On August 23, an Ethereum fixed-rate lending protocol called Term Finance had an incident. The attacker didn’t exploit any contract vulnerabilities; instead, they bought enough governance token voting power and then used the protocol’s own voting process to transfer the money out of the treasury. 2,843 ETH plus 1.68 million USDC—about $8.5 million in total—was just gone.
The key lesson to remember from this: even after a contract audit, it can still be breached by the governance layer. The governance token’s liquidity was too thin—whoever had money could buy the voting power cheaply. A seven-day timelock and LP veto rights weren’t enough this time.
Anyone building in DeFi needs to understand that funds locked in the treasury aren’t really sitting in a safe. The keys to change the rules are held by whoever has control, which is worth watching even more than the code itself. What is this—buy a few coins and you’re basically God.
#DeFi #安全防护
The key lesson to remember from this: even after a contract audit, it can still be breached by the governance layer. The governance token’s liquidity was too thin—whoever had money could buy the voting power cheaply. A seven-day timelock and LP veto rights weren’t enough this time.
Anyone building in DeFi needs to understand that funds locked in the treasury aren’t really sitting in a safe. The keys to change the rules are held by whoever has control, which is worth watching even more than the code itself. What is this—buy a few coins and you’re basically God.
#DeFi #安全防护
