Yapeswap Loses About $21,900 After Zero-Quorum WorkersUnion Governance Attack
By Crypto Wire
October 25, 2026
Yapeswap, a small Ethereum AMM that routes idle LP reserves into Yearn-style farms, lost about $21,900 after a WorkersUnion governance proposal with roughly 0.000055% voting support transferred YapeFactory’s feeToSetter permission to an attacker, according to SlowMist monitoring wrapped by TokenPost and PANews on October 25. Rug cut: the quorum requirement was zero, so a near-dust vote could move a factory admin lever — then a malicious Registry made latestVault() return a forged vault while vaults() still listed the real ones. Attribute the dollar loss and vote-share figures to SlowMist’s monitoring notes as reported; do not invent transaction hashes or claim a Tether freeze window.
After seizing feeToSetter, the attacker deployed that malicious Registry so pair logic would treat transferred deposits as farm assets without issuing redeemable shares. Reports name YapeFactory, YapePair, and YapeWrapper among the contracts in the path. In plain forensic English: governance handed over a permission that should have been hard to move, the fake vault pointer broke the share-accounting path, and depositors’ funds were counted into a farm rail they could not redeem against. DefiLlama’s Yapeswap page still showed only about $24,644 in Ethereum TVL on the Oct. 25 snapshot — so the ~$22K print is a large bite relative to the remaining pool, even if it is small versus weekend mega-drains.
Yapeswap’s own product pitch is that liquidity providers can earn extra yield by investing idle reserves from pools into farming and aggregator services associated with Yearn, with the protocol described as maintained by independent developers and governed by veYAPE holders. That Yearn-adjacent idle-reserve design is exactly why a forged latestVault() matters: the pair trusts a registry tip to decide where idle funds sit. When governance can rewrite factory permissions with no quorum, the yield path becomes an attack surface rather than a perk. Audits are listed as none on DefiLlama’s protocol card — treat that as a catalog field, not a fresh SlowMist finding.
Weekend context for the Rug Room: Saturday’s X100 Senate flash-governance drain (~$4.85M USDT) already showed how same-block voting power can empty a treasury when seats and execution share one transaction. Yapeswap is a different contract family and a much smaller dollar print, but the lesson rhymes — zero quorum plus transferable factory permissions turns “governance” into a permissionless admin key for whoever can push a dust vote. Do not merge the two incidents into one loss figure; keep X100 and Yapeswap as separate trails.
Desk hygiene: as of the SlowMist wraps, there was no confirmed project recovery statement, no published postmortem, and no named freeze of outgoing stables tied to this specific loss. Collectors and LPs who still hold Yapeswap positions should verify factory ownership, Registry addresses, and whether latestVault() still points at a known Yearn/adapter vault before depositing. NFT desks care because Uniswap-style share accounting and vault pointers show up in many LP-NFT and position-NFT stacks — a forged registry tip is the same class of bookkeeping lie that breaks redemptions even when the “real” vault list still looks honest.
What to watch on-chain next: Watch whether feeToSetter / factory ownership flips back from the attacker address, whether a patched Registry restores a legitimate latestVault() tip, and whether any recovery or residual drain txs appear against the remaining ~$24K TVL. Until SlowMist or the team posts explorer receipts for the ~$21,900 path, treat dollar and vote-share figures as monitoring claims — and do not assume LP-NFT or wrapper positions are safe to re-enter.
Bottom line: Yapeswap lost about $21,900 after a zero-quorum WorkersUnion vote with ~0.000055% support moved feeToSetter, then a malicious Registry forged latestVault() so deposits counted as farm assets without redeemable shares.
Disclaimer: This article is provided for informational and educational purposes only. It does not constitute financial, investment, legal, or trading advice. The NFT market is highly volatile, and past performance is not indicative of future results. Readers should conduct their own research and consult qualified professionals before making any decisions related to digital assets. The cover image for this article may have been created using artificial intelligence (AI).
