Proposal #45 Targets Control of YAM’s Timelock
YAM Finance is facing an attempted governance takeover after an address accumulated enough delegated voting power to submit a proposal that could hand it administrative control over the dormant DeFi protocol and its treasury.
Blockchain security monitoring service Defimon Alerts disclosed the attempt on September 2, saying the address self-delegated roughly 504,000 YAM tokens, equivalent to about 3.3% of the token supply and slightly more than the voting threshold required for the governance action.
The address then submitted Proposal #45 through YAM’s YamGovernorAlpha governance contract.
Unlike a conventional governance proposal describing a protocol upgrade or treasury decision, Proposal #45 carries an empty “0x” description and contains a single contract action: a call to setPendingAdmin on the YAM Timelock contract, with the proposed new administrator being an address controlled by the proposer, according to Defimon.
The distinction between pending administrator and administrator is important.
Passing and executing Proposal #45 would not immediately complete the transfer of control. It would first designate the address as the Timelock’s pendingAdmin. That address could subsequently call the acceptAdmin function to complete the administrative transfer.
If that sequence succeeds, Defimon said the address could gain control over YAM’s Timelock and, through it, administrative authority over protocol contracts and the DAO treasury. The security firm estimated that assets worth about $337,000 could be exposed.
Defimon urged YAM holders to vote against the proposal before Ethereum block 25,897,343. When the alert was issued, the security monitor estimated roughly 34 hours remained before that point.
The event remains different from a conventional smart-contract exploit in which an attacker discovers a coding vulnerability and immediately drains funds. The address appears instead to be using YAM’s existing governance machinery to attempt to obtain administrative privileges.
YAM describes itself as a protocol controlled by its tokenholders through on-chain governance. Its documentation says the system was built using Compound-style governance, with tokenholders able to approve protocol changes and treasury actions after delegating voting power. On-chain proposals historically proceed through a voting period before successful proposals pass through a Timelock prior to execution.
That design assumes active tokenholders will participate sufficiently to prevent unwanted proposals from passing.
Defimon specifically pointed to YAM’s dormant state when raising the alarm. The protocol’s relatively low level of current activity potentially makes governance participation more difficult to mobilize than it would be for an active DeFi project with a large community watching proposals every day.
YAM dates back to the first major wave of DeFi yield farming in 2020. It launched on August 11 of that year as an experimental protocol combining an elastic-supply token, a community-controlled treasury and decentralized governance.
Within its first day, YAM attracted hundreds of millions of dollars in deposited assets before developers discovered a bug in its rebasing code. The error caused substantially more YAM to be created for the protocol reserve than intended and threatened to make the governance quorum mathematically unreachable.
YAM’s own team said at the time that the coding error could leave treasury assets locked because governance would be unable to approve corrective actions. The original system ultimately failed to execute the rescue proposal, and the community later migrated to a revised version of the protocol.
The project subsequently disabled its rebasing mechanism and continued as a governance-focused DAO. By January 2021, YAM said its treasury had grown to several million dollars and had backed projects including Degenerative Finance and other community initiatives.
Six years later, its treasury is considerably smaller and the protocol is largely inactive, but the governance contracts remain consequential.
That combination is what makes Proposal #45 potentially dangerous: the protocol may be dormant, but administrative authority over its remaining assets has not disappeared with activity.
At the time Defimon raised the warning, the proposed transfer had not yet completed. The immediate issue for YAM holders is whether sufficient voting power can be mobilized before the proposal reaches the end of its governance process.
Dormant DAOs Can Become Easier Targets, Not Safer Ones
There is an uncomfortable irony in what is happening to YAM.
The protocol’s first crisis in 2020 involved a bug that made decentralized governance almost impossible to use. Its latest problem appears to come from the opposite direction: the governance system still works, but potentially too few people are paying attention to it.
That distinction matters.
Smart contracts do not become harmless when the community around them disappears. Treasury balances remain on-chain. Governance permissions remain active. Timelocks keep accepting transactions. Voting tokens continue to exist.
What can disappear is the social layer that is supposed to defend them.
In a healthy DAO, an obviously suspicious proposal asking to hand administrative control to an unknown address should attract immediate attention. Delegates can vote against it, community members can investigate the proposer and developers can warn users.
A largely dormant DAO may have exactly the same contracts but far fewer people watching.
That turns governance participation itself into part of the protocol’s security model.
The 504,000 YAM figure illustrates the problem well. Defimon calculates that it represents only around 3.3% of supply, yet it was enough to put the proposal into play.
An attacker does not necessarily need majority ownership of a governance token if most of the remaining supply does not participate. What matters in practice is how much active voting power can be assembled under the rules of the particular DAO.
This is one reason describing every such event as a “51% attack” can be misleading. The attack surface is not necessarily ownership of more than half the token. It can be the gap between theoretical token distribution and actual governance participation.
YAM is an unusually clear example because the requested permission is so direct. Proposal #45 is not hiding the administrative transfer inside a complicated protocol upgrade. Its single action would make the proposer the pending administrator of the Timelock.
There is another important difference from many hacks: the community has a window in which to respond.
That is one of the purposes of governance voting periods and Timelocks. They create delays between proposing a sensitive action and executing it, giving tokenholders time to recognize something dangerous.
But a delay protects assets only when someone is watching.
The incident therefore raises a broader question for DeFi projects that have effectively wound down but still control treasuries: who remains responsible for monitoring governance?
Leaving a DAO technically decentralized indefinitely may sound cleaner than appointing custodians or winding down contracts. In practice, abandoned governance can create its own security risk. A treasury worth $337,000 may be too small to justify maintaining a full development organization, but it can still be large enough to attract someone willing to acquire or concentrate enough voting power to attack it.
YAM’s history makes the lesson particularly sharp. It was launched as an experiment in decentralized governance, survived one of DeFi’s earliest governance emergencies and once controlled a treasury worth several million dollars.
Now the experiment is testing another edge case.
Decentralization works when tokenholders can act. A governance system with nobody governing it can eventually become an unguarded set of administrative keys — except those keys are obtainable through a vote.