YAM Finance Governance Attacked, Attacker Submits Empty Proposal in Attempt to Control Timelock

BlockBeats News, September 2nd, cybersecurity firm Defimon issued an alert stating that a governance takeover attack against YAM Finance has been detected. The attacker self-delegated approximately 504,000 YAM tokens (about 3.3% of total supply, slightly above the required voting threshold) and submitted YamGovernorAlpha proposal #45, which had an empty description ("0x"), with the sole action of calling the setPendingAdmin function of the YAM Timelock contract, pointing to the attacker's address.

It was disclosed that if the proposal is successfully voted on and executed, the attacker would become the pendingAdmin, allowing them to fully control the Timelock, which governs all YAM protocol contracts and the DAO treasury, involving a risk amount of approximately $337,000. As the protocol is currently in a dormant state, Defimon Alerts reminded YAM holders to vote against this proposal before block height 25897343 (approximately 34 hours remaining).