SlowMist: Yapeswap exploited for $21.9K via zero-quorum governance
- —Losses from the Yapeswap exploit are estimated at about $21.9K
- —A proposal with 0.000055% of votes transferred feeToSetter rights on YapeFactory
- —The attacker deployed a malicious Registry contract returning a fake latestVault() address
- —YapeFactory, YapePair and YapeWrapper contracts were affected
Why it matters: The case shows how a zero-quorum governance setup lets an attacker seize critical DeFi protocol permissions with almost no capital.
Source: PANews