How $951 Bought a $8.5M Vote: The Term Finance Governance Exploit

Zero bugs. Zero hacks. Just a vote.

On August 23, 2026, at 06:25 UTC, an attacker executed a single parameterless function call on Ethereum and walked away with $8.5 million from Term Finance's vaults. No exploit in the traditional sense — no reentrancy, no overflow, no oracle manipulation. The smart contracts worked exactly as designed. The attacker simply voted.

This is the anatomy of a governance takeover — the kind of attack that no code audit would have caught, because the code was never the problem.

The Target

Term Finance is an Ethereum-based fixed-rate lending protocol. Its yield products — the Meta Vaults — sit on Yearn V3 infrastructure with a custom governance layer bolted on top. Users deposit ETH and USDC into these vaults, which then deploy capital across strategies in Aave, Morpho Blue, and other lending markets.

At the time of the attack, Term's vaults held roughly $12.45 million in TVL, with $8.8 million on Ethereum mainnet.

The governance design: vault depositors receive a governance token (tmvETH) proportional to their stake. Token holders vote on proposals that control vault parameters — which strategies to add, what fee structures to use, where capital flows. A 7-day timelock and an LP veto mechanism were supposed to prevent hostile proposals from executing.

All of this worked as intended. That was the problem.

The Kill Chain

Day 0 — August 17, 05:01 UTC: The $951 Coup

Block 25,772,572. A fresh wallet (0xa908b347...) receives 0.9945 ETH from an intermediary funded by Tornado Cash. Two ETH total — seed money.

Block 25,772,675 (twenty minutes later). The wallet purchases 0.4852 tmvETH — the governance token for Term's ETH Meta Vault — for approximately 0.5 ETH.

Cost: roughly $951.

The total staked supply of gtmvETH at that moment: 0.5352.

The attacker now controls 90.66% of all voting power in the ETH Meta Vault. Four USDC strategy vaults fall under full control as well — their governance participation was even thinner.

The entire defense model assumed the electorate would be large enough that no single buyer could reach a majority. It wasn't. The governance token market was so thin that the protocol's security reduced to a liquidity depth question — and no one was watching the depth.

Day 0 — Proposals Submitted

With 90.66% voting power, the attacker submits governance proposals to the affected vaults. The proposals contain two critical actions, ordered deliberately:

Action 1: Set the timelock cooldown to zero.

This is the move that made everything else possible. The 7-day timelock was the last line of defense — after a proposal passes, there's supposed to be a mandatory waiting period before execution. The attacker's first action upon execution removes that waiting period for all subsequent proposals. One vote to end all future delay.

Action 2: Add a new "strategy" contract.

In Yearn V3 architecture, strategies are the modules that deploy vault capital into external protocols. The attacker's "strategy" is a contract whose sole purpose is to route withdrawn funds to the attacker's address (0x184f2e57b4...). It looks like a strategy. It functions as a drain.

Day 1–5 — Silence

The proposals sit in the timelock queue. The 7-day waiting period ticks.

Term Finance had an LP veto mechanism — liquidity providers could reject hostile proposals during this window. Nobody vetoed. The governance forum showed no discussion of these proposals. The monitoring infrastructure either didn't exist or didn't trigger.

Five days of a loaded gun sitting on the table, and nobody noticed.

Day 6 — August 23, 06:25 UTC: Execution

Block 25,816,049. The attacker calls 0x373058b8 on the governance executor contract (0x64e47780...). A single function, no parameters. Execute.

What happens inside this transaction — 78 log events in total:

1. The timelock cooldown drops to zero (Action 1 fires)
2. The malicious strategy is added to the vault roster
3. The Meta Vault begins withdrawing from its real strategies:
   • Aave WETH pool: two sub-vaults redeemed
   • Morpho Blue (0xbbbbbbbb...): two withdrawals via Yearn V3 wrapper
   • Each redemption flows back through the Meta Vault aggregator (0x26fcb50e...)
4. Capital is routed to the attacker's strategy (0x184f2e57b4...)
5. The strategy forwards 2,841.74 WETH to the attacker wallet

Transaction: 0xd354a15b...

