DeFi governance gap allows one wallet to request 98% of Ampleforth treasury’s USDC balance

Ampleforth, a DeFi protocol governed by FORTH token holders, saw Proposal 54 canceled on-chain before its voting window opened. The proposal would have transferred 2.5 million USDC to its author, but Tally records zero votes and lists the cancellation block before the scheduled voting-start block. No transfer executed.

The author presented the payment as a retrospective grant for Observatory for SPOT, a public, open-source analytics interface for the AMPL and SPOT ecosystem. The proposal called the tool completed, independent and unofficial, and its sole executable action directed the USDC to proposing wallet 0x730C…dd82. A Sept. 15, 2026 treasury dashboard snapshot showed about 2.54 million USDC and $3.56 million in total marked value. The request therefore equaled roughly 98.5% of displayed USDC and 70.2% of the dashboard total.

Shortly before the proposal was created, address 0x38cA…24D8 delegated 87,238.5461 FORTH of voting power to the proposing wallet. The proposal-creation transaction followed about 19 minutes later. Proposal 54 disclosed 0x38cA…24D8 among addresses the grantee might use to vote or that might delegate voting power to it. Control of that address remains unidentified in the cited proposal and onchain records.

On Sept. 14, the same address transferred 87,238.5461 FORTH away, then called cancel(54) about 14 minutes later. Ampleforth’s governor code includes a route allowing cancellation when a proposer’s prior-block voting power falls below the proposal threshold. The transaction sequence fits that rule, though it does not by itself establish the decisive contract path or anyone’s motive.

A governance-control question

Ampleforth’s governance documentation describes a progression through discussion, formal proposal development, targeted discussion, optional offchain signaling and technical work before a final binding onchain vote. The deployed contract’s submission gate, meanwhile, turns on voting power. The cited records do not show which preliminary steps occurred around Proposal 54, but they show that the proposing wallet submitted the request soon after receiving concentrated delegated power.

That is the exposure left by the canceled action: a request approaching the protocol’s displayed USDC balance reached the binding system before any public vote tested community support. GoPlus Security’s X account warned about the still-pending proposal shortly before cancellation and characterized it as an attack. That label remains the security firm’s assessment. The verified record shows a canceled proposal and no treasury loss or executed exploit, while intent remains unproven.