-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0277
============================================================

Advisory-ID:  0xCERT-2026-0277
Severity:     Low
Published:    2026-10-25T09:36:49.000Z
Updated:      2026-10-26T00:42:01.568Z
Chains:       Ethereum
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0277

Title: Yapeswap on Ethereum drained of about $21.9k after zero-quorum governance vote handed attacker YapeFactory feeToSetter role

Summary
- -------
Yapeswap's WorkersUnion governance had zero quorum, letting an attacker with ~0.000055% of voting power take YapeFactory's feeToSetter role and divert YapePair deposits to fake vaults (~$21.9k lost). Avoid Yapeswap pools and revoke approvals.

Details
- -------
Summary
On 2026-10-25 the Yapeswap AMM on Ethereum lost about $21.9k, according to a SlowMist threat-intelligence alert. The WorkersUnion governance contract required zero quorum, so a proposal backed by roughly 0.000055% of voting power transferred YapeFactory's feeToSetter role to the attacker. The attacker then installed a Registry whose latestVault() returned fake vaults while vaults() still listed the real ones, so YapePair counted diverted deposits as farming assets without receiving redeemable shares.

Affected
- - Yapeswap YapeFactory / YapePair / YapeWrapper (Ethereum), WorkersUnion governance
- - No fix announced at time of publication

Impact
Attacker-controlled governance moved liquidity from YapePair contracts to fake vaults. SlowMist estimates the loss at about $21.9k; DefiLlama lists $21.9k. Some third-party trace reports give higher totals across several attacker transactions; the figures here follow SlowMist.

Recommended actions
- - Do not deposit into or route through Yapeswap pairs; revoke token approvals granted to Yapeswap contracts
- - Integrators: flag the attacker addresses below and monitor fund movements
- - Governance designers: enforce a non-zero quorum and validate registry/vault addresses before moving reserves

Source & attribution
This 0xCERT advisory summarises a disclosure by SlowMist (SlowMist TI Alert): https://x.com/SlowMist_Team/status/2114290073546219799, corroborated by the DefiLlama hacks database and press coverage (PANews, TokenPost). Details may change; refer to the original source for the authoritative record.

References
- ----------
- - https://x.com/SlowMist_Team/status/2114290073546219799
- - https://etherscan.io/tx/0x4c741568cc12b23b382db409b0a38a4cfb6c708904f0c2ce7bad2e4fa7179e1e
- - https://panews.io/articles/01a17275-c583-7613-86e8-bccf64f7b391
- - https://www.tokenpost.com/news/technology/40458

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmrfiPwJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcme2BuJ1PtegkQM+OXlp/rLntn7wMX9fLq5ECvyl
3T8OXBYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAAD1XQD/StGs+u3xJMnkENBd
DFiOF/vumZ2Bn7FJ+4xEq/RhDM0BAPZ7AXYGCZlICge6eDDMenhO/GEGuodA
cQfJJgH7xhYA
=3oa4
-----END PGP SIGNATURE-----