Yapeswap zero-quorum governance attack, per SlowMist

'~$21.9k', per SlowMist.

Root cause: Per SlowMist: 'WorkersUnion's zero quorum let a proposal backed by ~0.000055% of voting power transfer YapeFactory's feeToSetter role to the attacker. The attacker installed a Registry that returned fake vaults from latestVault() while vaults() still listed real ones. YapePair counted the diverted deposits as farming assets without receiving redeemable shares.'

Timeline, as sourced: On-chain: timelock queued 24 Oct 2026 02:14 UTC (24-hour delay); fee-role transfer executed 25 Oct 02:15 UTC; drain tx 02:19 UTC. Per SlowMist: alert 09:36 UTC.

On 25 October 2026 SlowMist reported (opens in a new tab) a governance attack on Yapeswap. According to SlowMist, the WorkersUnion governance contract had zero quorum, so a proposal backed by about 0.000055% of voting power passed and transferred YapeFactory's feeToSetter role to the attacker. The attacker then installed a Registry that returned fake vaults from latestVault() while vaults() still listed the real ones, and YapePair contracts counted the diverted deposits as farming assets without receiving redeemable shares. SlowMist puts the loss at about $21,900 and cites the attack transaction (opens in a new tab). Yapeswap has not published a statement. With zero quorum, a proposal backed by almost no voting power can pass.