YAM Finance Governance Attack Puts $337K in Assets at Risk

A governance attack on YAM Finance has put approximately $337,000 in assets at risk. The attacker accumulated enough delegated YAM voting power to submit a proposal that could grant control of the protocol's Timelock and administrative functions.

The proposal, #45, seeks to make the attacker pending administrator of the YAM Timelock contract. If executed, it would give the attacker control over the YAM protocol contracts and its DAO treasury.

Defimon, an on-chain monitoring service operated by security firm Decurity, detected the attempt after an address self-delegated approximately 504,000 YAM tokens, representing around 3.3% of the token's supply and enough voting power to move just above the governance quorum.