YAM Finance Hit by Governance Attack, $337,000 in Assets Exposed

YAM Finance Protocol has come under a governance takeover threat, owing to an attack in which an attacker gained sufficient YAM tokens to submit a proposal that would take control of the Timelock of the protocol and place approximately $337,000 (roughly Rs. 3.1 crore) at risk. Defimon, which is an on-chain monitoring system run by the cybersecurity company Decurity, confirmed that the attack happened following an address self-delegating approximately 504,000 YAM tokens, which amount to 3.3 percent of the YAM token's total supply. It also gave away enough voting power to move just above the governance quorum. 

Inactive Governance Participation Leaves YAM Vulnerable to Takeover Attempts

Proposal 45 of the YamGovernorAlpha proposal by the attacker was filed with “0x” in the description field, according to Defimon. Rather than consisting of multiple governance operations, it makes just one call to the setPendingAdmin function in the YAM Timelock contract with the attacker-controlled address as the pending administrator. If the proposal receives enough votes and is executed, Defimon claimed that the hacker would initially gain pending administrator rights on the Timelock. It can then execute acceptAdmin to fully transfer administrative rights.

Taking control of the Timelock would mean gaining control of the administrative functions that govern the contracts of the YAM protocol and the DAO treasury, said the security firm. Defimon noted that roughly $337,000 (roughly Rs. 3.1 crore) is at risk if the proposal passes. The security company recommended that the remaining YAM tokens should vote against the proposal before block number 25,897,343. According to Defimon, at the time the warning was posted, there were about 34 hours left for action. 

However, YAM Finance has been quite inactive, which is something that Defimon pointed out when he warned about the proposal. Inactive participation leaves room for vulnerability in the governance process since only a few delegated tokens can satisfy the voting requirement.

The attempt has not succeeded in causing any loss of funds in the treasury as of the time when Defimon issued its warning. The proposal must first go through the process of governance and implementation for the attack to take place, as suggested by the security firm. The attempted takeover of YAM is just one of the many governance attacks that have happened in recent months.

The decentralised finance lending platform Term Finance also suffered a loss of an estimated $8.5 million (roughly Rs. 81.3 crore) after a hacker attacked its system through the governance control of its strategy vaults, as stated by blockchain security companies. The hacker stole an estimated 2,843 Ether (ETH) worth $6.87 million (roughly Rs. 65.7 crore) and 1.68 million USDC, which was converted into 1.68 million DAI on Sunday, PeckShield reported.