Yapeswap exploit analysis

The capture

On 25 October 2026 an attacker took control of Yapeswap's DAO with a dust-sized holding of the protocol's own governance token, then used the factory role that came with it to empty the protocol's liquidity pairs on Ethereum. DeFiHackLabs records the loss as about $21.9K drained from six Yapeswap pairs, and lists what the attack contract received: DAI 1,691.8, USDC 2,286.2, USDT 8,386.3, WETH 10.516 and WBTC 0.0316 (DeFiHackLabs entry). The chain matches the DAI, USDC, USDT and WBTC amounts but not the WETH. Twelve YapePair contracts sent reserves to the attack contract 0x327BF6DFc38a79393F78866c705193c39b04Be01, only 4.205 WETH of it in WETH, and the contract sold the rest for another 6.311 WETH. The entry's 10.516 WETH is that combined balance, so its list counts the stablecoins and WBTC twice (token flows).

Why the DAO fell

DeFiHackLabs' proof of concept rebuilds the capture against live contracts (proof of concept). Two conditions had to hold at once: a voting rule that let one lock carry a proposal, and a factory role with reach over the pairs.

The first is the WorkersUnion DAO's voting rule. minimumVotes and minimumVotesForProposing are both zero, so a proposal passes on totalForVotes > totalAgainstVotes no matter how few votes are cast. Voting power is square-root weighted through the SquareRootVoteCounter, and with no quorum any positive balance carries a proposal. YAPE trades freely on-chain, so anyone can buy that balance.

The second is the reach of the role the capture handed over. factory.feeToSetter sits with the DAO timelock, and the fee-to setter can re-point the factory's registry and operator. Each YapePair farms a share of its reserves into whatever vault registry.latestVault(token) returns, and YapePair._toYearn credits the tokens it ships out back to farming[token]. The pair's keepBalance invariant, ERC-20 balance plus farmed balance, therefore still holds after the real tokens have left the contract. Point the registry at a vault the attacker owns and the pair's books stay healthy while the reserves are gone.

The sequence on chain

The attacker's address 0x6e523866424220b3cb2cab88ba2195cfa5636b12 shows the whole run (address view).

• 2026-10-16 02:12:35 UTC: one swapExactETHForTokens on the Yapeswap router for 0.000000001 ETH buys 543.98 YAPE from the YAPE/WETH pair (transaction), and in the same block createLockUntil locks all of it in the VotingEscrowLock 0x4B9500Be3f3896FA4aE391244965740D9a59F1D6 (transaction).
• 2026-10-16 02:13:23 UTC: delegate, then proposeTx on the WorkersUnion DAO 0x5D35809b5558FbD8eFa18AE1B202db1973b95DdB (transaction).
• 2026-10-17 02:20:11 UTC: manualVote, the deciding vote, cast with that single lock.
• 2026-10-24 02:14:23 UTC: schedule into the timelock.
• 2026-10-25 02:15:47 UTC: execute on the DAO, carrying setFeeToSetter(0x6e523866424220b3cb2cab88ba2195cfa5636b12) to the factory (transaction).

With the role in hand, the attacker set the fee recipient, the registry and the operator on the verified YapeFactory 0x46aDc1C052Fafd590F56C42e379d7d16622835a2 inside one block, pointing registry at 0xC620CA5b2A63cdb792d462898010d2be4421b5A7 and operator at the attack contract (transaction). Two calls into the attack contract followed, and in them twelve YapePair contracts shipped their reserves to it (transaction, transaction). harvest() came last.

The harvest() call sold the DAI, USDC, USDT and WBTC for WETH through four Uniswap V3 pools, unwrapped the contract's 10.516 WETH, and sent the 10.516 ETH to 0x6e523866424220b3cb2cab88ba2195cfa5636b12 in the same transaction (transaction). On 29 October that address deposited 10.5 ETH into the Tornado Cash router in six transactions (address view).

DeFiHackLabs says the real attacker first pulled each pair's Yearn-farmed balance back with setFarmingRatio(0,0) and rebalance before diverting it, which is why the on-chain figure runs ahead of the directly liquid reserves the proof of concept measures on its fork. That step is a Yearn v3 allocator withdrawal, and it does not replay in the pinned pre-execution state the proof of concept starts from.

A run of governance captures

The corpus has a cluster of governance takeovers, and its two most recent sit on consecutive days. On 24 October an attacker bought two of three X100 Senate seats with a flash loan and pushed a 400,000 X treasury sale through a price it set, netting about 4.75 million USDT per DeFiHackLabs (X100Senate exploit analysis). Six weeks earlier a takeover of a dormant DAO quorum on YamFinance gave an attacker admin rights over the legacy UMA farming contracts, about $121K per DeFiHackLabs (YamFinance exploit analysis). In August an attacker on TermFinance wrapped a near-empty governance token to pass a 17-action proposal alone and take 2,841.74 WETH from the ETH meta-vault per DeFiHackLabs (TermFinance exploit analysis), and on StrongBlock the project's own Governor proposal installed the attacker as Upgrader.admin, about $72K per DeFiHackLabs (StrongBlock exploit analysis).

Each of those four is the same two-step move: voting power converts into control of a governance surface, and control converts into an asset outflow. What changes is what the voting power cost. X100 Senate needed a 1,942,457 USDT flash loan and a freeze of 38,200 X. TermFinance needed a wrapper around a vault deposit. YamFinance needed 3.3% of the YAM supply. Yapeswap needed one gwei and a square root.