Term Finance Exploit Highlights Risks of Low-Participation Governance Systems

A recent exploit on Term Finance, a decentralized finance (DeFi) protocol, has left many in the crypto community wondering about the security of vaults. An attacker spent just $951 to seize enough voting power to drain $8.5 million from the platform.

The attack was possible due to low participation and misaligned incentives in governance systems. According to PeckShield, a blockchain security firm, the exploiter drained roughly 2,843 ETH (worth about $6.87 million) and 1.68 million USDC (worth roughly $1.68 million), with the USDC already swapped into 1.68 million DAI.

Psykeeper drew a comparison to the BonkDAO exploit from July, where a malicious governance proposal drained roughly $20 million. The structural difference here is that the Term Finance attacker only needed to spend $951 to accumulate enough voting power, whereas the BonkDAO attacker needed to spend millions of dollars.

Glider's co-founder posted bluntly that people should simply stop using vaults, citing a fundamentally misaligned incentive structure running through the entire category. He argued that curators are incentivized to take on more risk to advertise higher APRs, and teams building these vaults are constantly hunting for the cheapest possible audits.