Users of BarnBridge, a decentralized finance (DeFi) protocol focused on risk-tokenized yield products, have been warned to review and revoke certain Ethereum token approvals after vulnerabilities were identified in two legacy Smart Yield governance proposals.
Blockchain security firm Blockaid said in an advisory that there was no indication of an exploit or stolen funds. However, the two legacy governance proposals could pose a threat if they are executed and then upgraded with malicious code. Existing token approvals from users could be abused in such a case.
An on-chain review shared with the alert found that only Governance Proposals #14 and #15 remain relevant. No other BarnBridge governance proposals are currently active, queued, or eligible for execution.
Proposal #14 is already in its executable grace period, while Proposal #15 has been queued and is scheduled to become executable on July 16, 2026, at 09:23:58 UTC.
Users advised to revoke token approvals
Although no attack has been detected, the community is advising anyone who has previously used BarnBridge Smart Yield to check whether they still have active token approvals linked to the affected contracts.
The warning covers spender addresses tied to several Ethereum-based stablecoins, including USDC, DAI, USDT, GUSD, and RAI. If the governance proposals were ever executed maliciously, those approvals could potentially be abused.
As a safety measure, users are encouraged to manually type the official Revoke.cash website into their browser instead of clicking links shared on social media or in private messages.
The advisory also urges users to ignore unsolicited support messages, avoid signing unexpected transactions, and refrain from sending funds. The only action being recommended is to revoke unnecessary token approvals through a trusted approval management tool.
Read: Lumi Finance Drained of $270K on Arbitrum via Smart Account Exploit
A reminder of the risks posed by old approvals
The warning serves as another reminder that older governance proposals and dormant smart contracts can continue to pose risks long after they were created.
In decentralized finance, token approvals often remain active until users revoke them manually. If a governance-controlled contract were ever compromised or maliciously upgraded, those lingering permissions could become a target.
For that reason, security firms routinely advise crypto users to review wallet approvals and remove any that are no longer needed, even when there are no signs of an active exploit.
The community is expected to continue monitoring the proposals closely, with users encouraged to review their wallet permissions and follow official updates as the situation develops.
Also Read: Circle Banned Tether-Backed Fund Over Manipulation Concerns, Filings Reveal
