DeFi protocol Yapeswap lost approximately $21,900 in an attack exploiting a critical vulnerability in its WorkersUnion governance mechanism. The system required zero quorum for proposals, enabling an attacker to seize the YapeFactory feeToSetter permission with only 0.000055% of total voting power.
Following the unauthorized transfer, the attacker deployed a malicious Registry contract that returned forged vault addresses through latestVault() while keeping real vaults listed in vaults(). This discrepancy caused YapePair to count transferred deposits as farm assets without issuing redeemable shares, resulting in the fund loss. Affected contracts included YapeFactory, YapePair, and YapeWrapper.
Yapeswap Suffers $21,900 Exploit via Zero-Quorum Governance Flaw
Aviso legal: El contenido de Phemex News es únicamente informativo.No garantizamos la calidad, precisión ni integridad de la información procedente de artículos de terceros.El contenido de esta página no constituye asesoramiento financiero ni de inversión.Le recomendamos encarecidamente que realice su propia investigación y consulte con un asesor financiero cualificado antes de tomar cualquier decisión de inversión.