weighted governance with delegated voting and a timelock.

A governance framework used by several protocols in Quantix Protocol Research. Proposals are voted with checkpointed token balances; passed proposals queue in a timelock before execution through a multicall executor.

Ecosystem
OPOptimism
Category
Governance
Languages
Solidity
Launched
May 2025
77.6BBBModerate risk

Grade BBB · Moderate risk

Adequate posture with notable weaknesses in one or more areas.

−0.2 since Nov 2025 · ±0.0 since Jul 2026

Quantix Protocol Research · as of 24 Oct 2026 · About this data

Risk Index

How the score is built

Six weighted components, each scored 0–100 where higher means less risk. Points are the component value multiplied by its weight; the gap is what the component costs against a perfect score.
ComponentWeightValuePointsGap
Code Security30%8024.0−6.0
Operational Security20%7615.2−4.8
Governance Risk15%7210.8−4.2
Economic Security15%7611.4−3.6
Infrastructure Resilience10%787.8−2.2
Transparency10%848.4−1.6
Quantix Risk Index100%77.6−22.4
CodeOperationalGovernanceEconomicInfrastructureTransparencyThessaly Governance, Code: 80Thessaly Governance, Operational: 76Thessaly Governance, Governance: 72Thessaly Governance, Economic: 76Thessaly Governance, Infrastructure: 78Thessaly Governance, Transparency: 84
Risk Index components: Thessaly Governance Code 80, Operational 76, Governance 72, Economic 76, Infrastructure 78, Transparency 84
ComponentThessaly Governance
Code80
Operational76
Governance72
Economic76
Infrastructure78
Transparency84

Grade scale

  1. AAA90–100
  2. AA85–89.9
  3. A80–84.9
  4. BBB75–79.9
  5. BB70–74.9
  6. B65–69.9
  7. CCC60–64.9
  8. CC55–59.9
  9. C50–54.9
  10. D0–49.9

Score history

12 monthly snapshots

Each point is the Risk Index computed from that month’s component values. Markers below the chart show the events that moved a component.
Thessaly Governance Quantix Risk Index by month
PeriodQuantix Risk Index
Nov ’2577.8
Dec ’2577.8
Jan ’2677.8
Feb ’2677.8
Mar ’2677.8
Apr ’2677.8
May ’2677.8
Jun ’2676.3
Jul ’2677.6
Aug ’2677.6
Sep ’2677.6
Oct ’2677.6

  1. 8 Jul 2026

    Governance

    Snapshot and delay changes

    Voting power snapshot moved before voting starts; voting delay extended.

    • Governance Risk+6
    • Operational Security+2

  2. 10 Jun 2026

    Incident analysis

    Borrowed voting power proposes removing the timelock

    A one-block voting delay let borrowed tokens count; the payload would have zeroed the timelock and emptied the treasury.

    Incident analysis in Threat Analysis
    • Governance Risk−10

Risk factors

What keeps the score from being higher, most severe first.

  • HighGovernance RiskProfile analysis

    Borrowed voting power

    Delegation of borrowed or flash-acquired tokens can meet quorum if snapshots are taken too close to proposal creation.

  • MediumGovernance RiskProfile analysis

    Unrestricted executor

    Passed proposals can call any contract, including treasury transfers, with no allow-list.

Recommendations

Each recommendation raises one component to a target value. The score effect is recomputed with the Risk Index model, holding every other component fixed.

  • Governance Risk: 72 → 80

    Longer voting delay and higher quorum

    Two-day voting delay and quorum of 6% of supply.

    +1.2

    → 78.8

  • Economic Security: 76 → 82

    Executor allow-list for treasury

    Require a separate, longer delay for treasury transfers.

    +0.9

    → 78.5

Analysis

Contract, governance and operations

Contract analysis

Source
Verified
Upgradeability
Immutable governor; timelock admin is the governor
Administrative control
Token holders through Governor and Timelock
Enforced delay
72 hours
External dependencies
Protocols that use the framework; Delegation markets
  • PassSource verified. Governor, token and timelock verified.
  • PassVoting snapshot. Voting power snapshot one block before voting starts since July 2026.
  • CautionQuorum. Quorum of 3% of supply.
  • CautionExecutor scope. Multicall executor can call any target.

Governance exposure

Moderate

Low quorum and an unrestricted executor mean a well-funded voter can pass and execute arbitrary actions after the timelock.

Operational resilience

Adequate

Proposal monitoring was added after the June incident.

Monitoring

Monitoring history

8 recorded security events for Thessaly Governance, most recent first.
Open in Security Monitoring
  1. 11 Jun 2026MediumTimelock minimum delay floor of 48 hours enforcedConfiguration Change · TimelockResolved
  2. 11 Jun 2026MediumVoting delay raised to 43,200 blocks (one day)Configuration Change · GovernorResolved
  3. 10 Jun 2026LowGuardian cancels Proposal 41Governance · GovernorResolved
  4. 10 Jun 2026LowBorrowed THS returned to the lending marketWhale Activity · VotesTokenResolved
  5. 10 Jun 2026MediumVoting snapshot taken one block after proposalGovernance · GovernorResolved
  6. 10 Jun 2026CriticalProposal 41 sets timelock delay to zero and moves the treasuryGovernance · GovernorResolved

Research assessment

No Quantix assessment of Thessaly Governance has been published. Its security findings are represented by the contract-analysis signals above: 0 failed and 2 cautionary.

Continue with

Comparable protocols

Compare side by side

Research

Relevant research

Publications on the risks that matter most for a governance protocol.

Architecture

System components

Governor
Proposal lifecycle and vote counting
VotesToken
Checkpointed voting power with delegation
Timelock
Delay and execution of passed proposals

Turn risk factors into a remediation plan.

A research assessment traces each weakness to code, configuration or process, and verifies the fix before the score moves.

Discuss Your Security RequirementsBack to the Security Explorer