Yapeswap on Ethereum drained of about $21.9k after zero-quorum governance vote handed attacker YapeFactory feeToSetter role

Summary

On 2026-10-25 the Yapeswap AMM on Ethereum lost about $21.9k, according to a SlowMist threat-intelligence alert. The WorkersUnion governance contract required zero quorum, so a proposal backed by roughly 0.000055% of voting power transferred YapeFactory's feeToSetter role to the attacker. The attacker then installed a Registry whose latestVault() returned fake vaults while vaults() still listed the real ones, so YapePair counted diverted deposits as farming assets without receiving redeemable shares.

Affected

• Yapeswap YapeFactory / YapePair / YapeWrapper (Ethereum), WorkersUnion governance
• No fix announced at time of publication

Impact

Attacker-controlled governance moved liquidity from YapePair contracts to fake vaults. SlowMist estimates the loss at about $21.9k; DefiLlama lists $21.9k. Some third-party trace reports give higher totals across several attacker transactions; the figures here follow SlowMist.

Recommended actions

• Do not deposit into or route through Yapeswap pairs; revoke token approvals granted to Yapeswap contracts
• Integrators: flag the attacker addresses below and monitor fund movements
• Governance designers: enforce a non-zero quorum and validate registry/vault addresses before moving reserves

Source & attribution

This 0xCERT advisory summarises a disclosure by SlowMist (SlowMist TI Alert): https://x.com/SlowMist_Team/status/2114290073546219799, corroborated by the DefiLlama hacks database and press coverage (PANews, TokenPost). Details may change; refer to the original source for the authoritative record.