BarnBridge SMART Yield — Governance Capture of an Abandoned DAO → Controller Swap → Approval Drain

Source & credit. Original research reproduction (not from DeFiHackLabs). Standalone Foundry PoC, offline anvil_state.json, and full write-up: 2026-07-CompoundProvider_exp in the evm-hack-registry mirror.

Vulnerability classes: vuln/governance/quorum-manipulation · vuln/governance/vote-weight-vs-quorum-asymmetry · vuln/access-control/live-admin-power-on-dormant-protocol · vuln/logic/leftover-approvals

Reproduction: compiles & runs in an isolated Foundry project at this project folder. The offline fork is served from the bundled anvil_state.json (local anvil replays Ethereum state at block 25535096, one block before the DAO proposal executed), so no public RPC is required. Full verbose trace: output.txt. Verified sources: CompoundProvider.sol, Governance.sol, BarnFacet.sol, IController.sol (holds yieldControllTo).

The important part: obtaining access, not the drain#

The money left through the front door of the DAO. This was not a Solidity bug in the drain path — it was a governance takeover of an abandoned protocol. The whole attack is the access acquisition; the drain is a formality that follows once the attacker owns the vault's controller.

Capture economics: ~$2,243 of BOND bought → $774,943 drained from proposal #14 alone — a ~345x return. A dormant protocol that still holds live token approvals and live admin power is not retired; it is a bug bounty with no expiration date.

Key info#

The governance parameters (verified on-chain)#

Read live from the Governance/Barn at the time of the attack:

The two load-bearing facts, straight from the source:

// Governance.sol — quorum is measured against RAW, UNMULTIPLIED staked BOND:
function _getQuorum(Proposal storage p) internal view returns (uint256) {
    return barn.bondStakedAtTs(_getSnapshotTimestamp(p)).mul(p.parameters.minQuorum).div(100);
}
// ...but votes are LOCK-MULTIPLIED voting power:
uint256 votes = barn.votingPowerAtTs(msg.sender, _getSnapshotTimestamp(proposal));

// BarnFacet.sol — a max lock DOUBLES voting power, quorum sees none of it:
function _stakeMultiplier(Stake memory s, uint256 t) internal view returns (uint256) {
    if (t >= s.expiryTimestamp) return BASE_MULTIPLIER;              // 1e18
    uint256 diff = s.expiryTimestamp - t;
    if (diff >= MAX_LOCK) return BASE_MULTIPLIER.mul(2);            // 2e18 at full lock
    return BASE_MULTIPLIER.add(diff.mul(BASE_MULTIPLIER).div(MAX_LOCK));
}

That asymmetry — quorum on raw stake, votes on multiplied stake — is the root cause, and it is catastrophic once participation drains away from an abandoned DAO.

The capture, with the real numbers#

• Attacker #1 bought 32,795 BOND, staked 32,000 with a near-max lock. balanceAtTs at the #14 snapshot = 32,000 raw BOND; votingPowerAtTs = 63,824.17 (≈1.99x). Quorum for #14 = 58,404.32 (40% of the 146,010.80 BOND staked at snapshot). So the attacker's raw stake alone was below quorum, but the lock multiplier pushed their vote above it. Proposal #14 passed 63,824.17 for, 0 against.
• Attacker #2 bought 67,838 BOND across 5 txs, staked 67,838 → 135,659.35 voting power at the #15 snapshot. Together the two wallets held ≈199,216 voting power ≈ 92.6% of the 213,848.80 BOND staked — for a token nobody else wanted.

Only ~2.14% of BOND's 10M supply was staked, because holders had no reason to keep staking in a protocol whose products were wound down after a 2023 SEC settlement. Quorum tied to live stake collapses as the room empties out.

The disguised proposal & the trust hand-over#

Proposal #14 carried a single action, titled the routine-sounding "migrate proxy implementation", decoded from the on-chain propose calldata:

target      = 0x41Ab… (the old cUSDC controller)
signature   = "yieldControllTo(address)"          // selector 0x5bb78d55
calldata    = abi.encode(0x66c6…)                 // the attacker's proxy

yieldControllTo is onlyDao, which is exactly why the attacker had to capture governance — there is no other way to call it:

// IController.sol (BarnBridge SMART Yield controller)
function yieldControllTo(address newController_) public onlyDao {
    IProvider(pool).setController(newController_);        // CompoundProvider now trusts the proxy
    ISmartYield(smartYield).setController(newController_);
}

The proxy 0x66c6… was deployed by the attacker with its initial implementation set to the legitimate controller, so the proposal looked benign right up to execution. execute was buried inside a throwaway contract's constructor (tx 0x2e28e0b1…, block 25535097) — which is why no top-level execute appears in the Governance tx list. The instant it ran, CompoundProvider.controller flipped 0x41Ab… → 0x66c6….

