Ampleforth governance under attack: suspicious proposal seeks to drain $2.5M treasury via malicious governance vote exploiting low quorum requirements.
Security & Exploits ·
Ampleforth's governance system faces a critical threat from a malicious proposal seeking to drain its entire treasury. A newly created account with minimal transaction history submitted proposal #54 to transfer 2,500,000 USDC—nearly all of the protocol's 2.538M USDC holdings—to itself under the guise of a grant for completed work. The proposer disclosed that it would self-vote through a delegate holding 87,238 FORTH tokens, just clearing the 75,000 minimum threshold for proposal eligibility.
The exploit hinges on Ampleforth's low quorum requirement of 600,000 FORTH tokens, valued at approximately $132,000 at the FORTH token price of $0.22. This creates a significant asymmetry: an attacker needs only that relatively modest amount of voting power to pass a measure worth $2.5 million. The proposal's structure—combining governance manipulation with treasury access—reveals a design gap in the protocol's safeguards against low-participation voting.
It remains unclear whether other governance stakeholders have noticed or will mobilize to block the measure before voting concludes. No details have been disclosed on the proposal timeline, voting period length, or whether meaningful opposition has mobilized among larger FORTH holders.