DeFi governance gap lets one wallet try to grab 98% of Ampleforth’s USDC
What went down
Ampleforth’s governance almost served up a gasp-worthy moment: a proposal was submitted that would have moved roughly 2.5 million USDC from the protocol treasury to the account that created the proposal. That amount was nearly the entire USDC balance shown on the treasury snapshot at the time — about 98% of the protocol’s USDC and around 70% of its total displayed holdings.
The proposal was labeled Proposal 54. It was created shortly after a single wallet delegated a huge chunk of FORTH voting power to the proposing address — about 87,238.5461 FORTH — and then the proposal appeared on-chain roughly 19 minutes later. Before any public vote ever started, the proposal was canceled on-chain, and no funds moved.
Why this matters (and why governance can be weird)
The Ampleforth governance contract contains a mechanism that lets a proposal be canceled if the proposer’s voting power in the previous block drops below the required threshold. The on-chain sequence here matches that rule: concentrated voting weight was given to a proposer, a proposal was submitted, and then the voting power situation changed and the proposal was canceled. That flow explains the mechanics but doesn’t prove intent or point fingers — it just shows how the smart contract’s rules behave in practice.
Complicating the picture: the address that delegated the FORTH later moved those tokens away and triggered a cancellation function about 14 minutes after the transfer. Observers — including a security firm that called the episode suspicious — flagged the situation before it was canceled. Still, the verifiable outcome is simple: a near-total-ask for the USDC pot reached the on-chain system, but it never got a public vote and no treasury funds were actually drained.
The bigger takeaway is a governance design note: when proposal submission gates are tied to on-chain voting power, it’s possible for a single cluster of delegated votes to push a high-impact request into the binding system before community sentiment is publicly tested. That’s not always an exploit, but it’s a risk vector worth watching for any DeFi project that relies on delegated token voting.
