DeFi protocol Yapeswap lost approximately $21,900 in an attack exploiting a critical vulnerability in its WorkersUnion governance mechanism. The system required zero quorum for proposals, enabling an attacker to seize the YapeFactory feeToSetter permission with only 0.000055% of total voting power.
Following the unauthorized transfer, the attacker deployed a malicious Registry contract that returned forged vault addresses through latestVault() while keeping real vaults listed in vaults(). This discrepancy caused YapePair to count transferred deposits as farm assets without issuing redeemable shares, resulting in the fund loss. Affected contracts included YapeFactory, YapePair, and YapeWrapper.
Yapeswap Suffers $21,900 Exploit via Zero-Quorum Governance Flaw
免責事項: Phemexニュースで提供されるコンテンツは、あくまで情報提供を目的としたものであり、第三者の記事から取得した情報の正確性・完全性・信頼性について保証するものではありません。本コンテンツは金融または投資の助言を目的としたものではなく、投資に関する最終判断はご自身での調査と、信頼できる専門家への相談を踏まえて行ってください。