The Term Finance Exploit: $8.5M Approved by Silence

What to check if you hold curated-vault shares

The summary explains how the drain happened. What it can't carry is the page's operational payload: the drain left the vault's on-chain accounting lying, and the page gives the exact calls to expose it.

On the ETH Meta Vault, totalAssets() still returns 2,926.22 WETH and convertToAssets(1e18) still prices each tmvETH share at 1.0308 WETH — while the vault's actual WETH balance is zero. The gap is deliberate accounting: strategies(0x184f2e57…) reports a currentDebt of 2,841.7435 WETH against a maxDebt of type(uint256).max, so the books treat the stolen funds as "out on loan" to the attacker's "Fixed Recipient WETH Exit Strategy" rather than gone. Until someone writes that position down, the share price is fiction, and any dashboard, integrator, or vault holding tmvETH inherits it. This is why DefiLlama showed TermFinance Vaults down only ~$450K after an $8.5M drain — the TVL feed was reading the broken accounting.

The page's direct advice to anyone in a Term vault: check your own vault's governor, not a dashboard — whether there is a live proposal, who created it, and what its payload actually calls. Note that Term's own recovery is queued behind the same veto window (proposals 6 and 7, including a "shutdown vault" proposal, go through the same opt-out queue the attacker waited out).

Fixes the page names

Beyond the postmortem question of how an unprivileged address got proposing rights, the page states four concrete design fixes:

• Keep cooldown changes behind their own cooldown, or out of governance reach entirely — the timelock was deletable by the same proposal it guarded (setTxCooldown(0) was action one of seventeen).
• A proposal threshold scaled to the vault — 0.5 ETH bought 0.017% of a 2,841 ETH vault and that was enough to put a proposal on the ballot.
• A proposer bond forfeited if a veto passes, to change the economics of trying.
• Someone actually reading the veto queue — the opt-out design converts silence into authorization.

Caveats

The page explicitly corrects an early alert (Defimon) that called this an attacker "cheaply acquiring a majority" of a governance token. The logs show no majority: 0.017% on ETH, a rounding error (0.0000156%) on USDC. Reading it as a token-supply problem points at the wrong fix. The page also flags its own numbers as provisional in places and notes no Term post-mortem existed at writing; the core open question — how a stranger got proposing rights at all — is unresolved and is the one part the author calls a genuine defect rather than the system working as designed.