A group called the ‘Golden Boys’ has pushed through a proposal, after three prior attempts, to direct $24 million in COMP token to a yield-bearing protocol called goldCOMP which would give passive income to COMP token holders.

Wintermute and other large stakeholders are concerned that the move constitutes a governance attack on the protocol.

COMP, the native token of the lending protocol Compound, is down over 6% as the Decentralized Autonomous Organization (DAO) that runs the protocol suffers from a possible “governance attack.”

A governance attack occurs when an attacker acquires significant voting power in a DAO to manipulate the protocol for personal gain, exploiting the permissionless and tradable nature of governance tokens.

According to posts on Compound’s forums, the governance attack on Compound involved a series of coordinated efforts to manipulate the platform’s decision-making process through significant COMP token delegations led by a whale named Humpy, who sought to allocate $24 million worth of COMP to a yield-bearing protocol he controlled called goldCOMP run by a group known as Golden Boys.

This group has made multiple attempts, with their latest attempt finally passing.

The group attack began weeks ago, in early May, with Proposal 118, which called for transferring 5% of COMP’s treasury to a multi-sig wallet controlled by the Golden Boys, which did not pass because community members highlighted suspicious circumstances around its introduction.

The group followed up with a second proposal, Proposal 247, which tried a similar approach. It called for investing 5% of COMP tokens into a goldCOMP vault, which would provide passive income for COMP holders. This proposal failed to reach a quorum and was canceled.

Finally, the group tried again with Proposal 289, which has passed.

While some have alleged that this is an attempt by Humpy and the Golden Boys to “steal funds”, Humpy, hit back by saying that their now-passed GoldCOMP fund uses a “Trust Setup with a constraint set of actions that doesn’t permit stealing/diverting of funds.”

However, in response to the Golden Boys’ geen-lit proposal, the community put forward a motion to put limits on what they can do.

Proposal 290, which will open for voting in just over a day, aims to transfer the Timelock Admin, a smart contract that queues governance actions, requiring a two-day delay before execution, giving the community more time to react.

While this may impede future governance attacks, it’s unclear whether it will stop the Golden Boys from moving the COMP tokens they were after.