{"investigation":{"slug":"aperocket","entity_name":"ApeRocket","trust_score":22,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"ApeRocket is a DeFi yield farming aggregator and optimizer originally deployed on Binance Smart Chain (BSC) and Polygon in 2021. The protocol suffered two simultaneous flash loan exploits on July 14, 2021, resulting in combined losses of approximately $1.26 million and a 63% collapse in its native SPACE token price. The project attempted a V2 relaunch with improved security, but the SPACE token currently shows zero trading volume and effectively zero market capitalization, indicating the protocol is inactive.","sections":[{"content":"ApeRocket Finance is a suite of DeFi yield optimization products built on Binance Smart Chain (BSC) and later expanded to Polygon. Its primary product is a vault system that automatically compounds and aggregates yields from third-party liquidity protocols, most notably ApeSwap and PancakeSwap. Users deposit assets into vaults, and the protocol performs auto-compounding to maximize returns. The protocol's native governance and reward token is SPACE, with xSPACE serving as a locked-token receipt for governance participation. According to DeFiLlama data, the protocol's current total value locked (TVL) stands at approximately $38,251, a dramatic decline from its peak activity in mid-2021.","heading":"Protocol Overview","sources":[{"url":"https://bsc.aperocket.finance/","name":"bsc.aperocket.finance","type":"other","credibility":3},{"url":"https://defillama.com/protocol/aperocket","name":"defillama.com","type":"other","credibility":3},{"url":"https://aperocket.gitbook.io/ape-rocket/basics/tokenomics","name":"aperocket.gitbook.io","type":"other","credibility":3}],"severity":"medium"},{"content":"On July 14, 2021, ApeRocket suffered two separate flash loan attacks within hours of each other — one on BSC and one on Polygon — resulting in a combined loss of approximately $1.26 million. The BSC attack occurred at approximately 4:30 AM UTC. The attacker borrowed 1.6 million CAKE (valued at roughly $21.8 million) from PancakeSwap via a flash loan, deposited 509,000 CAKE into the vault to acquire a 99.5% ownership stake, then transferred an additional 1.1 million CAKE directly to the vault contract. This artificially inflated the vault's perceived profits. When the attacker called the public harvest() function, the protocol minted approximately 508,000 SPACE tokens as performance fee rewards, which the attacker then dumped for profit, extracting approximately $260,000 (883 BNB) from the SPACE liquidity pool on ApeSwap. The root cause, identified by security researcher WatchPug, was that the _harvest() function processed the entire token balance of the contract without validating whether the capital was legitimately earned profit. The Polygon attack occurred at approximately 8:00 AM UTC the same day. The attacker borrowed 24 million DAI and 54 million MATIC through Aave flash loans, created 25 million DAI-MATIC LP tokens, deposited 10 million LP tokens to gain 99% vault ownership, then deposited an additional 15 million LP tokens via ApeSwap's MiniApeV2 deposit() function — which permitted deposits to arbitrary addresses — directly to the vault contract. When withdrawAll() was called, the system minted 2.5 million pSPACE tokens as reward to the attacker, which were converted to ETH. The Polygon attack extracted approximately $1 million (521 ETH). Following the exploits, the SPACE token price declined approximately 63%.","heading":"July 2021 Flash Loan Exploits","sources":[{"url":"https://www.coindesk.com/tech/2021/07/15/defi-yield-farming-aggregator-aperocket-suffers-126m-flash-loan-attack","name":"coindesk.com","type":"other","credibility":3},{"url":"https://finance.yahoo.com/news/defi-yield-farming-aggregator-aperocket-153230316.html","name":"finance.yahoo.com","type":"other","credibility":3},{"url":"https://watchpug.medium.com/aperocket-finance-performance-fee-minting-incident-root-cause-analysis-b959c1e963ba","name":"watchpug.medium.com","type":"other","credibility":3},{"url":"https://watchpug.medium.com/aperocket-polygon-performance-fee-minting-incident-root-cause-analysis-ed216f422f56","name":"watchpug.medium.com","type":"other","credibility":3},{"url":"https://www.nasdaq.com/articles/defi-yield-farming-aggregator-aperocket-suffers-$1.26m-flash-loan-attack-2021-07-15","name":"nasdaq.com","type":"other","credibility":3},{"url":"https://www.quadrigainitiative.com/casestudy/aperocketfinancerewardbug.php","name":"quadrigainitiative.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Prior to the July 2021 exploits, ApeRocket had obtained a security audit from PeckShield (report: PeckShield-Audit-Report-ApeRocket-v1.0.pdf), as well as a review from Mutative covering contracts, frontend, and user flow. The exploits demonstrated that these audits did not catch the critical vulnerability in the public harvest() function on BSC, nor the deposit-to-arbitrary-address flaw in the Polygon vault integration. Following the hacks, ApeRocket committed to conducting at least two additional security audits before launching V2. The team temporarily disabled the SPACE token minter. A block-lock mechanism was announced as part of V2 to prevent flash loan style exploits.","heading":"Security Posture and Audit History","sources":[{"url":"https://github.com/peckshield/publications/blob/master/audit_reports/PeckShield-Audit-Report-ApeRocket-v1.0.pdf","name":"github.com","type":"other","credibility":3},{"url":"https://aperocket.gitbook.io/ape-rocket/security/audits","name":"aperocket.gitbook.io","type":"other","credibility":3},{"url":"https://www.quadrigainitiative.com/casestudy/aperocketfinancerewardbug.php","name":"quadrigainitiative.