Incident Overview
The attacker's address:
https://polygonscan.com/address/0xfabd1c2f…82c19d
The transaction behind the attack:
https://polygonscan.com/tx/0x377fb92f…cf9d35
The attacker:
- borrowed 24M DAI and 54M MATIC of flash loans from Aave
- created 25M DAIMATIC LP
- deposited 10M LP to the DAI-MATIC LP vault. Got the majority share (99%) of the vault
- deposited 15M LP from the MiniApeV2 contract of ApeSwap to the DAI-MATIC LP vault of ApeRocket
- called withdrawAll() on the vault
- with the rather large amount of LP token added (deposited from ApeSwap’s MasterChef) by the attacker at step 3, it returned a large amount of profit. As a result, the system minted 2.5M pSAPCE as a reward to the attacker
- swapped the rewarded pSPACE token to ETH, repaid the flash loan
- taken out 521 ETH.
The deposit() function of ApeSwap Polygon's MiniApeV2 (a fork of SushiSwap's MiniChefV2) allows deposits to any address, which is not possible for a regular MasterChef v1, allowing the profit amount for everyone in the vault to be increased.
Even if the attacker owns the bulk of the vault, virtually all of the profit will be returned to the attacker.
Incident Report
Protocol Information
Market Context at Time of Hack
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to ApeRocket, these are the critical security checks that could have prevented this incident (July 2021).
- Verify all logic paths related to Flashloan Incentive Rewards Exploit / Flash Loan Attack are guarded by proper access controls and input validation - see the Flash Loans Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSecurity Audit History
- Audit Report 1 Report
Related Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
- 01
- 02
- 03
- 04
Learn to Prevent the Next ApeRocket
The ApeRocket hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.