Yapeswap
Oct 25, 2026
000055% of voting power to transfer YapeFactory’s feeToSetter role to themselves. The attacker then installed a malicious Registry that returned fake vault addresses through latestVault(), while vaults() continued listing legitimate vaults.
This redirected deposits into attacker-controlled destinations while YapePair incorrectly accounted for them as farming assets, resulting in approximately $21,900 in losses.
How the exploit worked
View reproducible PoClatestVault(token) returns and credits every token it ships out back to farming[token] so its keepBalance invariant (erc20 balance + farming) still holds after the real tokens have left, so anyone can buy a dust amount of the freely-traded YAPE, lock it for sqrt-weighted voting power, pass a proposal that moves feeToSetter to themselves through real voting and the timelock, swap in a registry pointing at a vault they own, and force a 100% rebalance that ships every pair's reserves straight to the attacker.
Lost: ~$21.9K drained from six Yapeswap pairs on Ethereum; the attacker contract received DAI 1,691.8, USDC 2,286.2, USDT 8,386.3, WETH 10.516 and WBTC 0.0316. Thi…
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Governance
- Technique
- Malicious Proposal
- Attribution
- Unknown
- Chains
Event timeline
- Oct 25, 2026Exploit executed — $22K drained via malicious proposal
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)