ApeRocket Hack

The attacker's address:

https://polygonscan.com/address/0xfabd1c2f…82c19d

The transaction behind the attack:

https://polygonscan.com/tx/0x377fb92f…cf9d35

The attacker:

- borrowed 24M DAI and 54M MATIC of flash loans from Aave

- created 25M DAIMATIC LP

- deposited 10M LP to the DAI-MATIC LP vault. Got the majority share (99%) of the vault

- deposited 15M LP from the MiniApeV2 contract of ApeSwap to the DAI-MATIC LP vault of ApeRocket

- called withdrawAll() on the vault

- with the rather large amount of LP token added (deposited from ApeSwap’s MasterChef) by the attacker at step 3, it returned a large amount of profit. As a result, the system minted 2.5M pSAPCE as a reward to the attacker

- swapped the rewarded pSPACE token to ETH, repaid the flash loan

- taken out 521 ETH.

The deposit() function of ApeSwap Polygon's MiniApeV2 (a fork of SushiSwap's MiniChefV2) allows deposits to any address, which is not possible for a regular MasterChef v1, allowing the profit amount for everyone in the vault to be increased.

Even if the attacker owns the bulk of the vault, virtually all of the profit will be returned to the attacker.