A $951 vote took $8.5M from Term Finance, and no audit was ever going to catch it

A controlling stake in Term's ETH Meta Vault cost 0.5 ETH, roughly $951 at the time ^[4]. Set that against the $8.8 million the vaults held on mainnet ^[6] and the buyer had put up about one hundredth of one percent of the capital he was about to direct ^[1]. The four USDC strategy vaults had even thinner governance participation ^[5], which is to say they were cheaper.

The ordering of the two proposal actions is the part worth studying. Action one set the timelock cooldown to zero. Action two registered a contract that presented as a Yearn V3 strategy and existed only to forward withdrawn capital to the attacker ^[8]. The design named two protections, a seven-day timelock and an LP veto ^[7]. The first was a parameter that the process it was meant to restrain could rewrite. The second required a person to be watching.

Between the token purchase and the execution call, 43,374 blocks passed ^[3]. The published account describes five days of queued proposals against a stated seven-day timelock ^[16][7], so either the cooldown was shorter than advertised or the narrative timeline is loose; a post-mortem would settle it. It does not disturb the finding. No LP exercised the veto, the governance forum carried no discussion of the proposals, and monitoring either did not exist or did not fire ^[10]. Execution itself was one call to a no-parameter function on the governance executor, unwinding into 78 log events ^[11].

The dollar headline deserves a check, because it is doing a lot of work. What actually left was 2,841.74 WETH through the fake strategy, plus about 1.68 million USDC from the stablecoin vaults, swapped immediately to DAI ^[12]. Take the USDC leg at par and the $8.5 million total implies roughly $2,400 per WETH ^[4]. The much-quoted 8,938x return ^[13] therefore rests on an ETH mark as much as on the mechanics, which is worth remembering when this figure gets cited as the record price of a governance capture.

Now the audit question. By the account's own description, the smart contracts did what they were written to do, with no reentrancy, no overflow and no oracle manipulation involved ^[2], and the author's conclusion is that the code was never the problem ^[15]. A code review verifies that the implementation matches the intent. It does not price the intent. The variable that determined this outcome was the staked supply of the governance token, a public balance sitting outside the contracts under review, and the defense rested on an assumption that the electorate would stay too large for one buyer to take it ^[9]. Nobody was measuring the depth ^[9].

The extraction came to about 97 percent of mainnet TVL and roughly 68 percent of the protocol's total across chains ^[2]. Depositors got voting tokens in proportion to what they put in ^[7]. The instrument that recorded their claim on the vault was the instrument used to sign it away.