DeFi protocol Yapeswap lost approximately $21,900 in an attack exploiting a critical vulnerability in its WorkersUnion governance mechanism. The system required zero quorum for proposals, enabling an attacker to seize the YapeFactory feeToSetter permission with only 0.000055% of total voting power. Following the unauthorized transfer, the attacker deployed a malicious Registry contract that returned forged vault addresses through latestVault() while keeping real vaults listed in vaults(). This discrepancy caused YapePair to count transferred deposits as farm assets without issuing redeemable shares, resulting in the fund loss. Affected contracts included YapeFactory, YapePair, and YapeWrapper.