A separate execution drains the USDC vaults — approximately 1.68 million USDC, immediately swapped to DAI through on-chain DEX routes.

Total extraction: ~$8.5 million from a $951 investment.

Return on capital: 8,938x.

The Money Trail

Post-drain, the attacker moves quickly but not completely.

The 2,841 WETH is unwrapped to ETH and forwarded through a series of splitter contracts, all pointing to variations of 0xd518... addresses. Address poisoning tactics are visible in the transaction log — fake "EṬH" transfers (note the modified T character: Ṭ vs T) sent to similar-looking addresses, a social engineering technique targeting anyone monitoring the flow who might copy-paste the wrong destination.

As of this analysis, the consolidation wallet 0xD5183d8BfC65a50863C62aF2538198A8288FFc13 holds:

Approximately $670K has been spent on gas, forwarding, and partial exits. The bulk remains untouched — either the attacker is patient, or they're waiting for attention to die down.

Why Every Safeguard Failed

The Timelock Paradox

A 7-day timelock is only useful if someone is watching. Term Finance's governance participation was so low that the proposals passed with zero opposition. But the deeper design flaw is subtler: the timelock itself was governed by the same vote that it was supposed to protect against.

The attacker's first action — setting cooldown to zero — is the governance equivalent of using the first wish to wish for unlimited wishes. If the entity that controls the timelock is the same entity the timelock is supposed to constrain, the timelock is decorative.

The Veto That Wasn't

LP veto rights existed on paper. No LP exercised them. This isn't an implementation failure — it's a participation failure. The mechanism assumed LPs would:

1. Monitor the governance forum
2. Understand the proposals
3. Recognize the threat
4. Act within the window

Each assumption was individually reasonable. Together, they built a defense that required four human actions in sequence, any one of which could fail to happen. The attacker only needed one to not happen. It was all four.

The Token Distribution That Nobody Checked

The most fundamental failure: at the moment of attack, the governance token had a total staked supply of 0.5352 gtmvETH. The entire security model — the votes, the timelock, the veto — was downstream of a single assumption: that this number would be large enough to make a hostile majority prohibitively expensive.

It cost $951.

No monitoring system checked this number. No circuit breaker fired when a single address acquired 90% of voting power. The protocol treated governance token concentration as someone else's problem.

The Architecture Lesson

This exploit belongs to a class that traditional smart contract audits cannot catch. The code functioned correctly. The governance mechanism executed as specified. The timelock enforced its rules. Every require passed, every assert held, every state transition was valid.

The vulnerability was economic, not technical:

1. Governance security is a function of participation, not mechanism design. A perfectly designed voting system with 0.5 participants is less secure than a flawed one with 10,000.

2. Timelocks must not govern themselves. If a governance vote can modify the timelock parameters, the timelock provides exactly one window of protection — the first one. After that, the attacker owns the clock.

3. Token concentration is a security metric. Protocols that expose governance power through thin markets need circuit breakers: minimum quorum, concentration alerts, automatic pause when a single address crosses a voting threshold.

4. The veto window is a monitoring commitment, not a safety feature. A veto mechanism that nobody monitors is indistinguishable from no veto mechanism at all.

5. $951 is cheaper than an audit. The attacker spent less on this entire operation than most protocols spend on a single smart contract review. The audit would have found nothing — the code was clean. The governance design was the attack surface, and no auditor was looking at token distribution depth.

What Should Have Existed

• Minimum quorum: proposals below X% participation cannot execute, regardless of vote ratio
• Concentration alert: if a single address holds >Y% of voting power, governance enters emergency mode (pause + multisig override)
• Timelock immutability: core safety parameters (timelock duration, veto window) cannot be modified through governance — they require a multisig or are hardcoded
• Strategy whitelist with independent approval: new strategy contracts require approval from a separate security council, not the same governance that benefits from the strategy
• Active monitoring with auto-pause: governance proposal submission triggers alerts to all LPs, and proposals modifying safety parameters auto-escalate to a higher approval threshold

None of these are novel. All of them existed in other protocols before this attack. They just weren't implemented here.

Timeline

On-chain data sourced via Alchemy Ethereum mainnet RPC. All addresses and transaction hashes are independently verifiable on Etherscan.