Yapeswap drained after zero-quorum governance vote handed over factory

On 25 October 2026 an attacker drained about $21.9K from Yapeswap, a small Uniswap V2-style DEX on Ethereum — nearly its entire ~$25K TVL. WorkersUnion governance had a zero quorum, so a proposal backed by ~0.000055% of voting power made the attacker the factory's feeToSetter.

• Loss: ~$21.9K per SlowMist, ~$39.7K across three attacker transactions per Oculr
• WorkersUnion quorum was zero, so a dust-sized VISION lock sufficed
• Public updateRegistry() in YapePair copied the factory registry without validation
• rebalance() moved reserves into fake vaults instead of genuine Yearn vaults