ApeRocket Hack

Reported loss $1.3M
BNB Chain
Flashloan Incentive Rewards Exploit

What happened

On July 14, 2021, ApeRocket Finance, a yield aggregator built on ApeSwap, was hit by two flash loan attacks a few hours apart: one on its BNB Chain vaults and one on its Polygon fork. In both cases the attacker briefly owned more than 99% of a vault, inflated the vault's apparent profit, and collected nearly all of the performance-fee reward tokens the protocol minted in response. The combined loss was about $1.26 million, roughly $260,000 (883 BNB) on BNB Chain and $1 million (521 ETH) on Polygon, and the SPACE token fell about 63%. ApeRocket stopped minting SPACE and announced compensation, including a new token for pSPACE holders and buybacks.

On Polygon, the root cause was that deposit() in ApeSwap's MiniApeV2 (a fork of SushiSwap's MiniChefV2) accepts deposits on behalf of any address, unlike a regular MasterChef v1. The attacker used this to credit a large LP position to ApeRocket's DAI-MATIC vault, which the vault then counted as profit.

Polygon attacker: 0xfabd1c2f4f16f2f6e2007abbed5549c84d82c19d Polygon attack transaction (July 14, 2021, 08:14 UTC): 0x377fb92f6e04db4bf5a0917a79d171ce27b28deaa23594b7fc498dd080cf9d35

How it happened

  1. On BNB Chain (about 04:30 UTC), the attacker flash-borrowed CAKE, took over 99% of ApeRocket's CAKE vault, sent a large amount of CAKE to the vault and called harvest(). The vault treated the CAKE as profit and minted SPACE rewards, almost all of which went to the attacker.
  2. On Polygon (the attack transaction landed at 08:14 UTC), the attacker used flash-loaned DAI and MATIC to create a large amount of DAI-MATIC LP and deposited part of it into ApeRocket's DAI-MATIC vault, taking more than 99% of its shares.
  3. It then deposited more LP into ApeSwap's MiniApeV2 on behalf of the vault, which MiniApeV2's deposit() allows for any address.
  4. The vault counted that extra LP as profit and minted pSPACE as a performance reward, almost all of which went to the attacker as the majority shareholder.
  5. The attacker sold the pSPACE, repaid the flash loans and left with about 521 ETH; SPACE dropped about 63% after the dumps.

Protocol details

Classification Ecosystem / Stablecoin / Yield Aggregator / Protocol Logic
Protocol Type Yield
Affected asset / contract pSPACE
Protocol links Website @ApeRocketFi

Security review history

Evidence

Understand the attack patterns

Compare incidents →
Flash Loan Attacks

Same attack technique

Browse all hacks →
BNB Chain AutoShark $823K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes