TermFinance exploit analysis

The TermMax ETH meta-vault 0x26fCb50eEC367ddAB060ccf5E7394Cecd95F7Db2 (Yearn V3, tmvETH) is governed through an Aragon OSx TokenVoting plugin at 0x213771693a4411446b4ecce5bce4a405778b2171 whose voting token is 0x5b96c5bBdcB361E1E9944bAa071b237E27829Be0 (gtmvETH), a GovernanceWrappedERC20 wrapping the vault's own share token. Depositing into the vault grants no vote by itself; a holder must additionally wrap shares into gtmvETH and delegate. At the fork block, the entire wrapped supply was only 0.05 gtmvETH. A single depositor who wraps even ~1 share owns the overwhelming majority of voting power and can pass any proposal on a 50 percent support threshold, single-voter, well above the 5 percent participation floor.

The attacker (EOA 0xa908b3472d76e7744baB0A5911768a4a6300612B, drain sink "strategy" 0x184f2E57b4cE135181FA2A2166AC394339016338) carried out the governance capture in a single transaction on block 25816049 of Ethereum (0xd354a15b15cb73d30908f411aee3f795ec86737a4d080e9a818ac4d6d3014129). The attacker deposited WETH into the vault for tmvETH shares, wrapped the shares into gtmvETH, and used the wrapped voting power to create proposal 5 on the TokenVoting plugin. The malicious proposal carried 17 actions, executed in sequence via the Aragon DAO at 0x0ae12af3878a2d896f5c4dce3be7250fb187c0a6 and the Zodiac Roles modifier at 0xD9DdE54D99a27F0f0E2b282369BFaa95528e9B75, with the Zodiac Delay modifier at 0x35C99CF4a5DF2D9bCd822BeE32676D9590229e33 handling the queue-and-execute pairs.

The first three actions set the Delay cooldown to zero, set the Delay expiration to zero, and enabled the DAO as a Delay module. That last change lets the DAO queue and execute transactions atomically inside the single proposal.execute() call. The remaining actions queue and execute update_debt(strategy, 0, 10000) against each of the four real strategies to recall them, add_strategy(0x184f2E57..., false) to add the attacker strategy, update_max_debt_for_strategy(0x184f2E57..., type(uint256).max) to raise its cap, and finally update_debt(0x184f2E57..., type(uint256).max, 10000) to push the recalled WETH out into the attacker strategy. The attacker strategy's deposit hook forwards WETH to the attacker EOA.

The on-chain drain totalled ~2,841.743535791961701401 WETH, the vault's withdrawable liquidity at block 25816049. The four real strategies were only partially liquid, so each update_debt(strategy, 0) pulled back less than the strategy's full debt; e.g. 1445.51 WETH was recalled against a 1521.07 WETH debt on one strategy.

This is a governance vote won by supplying nearly all of the tiny wrapped voting supply, not a signer compromise. The fix is to require a minimum live quorum of gtmvETH above some threshold (say 100,000 wrapped shares) before any proposal can pass, and to gate add_strategy behind a longer queue window independent of the captured Delay.