Yam Finance has been hit by a malicious governance takeover attempt that could put about $337,000 in protocol assets at risk. The attacker self-delegated roughly 504,000 YAM, or about 3.3% of total supply, slightly above quorum, and submitted proposal No. 45 to YamGovernorAlpha. The proposal contains an empty description and a single action: calling the YAM Timelock’s setPendingAdmin(attacker). If passed and executed, the attacker would become pendingAdmin and could assume full control of the Timelock, which administers all YAM protocol contracts and the DAO treasury. The protocol is currently dormant, and YAM holders have about 34 hours, until block 25897343, to vote against the proposal.