Only after the vote landed did the attacker upgradeTo a malicious implementation (0x769a…) and drain. The provider trusts its controller unconditionally:

// CompoundProvider.sol
function _takeUnderlying(address from_, uint256 amount_) external onlySmartYieldOrController {
    IERC20(uToken).safeTransferFrom(from_, address(this), amount_);   // ANY residual approval
}
function transferFees() external {
    // ...
    address to = CompoundController(controller).feesOwner();          // malicious impl → attacker
    IERC20(uToken).safeTransfer(to, IERC20(uToken).balanceOf(address(this)));
}

On-chain chronology (verified)#

The four stacked failures#

1. Quorum tied to live stake, with a vote-weight vs quorum-weight asymmetry. Quorum is 40% of raw staked BOND; votes count lock-multiplied power (up to 2x). In a depopulated DAO a few thousand dollars of BOND, staked with a max lock, clears a supermajority.
2. Live administrative power over contracts that still hold value. Winding down the products never severed the DAO's ability to yieldControllTo a new controller.
3. Leftover approvals. Users' years-old, unrevoked USDC allowances to the providers are what the hijacked controller inherited. Without them the vault was empty.
4. No emergency brake that could actually fire. Abrogation needs a majority of all voting power — unreachable when the attacker already controls the active stake. No guardian, no security-council veto.

PoC#

testExploit() (offline, bundled): forks block 25535096 — one block before the real execute of proposal #14, with the attacker's BOND already bought+staked and the proposal already voted+queued in fork state. It then:

1. Asserts the capture economics from real chain state: raw stake 32,000 < quorum 58,404.32 < lock-multiplied voting power 63,824.17.
2. execute(#14) on-chain → asserts CompoundProvider.controller flips 0x41Ab… → 0x66c6… (ACCESS OBTAINED).
3. Upgrades the proxy to a minimal malicious controller and replays the two historical drain batches for the exact on-chain profit 776,575.547933 USDC.

test_CaptureFromScratch() (live-RPC only; set BB_LIVE_RPC): forks a pre-attack block and reconstructs the ENTIRE access acquisition with a fresh wallet — buy BOND on Uniswap → stake with a max lock → propose → warp past the 2-day warm-up → vote → queue → warp past the timelock → execute → assert the vault's controller is handed to the attacker.

# offline (bundled state, no RPC)
bash _shared/run-poc/run_poc.sh 2026-07-CompoundProvider_exp -vv

# full from-scratch capture reconstruction (needs a mainnet archive RPC)
BB_LIVE_RPC=$MAINNET_RPC_URL forge test --match-test test_CaptureFromScratch -vv

Mitigations#

1. Fix the quorum/vote asymmetry: measure quorum against the same multiplied voting power used to count votes, and add an absolute quorum floor that does not fall to zero as stake leaves.
2. Decommission deliberately: when winding a protocol down, neutralize or renounce any admin power that can still move funds (e.g. freeze yieldControllTo / controller rotation once TVL is residual approvals only).
3. Get users to revoke approvals as part of sunsetting; a live allowance to a dormant contract is standing risk. Prefer session-scoped pulls over unlimited standing approvals.
4. A real emergency brake: a guardian / security-council veto or a cancel path that does not require out-voting an attacker who already owns the active stake.
5. Two-step controller rotation with explicit acceptance + delay, so a single vote cannot silently repoint a live vault at an attacker-controlled proxy.

References#

• Blockful write-up (governance attack on an abandoned DAO): https://x.com/blockful_io
• Phalcon: https://x.com/Phalcon_xyz/status/2077243530280587721
• ExVul (CompoundProvider allowance sweep; not Compound Protocol): https://x.com/exvulsec/status/2077253565438194108
• Drain #1: https://etherscan.io/tx/0xd191fead1b9a2244f2837560f35d4fc865404914d229bfcb0172d1a7a9895afb
• Drain #2: https://etherscan.io/tx/0x7d722637a58a7117dbca0182ec26d74e2be0c1052ac319f0150bc056e528d238
• Propose #14: https://etherscan.io/tx/0x07ff84e9372b9166f54f3de69b92371c113a370f08b1bef1e116c10ee48b7009

Sources & further analysis#

Reproductions & code

• Standalone PoC + full trace: 2026-07-CompoundProvider_exp (evm-hack-registry mirror).
• Attack transaction: view on explorer.

Alerts & third-party analyses

• Original alert / thread: post on X.
• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.