Bollcoin, October 25: According to SlowMist monitoring, Yapeswap suffered an attack with losses of about $21,900. The root cause is that the WorkersUnion governance mechanism requires zero quorum, allowing a proposal backed by only about 0.000055% of voting power to transfer YapeFactory's feeToSetter permission to the attacker. The attacker then deployed a malicious Registry contract so that latestVault() returned a forged vault address while vaults() still listed the real vault. YapePair counted the transferred deposits as farm assets but received no redeemable shares, ultimately causing the fund loss.