Term Labs $8.5M Governance Takeover: How 0.5 ETH Bought Majority Control of Six Vaults

An attacker spent roughly 0.5 ETH on opt-in governance tokens to capture majority voting weight, then zeroed the time-delay and instantly drained six Term Labs Meta Vaults for $8.5M in WETH and USDC.

Root Cause

Term Labs Meta Vaults delegated governance power to holders of a wrapped depositor token (frWETH). The wrapping step was opt-in — regular depositors almost never performed it — so the effective governance quorum was near-empty. An attacker spent approximately 0.5 ETH to acquire a supermajority of the circulating wrapped supply.

// Simplified: opt-in wrap mints governance tokens
function wrap(uint256 amount) external {
    underlying.transferFrom(msg.sender, address(this), amount);
    _mint(msg.sender, amount); // only callers of this function have voting power
}

// The governance module tallied _only_ wrapped balances for quorum:
function getVotes(address account) public view override returns (uint256) {
    return balanceOf(account); // frWETH balance, not underlying deposit
}

Because almost no legitimate depositors wrapped their tokens, the attacker's small wrapped position represented ~100% of the active voting supply.

Attack Steps

Step	Action	Detail
1	Acquire governance tokens	Buy/wrap ~0.5 ETH worth of `frWETH`; captures supermajority
2	Submit proposal: zero time-delay	Propose setting governance timelock delay to 0
3	Pass with own votes	No meaningful opposition; delay-zero proposal passes
4	Submit drain proposal	With 0-second delay, a second proposal executes immediately
5	Deploy `frWETH-EXIT` sweep contract	Custom contract receives and forwards WETH from all 6 vaults
6	Drain WETH	2,841.74 WETH (~$6.87M) swept via `frWETH-EXIT`
7	Sweep USDC via counterfeit token	Counterfeit token priced at the full liquid USDC balance of vaults used to redeem 1,679,639 USDC
8	Convert USDC → DAI	Swapped to DAI for exfiltration

Impact

Total loss: ~$8,500,000
Assets: 2,841.74 WETH + 1,679,639 USDC (converted to DAI)
Chains: Ethereum mainnet
Protocols: Term Labs Meta Vaults (6 vaults drained)
Date: August 23, 2026; widely confirmed and reported September 2026

Lessons for Auditors

Governance quorum must track underlying principal, not opt-in derivative tokens. If only 0.1% of depositors hold the governance token, quorum is meaningless.
Governance time-delays should be immutable or require an overwhelming supermajority to shorten. A single malicious proposal that zeroes the delay collapses all subsequent safeguards.
Audit the interplay between vault accounting and governance: verify that vault shares / deposit receipts cannot be used to price a counterfeit token at full underlying value.
Deploy dispute-monitoring bots for any on-chain governance with a delay mechanism; automated alerting would have surfaced both the delay-zero proposal and the drain proposal before execution.
Verify that getVotes() returns a value proportional to locked/deposited assets rather than a separately-mintable token whose supply can be gamed cheaply.