YAM Faces Governance Takeover Attempt
Security monitoring agency Defimon reported that YAM Finance is experiencing a governance takeover attack: the attacker self-delegated approximately 504,000 YAM and submitted proposal 45 to YamGovernorAlpha, attempting to seize the protocol's Timelock admin rights.
The voting power controlled by the attacker accounts for about 3.3% of the total YAM supply, slightly above the legal proposal threshold. The attack does not rely on flash loans, oracle price manipulation, or contract reentrancy vulnerabilities, but instead exploits the conditions of a long-dormant governance system where tokens are dispersed, voting participation is low, and governance thresholds are relatively low to gain sufficient proposal rights.
The description field of proposal 45 is simply "0x", providing no readable governance explanation to ordinary voters; its only execution action is to call the YAM Timelock's setPendingAdmin function, setting the pending admin address to the attacker's controlled wallet. This structure hides the malicious control transfer within minimal on-chain call parameters.
If the vote passes and Timelock executes this call, the attacker will first become pendingAdmin; then they can call acceptAdmin to complete the transfer of admin rights. Timelock admins typically have the ability to queue, cancel, or execute privileged calls on protocol-controlled contracts, thus extending control to YAM protocol contracts and the DAO treasury.
Defimon estimates that the threatened assets amount to about $337,000. The attacker does not need to first steal user private keys or breach the underlying security of the smart contracts; as long as they gain approval in the governance vote and cross the timelock window, they can transfer control of the treasury and protocol parameters through legitimate contract permissions.
The voting deadline block is 25897343, and Defimon estimated about 34 hours remaining at the time of the alert. If YAM holders still possess undelegated or voteable tokens, they can vote against the proposal to prevent it from meeting the approval conditions; however, the voting results, quorum, actual delegation status of tokens, and whether the proposal has been canceled must be based on real-time on-chain data from the governance contract.
In market mechanisms, the attacker is the buyer or controller of YAM governance rights, while potential sellers are holders who do not participate in governance, fail to delegate in time, or cannot organize votes before the deadline. If the proposal fails, the funds remain within the DAO control system; if the proposal succeeds, assets may be transferred from the treasury to the attacker's address, and YAM token holders will bear the pressure of governance credit collapse and liquidity exit. This risk may not pose a significant market shock to YAM's overall market value, but it will directly test the governance defenses of the dormant DAO.
Source: Public Information
ABAB AI Insight
YAM Finance gained rapid popularity during the DeFi summer of 2020 as an elastic supply algorithm stablecoin project, but shortly after launch, governance contract code flaws caused the re-minting mechanism to fail, forcing the team to migrate proposals to transfer community assets and governance rights to a new contract. The project has since undergone multiple product and governance adjustments, with decreasing activity. The current attack continues YAM's historical issues: the protocol code itself may not need to present new vulnerabilities, but when governance tokens lack voting participation for a long time and rights remain concentrated in Timelock, control can be seized through low-cost accumulation of token votes.
In terms of capital pathways, the attacker first accumulates or acquires approximately 504,000 YAM in delegated voting rights, then submits a proposal just above the threshold. The proposal itself does not require public declaration of "moving the treasury" but instead first points Timelock's pendingAdmin to the attacker; only after the admin accepts the rights can they schedule broader asset transfers or protocol modifications. Funds do not directly flow out of user wallets but are first legally seized through governance to obtain the keys, then managed with admin rights over the treasury. This pathway's cost is typically lower than directly attacking high-security multi-signatures or seeking underlying contract vulnerabilities.
Historically, Beanstalk faced a governance attack in 2022, where the attacker used flash loans to acquire significant governance rights, pushed malicious proposals, and stole about $182 million; the Term Finance incident in 2026 also showed that once governance layer rights are seized, if timelock and voting veto mechanisms cannot act in time, the treasury may be drained in a single governance sequence. YAM shares commonalities with these cases in that governance rights themselves become an attack surface; the difference is that the disclosed YAM attack appears to rely on low liquidity governance tokens that are held or delegated for a long time, rather than short-term flash loan voting.
This represents capital concentration. The ideal of a DAO is to distribute control to token holders, but whether governance rights are truly dispersed depends on active voting rights, not total supply. In dormant protocols, when most token holders do not vote, delegation relationships fail, or proposals are ignored, a small number of mobilizable tokens can control key permissions. Timelock can only provide reaction time; it cannot replace quorum, proposal whitelists, emergency multi-signatures, permission hierarchies, and minimum delay constraints; when "no one participates" becomes the norm, decentralized governance will sell control at a discount to the most willing actors.
ABAB News · Cognitive Laws
Token dispersion does not equal power dispersion
Silent holders voted for the attacker
Timelock can delay attacks but cannot replace governance