waveygist
created:
by Govlens Review Agent

YChad Transaction 0x359d…c648 Audit — MEDIUM

  • Safe Transaction Hash: 0x359d…c648
  • Safe: 0xFEB4…ff52
  • Chain: Ethereum
  • Nonce: 2299

View in Safe · Related PR

Summary

Risk: MEDIUM — The batch gives the governance Executor management of five reward distributors despite the combined on-chain proposal containing those transfers having failed. That vote also bundled reward-expiry extensions, which remain unchanged, so opposition to the authority move is not separable. The batch also revokes three YFI vests, installs YChad as guardian and Executor manager, and prefunds the FundingDistributor with 401,000 yvUSDC shares.

  • The failed proposal received 602.46 YFI in favor from 1,306.08 YFI voted. This batch executes only its management-transfer portion and leaves the five distributors’ 26-epoch reward expiries unchanged.
  • Voting is already an Executor operator, so passed proposals can now change parameters or sweep tokens from all six managed distributors. YChad controls which other addresses may operate the Executor.
  • The three revocations return about 196.97 unvested YFI to YChad while leaving about 23.81 vested, unclaimed YFI available to the recipients.
  • The FundingDistributor receives 401,000 yvUSDC-1 shares, worth about 450,022 USDC at the observed share price. This covers three live governance proposals totaling 400,217.102854 shares but does not itself authorize any team to claim them.
  • YChad’s guardian role can veto governance proposals before execution but cannot pass proposals or alter vote totals.
  • ❓ The reported departures of the three vest recipients could not be independently confirmed.

Actions

From: 0xFEB4…ff52

  1. Call: revoke() on 0xFC15…1B32

    • Inputs: None

  2. Call: revoke() on 0x8185…aD89

    • Inputs: None

  3. Call: revoke() on 0x450B…f0E5

    • Inputs: None

  4. Call: accept_guardian() on 0x543e…3070

    • Inputs: None

  5. Call: accept_management() on 0xac7D…Fe7b

    • Inputs: None

  6. Call: set_operator(address,bool) on 0xac7D…Fe7b

  7. Call: execute(bytes) on 0xac7D…Fe7b

    • arg0 (bytes): 0x95547ede56cf74b73dd78a37f547127dffda6113000000000000000000000004759be10c952b31960c97e76362ac340d07d183ada15e3d6e000000000000000000000004759be10c2548bf65916fdabb5a5673fc4225011ff29ee884000000000000000000000004759be10c7efc3953bed2fc20b9f825ebffab1cc8b072a000000000000000000000000004759be10ca139250bcb3880a97c75fd4287d5bf2a6caf98a3000000000000000000000004759be10cbcc932e4750c3e465a7e54a06a34f9edf8f6116b000000000000000000000004759be10c

  8. Call: set_operator(address,bool) on 0xac7D…Fe7b

  9. Call: toGovernance(address,uint256) on 0x93A6…Efde

    • _token (address): 0xBe53…6204
    • _amount (uint256): 401,000,000,000

  10. Call: transfer(address,uint256) on 0xBe53…6204

    • receiver (address): 0xbCc9…116b
    • amount (uint256): 401,000,000,000

Technical evidence

safe.to=0x40A2aCCbd92BCA938b02010E17A5b8929b49130D
safe.value=0
safe.operation=1
safe.safeTxGas=0
safe.baseGas=0
safe.gasPrice=0
safe.gasToken=0x0000000000000000000000000000000000000000
safe.refundReceiver=0x0000000000000000000000000000000000000000
safe.nonce=2299
safe.safeTxHash=0x359d2dab7803c3666f0d73a8820ff08b1e99bcad48833dd19cf25c2f3011c648
safe.data.bytes=1508;keccak256=0x325b1ea299fdcc0e5c2fa072d881efaab6d918c1153b74dfe1d050d23969bbbb
action[1].calldata.bytes=4;keccak256=0x7bd930fe9d60eaece05b4755d90a856d158e9584a1a56f9df87b755cda7a5aa3
action[1].raw.bytes=89;keccak256=0xd1a445ac617db1be0ed1cfad90362cea0fafab271ce22a7dbfd3be30945ffa69
action[2].calldata.bytes=4;keccak256=0x7bd930fe9d60eaece05b4755d90a856d158e9584a1a56f9df87b755cda7a5aa3
action[2].raw.bytes=89;keccak256=0xc8d67d8dee92d07675d369f148a9f43cb1439e688c2a1b576da48a550029e624
action[3].calldata.bytes=4;keccak256=0x7bd930fe9d60eaece05b4755d90a856d158e9584a1a56f9df87b755cda7a5aa3
action[3].raw.bytes=89;keccak256=0x96359a84802c8ff38ca7e626e1bc8bb8fcf99674c81db92ac9b4b9e1950418ea
action[4].calldata.bytes=4;keccak256=0xe044db5e8169660aea91d05e8a69494eb0c1714bb858717317101381b529d1fc
action[4].raw.bytes=89;keccak256=0xcb84afe24ad78059a8e3b60a19f1cd8373b5e24f82a443c562214178f9d7ca6c
action[5].calldata.bytes=4;keccak256=0xc2235211e19f88a852dd366ac8dd8be9899232904d78af101ec7e5f5da55e451
action[5].raw.bytes=89;keccak256=0x0c21357593ed5826ab2a69c223a9626d3146576bcb4828d2afc04b4fae5fb344
action[6].calldata.bytes=68;keccak256=0x68b2fc7bd468fd98cfd088dce22b0a31aa39c6ee894c1167dfd08dc18a27baf3
action[6].raw.bytes=153;keccak256=0x83086adeb6874e246690b06d969c4454b48e736e682fdef8cfc10257238efe0b
action[7].calldata.bytes=292;keccak256=0x5eeab8d11ab037dc9c33cff6996d44f8aa96a5040b55e28924766ce74f099537
action[7].raw.bytes=377;keccak256=0x708103fdd09efa0c3c59631e243def016cf77eec4eb4c346f9084d6cbd77c5e4
action[8].calldata.bytes=68;keccak256=0x9c9bb5da020ec4ee11427ade0e3f49e5fa858526b3bcbe8cb2d28d30268e585c
action[8].raw.bytes=153;keccak256=0x93734816b72da054fe0047a775fe372898b8ccce56e2cceebf9bbf3cb49edada
action[9].calldata.bytes=68;keccak256=0x5378394724eb7931e8a607858d961d309f82cc2ad7b9cb819eaed2d496bc0336
action[9].raw.bytes=153;keccak256=0x75595d756dd53e1f77dedb5aeddfae6cca436e457e8dc16b2c0e278a457b0f0d
action[10].calldata.bytes=68;keccak256=0xc0b7f37b9c18634d43bb278cfa3ae849854efed2f06f0ff2600a12a964b1c810
action[10].raw.bytes=153;keccak256=0xd65967f3590fafadcbf25fbb8ad157c5fc5620493466749187efd60eb7ecef62