On-chain fixed-rate lending protocol Term Finance has permanently shut down its Meta Vaults following a governance exploit, halting new deposits while keeping withdrawals open. Term Labs also revoked the vaults' decentralized autonomous organization governance roles.
Blockchain security firm PeckShield estimated that the attacker removed approximately 2,843 ether (ETH) valued at $6.87 million and 1.68 million USDC, which was subsequently swapped for about 1.68 million DAI. The total estimated drain is approximately $8.5 million, though Term Finance has not officially confirmed this amount or published vault-by-vault accounting.
How the Exploit Unfolded
Term's governance framework utilizes an opt-out system where vault liquidity-provider token holders can veto queued parameter changes during a seven-day delay before a change becomes executable.
According to an on-chain reconstruction by DeFiPrime, an ETH Meta Vault proposal remained open for six days without a veto. Upon execution, the proposal immediately set the delay cooldown to zero and routed 2,841.7435 wrapped ether (WETH) through a newly added strategy to an attacker-controlled address at 06:25 UTC on August 23.
A second transaction approximately 22 minutes later executed five proposals across five USDC vaults, removing 1,679,639.29 USDC. Term has not yet published a postmortem explaining how the proposer obtained authority to queue these actions or why veto and delay controls failed to stop them.
Impact and Scope
Yearn noted that while Term's vault contracts utilize Yearn V3 architecture, the exploit occurred specifically through Term's custom governance wrapper. Yearn stated that standard Yearn vault setups do not face this attack vector and remained unaffected.
Term Finance reported that its underlying protocol, along with direct borrowing and lending markets, were unaffected based on its preliminary investigations, limiting the confirmed impact strictly to the vault product.
Recovery and Next Steps
Term Finance stated it is coordinating with external security teams on remediation and recovery efforts. The protocol noted it would explore ways to address any potential shortfalls if they remain, though it has not committed to directly reimbursing depositors or provided a specific recovery timetable.
While withdrawals remain open, the protocol has not confirmed the liquidity or remaining value available to fulfill every withdrawal request given the lack of final accounting.
