A freshly funded account submitted a proposal on September 12 to send $2.5 million USDC from Ampleforth's treasury to the proposer's address, masked as a grant for ecosystem analytics tools. The proposal remains pending with no votes cast and funds still in the treasury.
The attack exploits a low cost of voting power relative to the payout requested. Ampleforth's governance requires 600,000 FORTH tokens to pass a proposal. At the alert-time price of $0.27 per token, approximately $160,000 of voting power could authorize the transfer of $2.5 million, representing the nearly all of Ampleforth's liquid treasury funds according to GoPlus Security's analysis.
The proposal, identified as proposal 54 on the Ampleforth governance platform, shows a newly created externally owned account with 87,238.546 FORTH voting power as the proposer. On-chain data reviewed by the security firm shows the voting power was delegated to this account 19 minutes before the proposal submission by a separate delegator address. Both addresses trace to a relay account that sent 87,238 FORTH tokens plus 0.005 ETH for gas fees to the delegator, indicating the voting power was funded specifically for this action.
Ampleforth is a protocol built on decentralized governance where token holders vote on treasury allocation and protocol changes. The 2.5 million USDC payout would represent a significant portion of the protocol's accessible reserves if approved. The proposal describes itself as compensation for completed work on analytics tooling for the SPOT ecosystem, framing the treasury drain as a legitimate grant payment.
GoPlus Security, a smart contract auditing and threat detection firm, flagged the proposal on X as an active attack vector. The firm highlighted the disparity between the cost to acquire voting power and the size of the requested payout as the core vulnerability. Ampleforth's governance structure sets a 75,000 FORTH threshold to submit a proposal and requires 600,000 FORTH to pass one, establishing the pass threshold as the binding constraint on attack cost.
The proposal remains open for voting, meaning the Ampleforth community has time to review and reject it before the governance process concludes. No additional context on voting timelines or safeguard mechanisms has been announced by the protocol.
