SlowMist: Yapeswap Attacked Due to Zero Quorum in Governance, Losses Approximately $21,900

October 25: SlowMist issued a security alert stating that the decentralized trading platform Yapeswap was attacked, with losses of approximately $21.9 thousand. The root cause is that the WorkersUnion governance quorum is zero, allowing the attacker to pass a proposal with only about 0.000055% of the voting power, transferring the feeToSetter permission of YapeFactory to themselves. The attacker then installed a malicious Registry, causing latestVault to return a fake vault, while vaults still listed the real vault. YapePair counted the misappropriated deposits as farming assets but did not obtain redeemable shares.