# Term Finance: governance capture via thin wrapped voting supply drains vault

Term Finance's Aragon governance token wrapped vault shares had only 0.05 supply, so one depositor wrapped ~1 share, captured voting power, and drained 2,841 WETH.

- Payout: Real-world hack
- Severity: critical
- Program: TermFinance
- Credited: DeFiHackLabs
- Disclosed: 2026-08-23
- Write-up quality: 8/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-08/TermFinance_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260823-termfinance
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:recon technique:source-review vuln:access-control vuln:business-logic vuln:governance

**Target:** Aragon TokenVoting governance plugin over Yearn V3 meta-vault (tmvETH/gtmvETH)
**Root cause:** The vault's Aragon TokenVoting plugin used a GovernanceWrappedERC20 (gtmvETH) wrapping the vault share token, but wrapping was optional and almost nobody did it, leaving total wrapped supply at ~0.05 gtmvETH; a single depositor wrapping ~1 share controlled overwhelming voting power.
**Steps:**
1. Fork mainnet at block 25772670 (before attacker deposit/wrap/proposal).
2. Deposit `1 ether` WETH into tmvETH vault `0x26fCb50e...` to mint shares.
3. Approve and `GT.depositFor(ATTACKER, shares)` then `GT.delegate(ATTACKER)` on gtmvETH `0x5b96c5bB...` to obtain near-total voting power.
4. Create malicious proposal via `PLUGIN.createProposal` with 17 actions: `Delay.setTxCooldown(0)`, `Delay.setTxExpiration(0)`, `Delay.enableModule(DAO)`, then queue+execute `vault.update_debt(strategy,0,10000)` for each real strategy, `vault.add_strategy(attackerStrategy,false)`, `vault.update_max_debt_for_strategy(attackerStrategy,type(uint256).max)`, `vault.update_debt(attackerStrategy,type(uint256).max,10000)`.
5. Vote Yes via `PLUGIN.vote(proposalId, 2, true)`; wait out MIN_DURATION 522000s.
6. Call `PLUGIN.execute(proposalId)`; zeroed cooldown lets each queue+execute pair run atomically, recalling strategy funds and pushing them into attacker strategy whose deposit hook forwards WETH to attacker EOA.
**How found:** Recognized that the governance token was a wrapper over vault shares and that wrapping was optional; checked on-chain wrapped supply (0.05 gtmvETH) versus the ~2,925 WETH vault, concluding a single wrapper would own majority voting power and could pass any proposal.
**Exploitation:** Attacker seeded 1 WETH, wrapped shares into gtmvETH to dominate the tiny 0.05 wrapped supply, passed a 17-action proposal on a 50% threshold single-voter, zeroed the Zodiac Delay cooldown so queue+execute pairs ran atomically in one execute() call, recalled all four real strategies' debt, added an attacker-controlled strategy with max debt cap, and pushed recalled WETH into it; the strategy's deposit hook forwarded funds to the attacker EOA, netting 2,841.74 WETH.
**Escalation:** Chained governance plugin -> DAO -> Zodiac Roles/Delay modifiers -> vault strategy management to convert a trivial 1 WETH stake into full vault drain; zeroing Delay cooldown collapsed the timelock so all 17 actions executed atomically.
**Insight:** When a protocol's governance token is an opt-in wrapper over deposit shares, compare total wrapped supply to TVL — if wrapping is rare, a tiny deposit buys majority voting power and full control of vault strategy parameters.