The Seven-Day Timelock Worked. Nobody Used It.
Term Finance did not lose an estimated $8.5 million because its seven-day timelock failed to count down. It lost the money after a malicious governance proposal remained visible for six days, attracted no veto and used its first executable actions to remove the remaining delay.
The incident is a useful correction to a common security assumption. A control can be present in the architecture, correctly implemented in code and still provide no protection if nobody is responsible for watching it, understanding what a proposal can do and acting before the window closes.
Term Labs acknowledged a governance exploit affecting Term vaults on 23 August 2026. Blockchain security firms PeckShield and CertiK estimated that approximately 2,843 ETH and 1.68 million USDC were taken, putting the value near $8.5 million. The USDC was subsequently converted to DAI, according to reporting by The Block.
That dollar figure remains an external estimate. Term Labs has not published a final loss accounting, and the distinction matters because vault accounting can continue to represent assets as deployed to a strategy even after the strategy has forwarded the underlying tokens elsewhere.
The proposal was not hidden
A detailed on-chain reconstruction by DeFiPrime places the start of the ETH-side operation on 17 August. A wallet received 1 ETH from Tornado Cash, deposited 0.5 ETH into the ETH Meta Vault and received 0.4852 tmvETH. Minutes later, a newly deployed contract created proposal 5.
The position represented only about 0.017% of the vault’s share supply, according to the transaction analysis. Yet it was sufficient to create a proposal containing 17 actions. The payout contract’s address appeared repeatedly in the payload. The proposal then remained on-chain for six days. One vote was cast, by the attacker. No veto followed.
The execution began at 06:25:47 UTC on 23 August, twelve seconds after the voting window closed. A second transaction followed at 06:47:47 UTC against five USDC vaults whose proposals had been created two days earlier. Those proposals reportedly contained an empty summary and description.
The timelock was alive until the transaction spent it
Term’s own governance documentation describes a Gnosis Safe protected by a seven-day timelock through a Zodiac Delay Module. Actions flow from a Proposer Safe to the delay module, then to the Governor Safe and finally to the vault. Vault LPs act as DAO members and can invalidate a queued transaction by voting to skip it.
That design assumes the review period is an active operational process. Someone must detect a new proposal, decode its complete action list, assess every target and parameter, reach the people able to veto it and verify that the veto has actually invalidated the queued transaction.
According to the on-chain reconstruction, the delay module still reported a 608,400-second cooldown one block before the exploit. The first actions in the approved payload then called setTxCooldown(0), set the expiration to zero and enabled the governance executor as a module. The remaining actions could consequently be queued and executed in the same block.
The proposal recalled WETH from strategies using Aave and Morpho, added a new strategy named “Fixed Recipient WETH Exit Strategy”, assigned it effectively unlimited debt capacity and deposited the vault’s WETH into it. The strategy forwarded 2,841.7435 WETH to the attacker’s wallet in the same transaction.
This is the most consequential architectural detail. The timelock was not missing. The proposal mechanism it was meant to constrain could reconfigure the timelock itself. The safety boundary depended on human review during the only period in which that authority could still be stopped.
Valid authority can be as dangerous as code execution
There is no public evidence that the attacker stole an administrator key, manipulated an oracle, used reentrancy or relied on a flash loan. The available evidence points instead to an attacker using the governance path and permissions the system already provided.
That distinction should not make the incident sound less technical or less severe. The attacker crossed a trust boundary from an economically tiny vault position to authority over assets worth millions. The transactions were accepted because the governance layer regarded them as authorised.
Security reviews often give most attention to whether a contract can be tricked into doing something its code forbids. Governance incidents ask a different question: what can the contract be instructed to do when the instruction arrives through an approved administrative path?
If governance can add strategies, assign unlimited debt, change security-module parameters or move assets, the governance surface is part of the protocol’s privileged execution layer. It needs the same threat modelling, telemetry and least-privilege design as any other administrative interface.
Yearn V3 was the foundation, not the failed boundary
Term Strategy Vaults implement the ERC-4626 interface and are built on Yearn V3’s modular vault architecture. That relationship could easily produce the wrong conclusion about the affected layer.
Yearn said the exploit occurred through a custom governance wrapper around the Term vaults and that the attack vector does not apply to standard Yearn vault configurations. It added that funds in standard Yearn vaults were unaffected.
The lesson is broader than this dependency. “Built on” does not mean “inherits every security property of”. A downstream protocol can introduce new authority, upgrade, governance and monitoring assumptions around a mature component. Depositors inherit those wrapper risks even when the underlying vault implementation behaves exactly as designed.
The accounting may lag the economic loss
DeFiPrime’s analysis also identified a less visible operational risk. After the transfer, the ETH Meta Vault could still report the missing WETH as debt allocated to the attacker-controlled strategy. A dashboard or integrator reading the vault’s accounting could therefore display assets that were no longer recoverable from the strategy.
This creates a second incident-response problem. Stopping further deposits is urgent, but so is ensuring that share prices, total-value figures and downstream integrations no longer rely on stale accounting. A governance compromise can propagate through data and composability even after the original outflow has ended.
Term has permanently closed the Meta Vaults
In an update early on 24 August, Term Labs said all Term Meta Vaults had been shut down and their DAO governance roles revoked. The shutdown is irreversible, blocks future deposits and leaves withdrawals open.
The team said its investigation had so far found that the underlying Term protocol and direct borrowing and lending markets were not affected. It is continuing to verify the scope, coordinate with external security teams and examine recovery options. If a shortfall remains, Term said it would explore ways to address it.
That containment sharply limits the immediate risk of the same vault-governance route being reused. It does not yet answer the recovery question, provide a final accounting or explain how the proposer and veto model came to permit the malicious actions.
What DeFi operators should change
- Treat governance monitoring as a staffed security control. Every proposal should generate an alert with an accountable recipient, escalation path, response deadline and proof that the payload was reviewed.
- Decode actions, not descriptions. A familiar title or empty summary is not evidence of a safe proposal. Monitoring must resolve the destination contracts, function selectors, parameters, module changes and asset flows before the review window expires.
- Do not let ordinary governance weaken its own containment. Changes to timelocks, guardian roles, modules, upgrade authorities and execution limits should require a separate, stronger path with a longer delay and independent approval.
- Set meaningful proposal and quorum thresholds. The right threshold depends on the system, but a negligible economic position should not gain unilateral authority over assets worth millions.
- Install automatic tripwires for dangerous combinations. A proposal that sets a cooldown to zero, enables a new module, assigns unlimited debt and routes the full balance to a new strategy should be blocked or paused even if it arrives through governance.
- Exercise the veto process. A documented veto is not a control until the right people can discover a hostile proposal, coordinate and invalidate it under realistic time pressure.
- Contain accounting as well as transfers. Incident plans should address stale strategy debt, incorrect share prices, dependent vaults, dashboards and integrators that may continue to trust compromised state.
The control window needs an owner
A seven-day delay sounds substantial. In this case, it was more than enough time for a defender to inspect the proposal and veto it. The problem was not the duration of the window. It was the absence of an effective process inside it.
Timelocks do not investigate. Governance tokens do not summon a response team. Transparent transactions do not become understandable merely because anyone can read them.
The Term Finance incident shows what happens when protocol security depends on someone noticing an authorised path before it becomes irreversible. The code waited. The proposal stayed visible. The veto never arrived.
