YAM Finance Faces Governance Takeover Attack, Attacker Submits Empty Proposal to Control Timelock

Security firm Defimon has issued an alert detecting a governance takeover attack on YAM Finance. The attacker self-delegated approximately 504,000 YAM (3.3% of the total supply) and submitted an empty proposal, YamGovernorAlpha proposal #45. The only action of this proposal is to call the setPendingAdmin method of the YAM Timelock contract, pointing to the attacker's address. If the proposal is voted through and executed, the attacker will become the pendingAdmin and can subsequently take full control of the Timelock via acceptAdmin, managing all YAM protocol contracts and the DAO treasury, with a risk amount of approximately $337,000. Defimon Alerts advises users holding YAM to vote against this proposal before block height 25897343 (approximately 34 hours remaining).

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.