Security monitoring agency Defimon reported that YAM Finance is experiencing a governance takeover attack: the attacker self-delegated approximately 504,000 YAM and submitted proposal 45 to YamGovernorAlpha, attempting to seize the protocol's Timelock admin rights.

The voting power controlled by the attacker accounts for about 3.3% of the total YAM supply, slightly above the legal proposal threshold. The attack does not rely on flash loans, oracle price manipulation, or contract reentrancy vulnerabilities, but instead exploits the conditions of a long-dormant governance system where tokens are dispersed, voting participation is low, and governance thresholds are relatively low to gain sufficient proposal rights.

The description field of proposal 45 is simply "0x", providing no readable governance explanation to ordinary voters; its only execution action is to call the YAM Timelock's setPendingAdmin function, setting the pending admin address to the attacker's controlled wallet. This structure hides the malicious control transfer within minimal on-chain call parameters.

If the vote passes and Timelock executes this call, the attacker will first become pendingAdmin; then they can call acceptAdmin to complete the transfer of admin rights. Timelock admins typically have the ability to queue, cancel, or execute privileged calls on protocol-controlled contracts, thus extending control to YAM protocol contracts and the DAO treasury.

Defimon estimates that the threatened assets amount to about $337,000. The attacker does not need to first steal user private keys or breach the underlying security of the smart contracts; as long as they gain approval in the governance vote and cross the timelock window, they can transfer control of the treasury and protocol parameters through legitimate contract permissions.

The voting deadline block is 25897343, and Defimon estimated about 34 hours remaining at the time of the alert. If YAM holders still possess undelegated or voteable tokens, they can vote against the proposal to prevent it from meeting the approval conditions; however, the voting results, quorum, actual delegation status of tokens, and whether the proposal has been canceled must be based on real-time on-chain data from the governance contract.

In market mechanisms, the attacker is the buyer or controller of YAM governance rights, while potential sellers are holders who do not participate in governance, fail to delegate in time, or cannot organize votes before the deadline. If the proposal fails, the funds remain within the DAO control system; if the proposal succeeds, assets may be transferred from the treasury to the attacker's address, and YAM token holders will bear the pressure of governance credit collapse and liquidity exit. This risk may not pose a significant market shock to YAM's overall market value, but it will directly test the governance defenses of the dormant DAO.

Source: Public Information