Yam Finance governance takeover drains $121K from old UMA contracts
Security & Exploits ·
An attacker used self-delegated YAM votes to seize control of the protocol's dormant Timelock and empty leftover UMA farming pools.
An attacker took over Yam Finance's governance by pushing through proposal #45 with self-delegated YAM votes, gaining admin control of the protocol's Timelock, according to a report. Once in control, the attacker shortened the Timelock delay from 5 days to 12 hours, making it faster to execute further privileged actions without waiting out the original governance window.
With admin rights secured, the attacker made themselves governor of Yam's old UMA farming contracts, which had been left dormant since the protocol's earlier farming programs ended. Calling the _settleExpired() function released WETH collateral tied to expired uGAS positions, freeing funds that had been sitting untouched in the contracts.
The attacker then used the gov-only masterFallback function, which allows the contract's governor to execute arbitrary calls, to pull the released funds out entirely. Extracted amounts included 23.50 WETH plus 763 UMA from the UMAFarmingMar contract tied to uGAS-MAR21, and 24.59 WETH from the UMAFarmingFeb contract tied to uGAS-FEB21, together totaling roughly $121K.
The proceeds, amounting to 48.15 ETH, were cashed out through FixedFloat. Two sources in the cluster corroborate the mechanics of the takeover and the drained figure, describing an attacker gaining control of governance, cutting the Timelock delay, and draining the legacy UMA farming contracts via privileged functions.
Unresolved is whether Yam Finance or UMA plan any response to the leftover contracts that were exploited, and whether other dormant governance-controlled contracts from the same era carry similar exposure. No statement from either protocol has been included in the material reviewed.