YAM Finance is facing an attempted governance takeover after an attacker accumulated enough delegated voting power to submit a proposal that could hand over control of the protocol’s Timelock and expose roughly $337,000 in assets.
According to Defimon, the on-chain monitoring service operated by security firm Decurity, an address self-delegated approximately 504,000 YAM tokens, representing about 3.3% of the token supply. That stake was just enough to clear the governance quorum. The attacker then submitted YamGovernorAlpha proposal #45 with an empty “0x” description. The proposal contains a single call to the YAM Timelock contract’s setPendingAdmin function, designating an attacker-controlled address as the pending administrator.
If the proposal passes and is executed, the attacker could call acceptAdmin to complete the transfer of administrative control. Taking over the Timelock would give the attacker authority over administrative functions governing YAM protocol contracts and the DAO treasury. Defimon estimated that about $337,000 is currently exposed if the proposal succeeds.
The security firm urged YAM holders to vote against the proposal before block 25,897,343. At the time of the alert, holders had roughly 34 hours to respond. YAM Finance has been largely dormant, which Defimon noted makes governance systems vulnerable when low participation allows a relatively small concentration of delegated tokens to meet voting requirements.
The attempted YAM takeover follows several governance attacks against inactive or lightly monitored decentralized organizations. In August, an attacker took control of StrongBlock’s abandoned governance system and drained about $72,000 worth of STRONG and STRNGR tokens. Another attack targeted Term Labs, where an attacker spent roughly $951 to acquire governance control and later drained about $8.5 million from strategy vaults. In July, a BonkDAO governance attack moved around $20 million from its treasury after an attacker accumulated enough BONK voting power to clear quorum.
For YAM Finance, no treasury funds have been reported lost so far, but the warning remains focused on proposal #45. The outcome depends on whether remaining YAM holders participate and vote against the proposal before the governance deadline.
