Update on Yam.finance governance takeover
The attacker executed proposal #45 and took Timelock admin. They then cut the Timelock delay from 5 days to 12 hours and made themselves gov of Yam's old UMA farming contracts. Calling _settleExpired() released the WETH collateral from their expired uGAS positions. The attacker then pulled everything out with the gov-only masterFallback function, which lets the gov make any call from the contract.
Extracted (~$121K):
• UMAFarmingMar (uGAS-MAR21): 23.50 WETH + 763 UMA
https://etherscan.io/address/0xffb607418dBEaB7A888e079A34Be28A30d8E1DE2
• UMAFarmingFeb (uGAS-FEB21): 24.59 WETH
https://etherscan.io/address/0xc0AE1e1e172ECD4C56fD8043FD5Afe5a473E9835
The proceeds (48.15 ETH) were cashed out via FixedFloat.
Post #3301
919
Defimon Alerts Community alert: Defimon detected a governance takeover attempt of Yam.finance Attacker self-delegated ~504K $YAM (~3.3% of supply, just over the quorum) and submitted YamGovernorAlpha proposal #45 with an empty description ("0x"). The single action calls…
- 🔥 6
- ❤ 3
- 😱 2
- 🤣 1