Slow Mist: Yapeswap suffered a loss of approximately $21,900 due to an attack, with the attacker seizing key permissions through extremely low voting power

According to Slow Fog monitoring, Yapeswap suffered an attack, resulting in a loss of approximately $21,900. The root of the incident lies in the WorkersUnion governance mechanism, where the quorum requirement is zero, allowing a proposal that received only about 0.000055% voting support to transfer the feeToSetter authority of YapeFactory to the attacker.

The attacker subsequently deployed a malicious Registry contract, causing latestVault() to return a forged vault address, while vaults() still listed the real vault. YapePair accounted for the deposits to be transferred as farm assets, but did not receive redeemable shares, ultimately leading to a loss of funds. This incident involves contracts such as YapeFactory, YapePair, and YapeWrapper.