Yapeswap's WorkersUnion DAO carries a zero quorum (minimumVotes and minimumVotesForProposing are both 0) and factory.feeToSetter, held by the DAO timelock, can re-point the factory
מה ידוע על המתקפה?
הסיווג ושיטת התקיפה משקפים את דיווחי המקורות. תיאורים מפורטים מוצגים בשפת המקור; לקריאת התחקיר המלא ניתן לפתוח את הקישור המצורף.
DefiLlamaתיאור המקור באנגלית
YapeSwap’s WorkersUnion governance contract allowed proposals to pass with zero quorum, enabling an attacker controlling approximately 0.000055% of voting power to transfer YapeFactory’s feeToSetter role to themselves. The attacker then installed a malicious Registry that returned fake vault addresses through latestVault(), while vaults() continued listing legitimate vaults. This redirected deposits into attacker-controlled destinations while YapePair incorrectly accounted for them as farming assets, resulting in approximately $21,900 in losses
SlowMistתיאור המקור באנגלית
The Ethereum DeFi protocol Yapeswap (an AMM DEX) was hit by a governance attack. WorkersUnion’s zero-quorum setting allowed a proposal backed by only ~0.000055% of voting power to transfer YapeFactory’s feeToSetter role to the attacker. The attacker then installed a malicious Registry that made latestVault() return fake vaults while vaults() still listed real ones. YapePair counted the diverted deposits as farming assets without issuing redeemable shares, resulting in a loss of approximately $21,900.
Yapeswap's WorkersUnion DAO carries a zero quorum (minimumVotes and minimumVotesForProposing are both 0) and factory.feeToSetter, held by the DAO timelock, can re-point the factory
מה ידוע על המתקפה?
הסיווג ושיטת התקיפה משקפים את דיווחי המקורות. תיאורים מפורטים מוצגים בשפת המקור; לקריאת התחקיר המלא ניתן לפתוח את הקישור המצורף.
DefiLlamaתיאור המקור באנגלית
YapeSwap’s WorkersUnion governance contract allowed proposals to pass with zero quorum, enabling an attacker controlling approximately 0.000055% of voting power to transfer YapeFactory’s feeToSetter role to themselves. The attacker then installed a malicious Registry that returned fake vault addresses through latestVault(), while vaults() continued listing legitimate vaults. This redirected deposits into attacker-controlled destinations while YapePair incorrectly accounted for them as farming assets, resulting in approximately $21,900 in losses
SlowMistתיאור המקור באנגלית
The Ethereum DeFi protocol Yapeswap (an AMM DEX) was hit by a governance attack. WorkersUnion’s zero-quorum setting allowed a proposal backed by only ~0.000055% of voting power to transfer YapeFactory’s feeToSetter role to the attacker. The attacker then installed a malicious Registry that made latestVault() return fake vaults while vaults() still listed real ones. YapePair counted the diverted deposits as farming assets without issuing redeemable shares, resulting in a loss of approximately $21,900.
