Decentralized lending protocol Term Labs suffered a governance attack that resulted in $8.5 million being drained from its vaults in ETH and DAI. The incident comes shortly after other high-profile exploits in the Web3 space, including attacks affecting Maya Protocol and The Sandbox.
Term Labs, the creator of Term Finance, offers fixed-rate ETH loans and utilized Aragon as its governance platform. According to initial on-chain data, the attacker's wallets were funded with 2 ETH coming from Tornado Cash.
The attacker executed the exploit by utilizing governance influence rather than a malicious code exploit. Term Labs vaults allowed users to deposit funds and optionally wrap their vault deposit into governance tokens by manually turning share tokens into a special governance token. The attacker performed this second step to gain control of four of the five drained vaults by holding 100% of the governance token, despite holding tokens worth only a few dollars.
On August 17, the attacker submitted a proposal containing hidden actions that were not immediately visible to voters. Following a six-day waiting period, the attacker successfully changed vault parameters to drain funds from five USDC lending vaults. The stolen funds were subsequently parked in a single wallet holding approximately $1.6 million in DAI and $6.9 million in ETH, and have not yet been mixed or moved.
Prior to the incident, Term Finance vaults held $12.25 million, meaning the exploit nearly drained the protocol's entire lending capabilities. Term Labs announced that the exploit impacted some of its vaults, with the real impact and further details subject to ongoing investigation.
