Defimon: YAM Finance was attacked by a governance takeover, and the attacker submitted an empty proposal to attempt to control the Timelock

The security company Defimon issued an alert stating that a governance takeover attack against YAM Finance has been detected. After self-delegating approximately 504,000 YAM (about 3.3% of the total supply, slightly above the legal voting threshold), the attacker submitted YamGovernorAlpha proposal #45, which is described as empty ("0x"), with the sole action being to call the setPendingAdmin method of the YAM Timelock contract, pointing to the attacker's address.

It has been disclosed that if the proposal is voted through and executed, the attacker will become the pendingAdmin, and then can fully control the Timelock through acceptAdmin, which includes management rights over all YAM protocol contracts and the DAO treasury, involving a risk amount of approximately $337,000. As the protocol is currently in a dormant state, Defimon Alerts reminds users holding YAM to vote against the proposal before block height 25897343 (about 34 hours remaining).