Yapeswap Exploited for $21.9K via Zero-Quorum Governance Flaw

The modest dollar loss understates the design lesson: a zero-quorum threshold turned a governance parameter into an attack surface, and the malicious Registry contract exploited a mismatch between two view functions to make deposits appear credited without redeemable backing. The pattern matters for small DeFi protocols that treat quorum settings as harmless defaults, and for integrators relying on a single contract call to validate vault addresses. Whether similar zero-quorum mechanisms exist elsewhere, and how quickly projects revisit their governance parameters, is the open question.