# A Dormant Governance Contract, a Reentrancy Bug and Four Chained Flaws: Three Exploits Documented

An attacker bought and self-delegated 3.3% of Yam Finance's token supply to clear quorum alone, while two BNB Chain token contracts lost funds to classic reentrancy.

- Published: 2026-09-15T05:52:11.664Z
- Canonical: https://polylog.news/crypto/2026-09-15/a-dormant-governance-contract-a-reentrancy-bug-and-four-chai
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [DeFiHackLabs](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/83ee5e1676ad3e96723e3acaf15e80300a4a43ec), [DeFiHackLabs](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/2efa2a4ad1d7e04a020b1228038b7883586701d5), [DeFiHackLabs](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/c1dab229cec5c98497357321b81d94aeda1acc27), [DeFiHackLabs](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/1acd4d3014d6619fbfccd915f1af95b519b00e6e)

Security researchers published working reproductions of three recent exploits to the DeFiHackLabs repository overnight. The largest concerns Yam Finance, a decentralized autonomous organization (DAO) whose governance has been effectively in…

This story is for subscribers. Read it in full at https://polylog.news/crypto/2026-09-15/a-dormant-governance-contract-a-reentrancy-bug-and-four-chai (subscription information: https://polylog.news/pricing).