SlowMist: Yapeswap attacked due to zero governance quorum, losing approximately 21900 USD
BIBIBI
AT A GLANCE
SlowMist said Yapeswap was attacked because its governance quorum was zero, losing approximately 21900 USD。
Article
SlowMist: Yapeswap attacked, losing approximately 21900 USD, with the attacker obtaining key permissions with extremely low voting power
PANews October 25 According to PANews, citing SlowMist monitoring, Yapeswap was attacked, losing approximately 21900 USD. The incident stemmed from the WorkersUnion governance mechanism having a quorum requirement of zero, allowing a proposal supported by only approximately 0.000055%of the voting power to transfer YapeFactory’s feeToSetter permissions to the attacker. The attacker subsequently deployed a malicious Registry contract, causing latestVault() to return a forged vault address while vaults() continued to list the real vaults. YapePair counted the transferred deposits as farm assets but did not receive redeemable shares, ultimately resulting in a loss of funds. The incident involved YapeFactory, YapePair, and YapeWrapp...
PANews reported, citing SlowMist monitoring, that Yapeswap was attacked, losing approximately 21900 USD。
02
The quorum requirement of the WorkersUnion governance mechanism was zero.
03
A proposal supported by only approximately 0.000055%of the voting power transferred YapeFactory’s feeToSetter permissions to the attacker.
04
The attacker deployed a malicious Registry contract, causing latestVault() to return a forged vault address while vaults() continued to list the real vaults.
05
YapePair counted the transferred deposits as farm assets but did not receive redeemable shares, ultimately resulting in a loss of funds.
AI-assisted interpretation
The following is analysis, separate from reported facts. Verify important claims independently.
The governance mechanism had no minimum approval-vote requirement, so a proposal supported by very little voting power could also transfer key permissions. The attacker used this permission to forge vault addresses, causing some deposits to be counted as assets without obtaining redeemable shares.
Why it matters to readers
The incident shows that a zero governance quorum may allow proposals with extremely low voting power to obtain key permissions and cause losses of funds.
Governance voting is not necessarily safe; without minimum participation or approval thresholds, a small amount of voting can also change contract permissions.
Risks and unknowns
The content at the end of the original text concerning the components involved was truncated; only YapeFactory and YapePair were explicitly mentioned.
The material did not provide confirmation from the project team, suspension measures, or remediation progress.
The actual affected liquidity pools, user scope, and compensation arrangements were not specified.
Related Developments
Loading event timeline…
Related concepts
Quorum
DAO The minimum voter participation required before a proposal can receive a valid vote or pass.
