YamFinance exploit analysis

Yam Finance's dormant DAO was hijacked on 2026-09-12 when an attacker bought 504,427 YAM (about 3.3% of supply), self-delegated it, and used the resulting voting weight to push a proposal setting the attacker as pendingAdmin of the YAM Timelock (proposal transaction, block 25884997). DeFiHackLabs reconstructs the takeover against the live YAM governance and Timelock on a mainnet fork.

The DAO had been dormant, with almost no active voting participation, so the 504K YAM stake alone cleared both the proposal threshold and the passage quorum. The attacker held 0 YAM at block 25884983 and 504,427 YAM one block later, acquired via an aggregator swap. With quorum cleared, the attacker submitted Proposal #45, a single action setPendingAdmin(attacker) on the YAM Timelock with an empty description, and voted it through the normal propose -> vote -> 5-day timelock -> accept cycle using real capital (no flash loan). After acceptance, the attacker held full admin control of the protocol and used it to drain the legacy UMA farming contracts.

DeFiHackLabs records a drain of ~$121K: 48.085 WETH plus 763.101 UMA.

The vulnerable assumption is that the proposal and passage thresholds are safe whenever the DAO is active: a dormant DAO reduces actual participation to near zero, so a relatively small stake can pass both thresholds. Setting pendingAdmin to an arbitrary address is the canonical hand-off, but the design relies on the proposal being voted down by a quorum of legitimate stakeholders.