Yapeswap Loses About $21,900 in Zero-Quorum Governance Attack

Yapeswap lost about $21,900 after a WorkersUnion governance vote transferred a key YapeFactory permission to an attacker, despite receiving support from about 0.000055% of voting power.

WorkersUnion governance required no minimum quorum. The proposal transferred YapeFactory’s feeToSetter permission to the attacker.

The attacker then deployed a malicious Registry contract. Its latestVault() function returned a fake vault address, while vaults() continued to list the real vaults.

YapePair counted transferred deposits as farm assets without receiving redeemable shares, causing the loss. The incident involved YapeFactory, YapePair and YapeWrapper contracts.