A malicious governance proposal has been detected in the YAM Finance voting system, and security firm Defimon is treating it as an attempted takeover of the protocol. The attacker self-delegated around 504,000 YAM tokens, roughly 3.3% of total supply and just above the governance voting threshold, then submitted proposal #45 to YamGovernorAlpha. The proposal has an empty body, encoded as 0x, and contains one operation: a call to setPendingAdmin on the YAM Timelock contract with the attacker's address as the target. Defimon warns that if the vote passes and the proposal executes, the attacker becomes pendingAdmin and can later call acceptAdmin to take full control of Timelock. That would give the attacker management authority over all YAM protocol contracts and the DAO treasury. The value exposed in this scenario is about $337,000. YAM is currently dormant, but the voting window remains live. Defimon Alerts is therefore urging YAM holders to vote no before block 25,897,343, around 34 hours from the alert.
Security firm Defimon has issued an alert after detecting a governance takeover attempt against YAM Finance.
The attack begins with a delegation step. According to Defimon, the attacker self-delegated about 504,000 YAM tokens, or roughly 3.3% of the token's total supply. That amount is just above the threshold needed for a governance proposal to pass. The attacker then filed proposal #45 on YamGovernorAlpha. The proposal body is empty, its data field is 0x, and the only action it performs is calling setPendingAdmin on the YAM Timelock contract. The target address in that call is the attacker's own address.
Defimon's alert explains what a successful vote would unlock. If the proposal is passed and executed, the attacker becomes Timelock's pendingAdmin. A follow-up acceptAdmin call would then hand over full control of Timelock. YAM's protocol contracts and the DAO treasury sit under Timelock's permission system, so the attacker could take over management of both. Defimon puts the value at risk at roughly $337,000.
YAM Finance has been dormant, Defimon noted, but the governance vote is still live. Defimon Alerts is telling YAM holders to vote against proposal #45 before block 25,897,343, about 34 hours away.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