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the exploits, the ApeRocket team (operating under the Medium handle YieldRocket) published post-mortem communications. For BSC victims, a compensation pool was announced with planned buybacks intended to support the SPACE token price. For Polygon victims, the team issued a new token allocated to all pSPACE holders recorded before the exploit, subject to a lock-up period. New SPACE minting was halted entirely. The team outlined a V2 relaunch with improved tokenomics, a new block-lock security mechanism to prevent flash loans, and a commitment to two additional audits. ApeRocket V2 was announced as launched in October 2021 with revised tokenomics. However, the protocol's post-V2 trajectory has been one of declining usage, and the SPACE token currently reports effectively zero trading volume and zero market capitalization across multiple tracking platforms including CoinMarketCap, suggesting the protocol is functionally inactive.","heading":"Team Response and Compensation","sources":[{"url":"https://www.quadrigainitiative.com/casestudy/aperocketfinancerewardbug.php","name":"quadrigainitiative.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/tech/2021/07/15/defi-yield-farming-aggregator-aperocket-suffers-126m-flash-loan-attack","name":"coindesk.com","type":"other","credibility":3},{"url":"https://coinmarketcap.com/currencies/aperocket/","name":"coinmarketcap.com","type":"other","credibility":3},{"url":"https://yieldrocket.medium.com/aperocket-v2-imminent-launch-7d7f685a4d36","name":"yieldrocket.medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"As of 2026, ApeRocket's SPACE token is listed at $0.00 with zero 24-hour trading volume on CoinMarketCap, CryptoRank, and Binance price trackers. BscScan data shows the legacy SPACE token contract (0x01a0cbec1e6b69c1a21d036d8ea4d43bb1fd41cb) with approximately 8 holders. DeFiLlama reports a residual TVL of approximately $38,251 on BSC, likely reflecting dormant or orphaned deposits. The protocol's social media activity appears to have ceased. These indicators collectively suggest ApeRocket is effectively abandoned with no active development, liquidity, or user base.","heading":"Current Protocol Status","sources":[{"url":"https://defillama.com/protocol/aperocket","name":"defillama.com","type":"other","credibility":3},{"url":"https://coinmarketcap.com/currencies/aperocket/","name":"coinmarketcap.com","type":"other","credibility":3},{"url":"https://cryptorank.io/price/aperocket","name":"cryptorank.io","type":"other","credibility":3},{"url":"https://bscscan.com/token/0x01a0cbec1e6b69c1a21d036d8ea4d43bb1fd41cb","name":"bscscan.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On-chain investigator ZachXBT is reported to have flagged ApeRocket as a high-risk entity. The specific nature and timing of the flagging could not be independently verified through a primary source at the time of this investigation. ZachXBT is a widely cited independent blockchain investigator whose findings on DeFi exploits and scams have been covered by major crypto publications. The existence of the verified $1.26 million flash loan exploit is consistent with the basis for such a flagging.","heading":"ZachXBT Flagging","sources":[{"url":"https://en.wikipedia.org/wiki/ZachXBT","name":"en.wikipedia.org","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021","event":"ApeRocket launches on Binance Smart Chain as a yield farming aggregator leveraging ApeSwap liquidity.","source":"","date_original":"2021-01-01"},{"date":"2021-07-14","event":"BSC CAKE vault exploited via flash loan at approximately 4:30 AM UTC; attacker extracts approximately $260,000 (883 BNB) by artificially inflating vault profits and triggering excessive SPACE token minting.","source":""},{"date":"2021-07-14","event":"Polygon MATIC-DAI vault exploited via flash loan at approximately 8:00 AM UTC; attacker extracts approximately $1,000,000 (521 ETH) using a flaw in ApeSwap's MiniApeV2 deposit() function.","source":""},{"date":"2021-07-14","event":"SPACE token price drops approximately 63% following the two exploits. ApeRocket halts SPACE token minting.","source":""},{"date":"2021-07-15","event":"CoinDesk and Nasdaq report on the combined $1.26 million flash loan attacks. WatchPug publishes root cause analyses for both exploits.","source":""},{"date":"2021-10-15","event":"ApeRocket launches V2 with revised tokenomics, block-lock mechanism, and PeckShield + Mutative audit coverage.","source":""},{"date":"2022","event":"Protocol activity begins to decline significantly; TVL and SPACE token trading volume trend toward zero.","source":"","date_original":"2022-01-01"},{"date":"2026-05-28","event":"SPACE token reports $0.00 price and zero trading volume across major trackers. DeFiLlama shows residual TVL of approximately $38,251. Protocol is effectively inactive.","source":""}],"sources_used":[{"url":"https://bsc.aperocket.finance/","name":"bsc.aperocket.finance","type":"other","archive_url":"https://web.archive.org/web/20260830082932/https://bsc.aperocket.finance/","credibility":3,"archive_timestamp":"2026-08-30T08:29:32+00:00"},{"url":"https://defillama.com/protocol/aperocket","name":"defillama.com","type":"other","archive_url":"http://web.archive.org/web/20250914214610/https://defillama.com/protocol/aperocket","credibility":3,"archive_timestamp":"2025-09-14T21:46:10+00:00"},{"url":"https://aperocket.gitbook.io/ape-rocket/basics/tokenomics","name":"aperocket.gitbook.io","type":"other","archive_url":"https://web.archive.org/web/20260830082511/https://aperocket.gitbook.io/ape-rocket/core/vaults","credibility":3,"archive_timestamp":"2026-08-30T08:25:11+00:00"},{"url":"https://www.coindesk.com/tech/2021/07/15/defi-yield-farming-aggregator-aperocket-suffers-126m-flash-loan-attack","name":"coindesk.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://finance.yahoo.com/news/defi-yield-farming-aggregator-aperocket-153230316.html","name":"finance.yahoo.com","type":"other","archive_url":"http://web.archive.org/web/20260830203525/https://finance.yahoo.com/news/defi-yield-farming-aggregator-aperocket-153230316.html","credibility":3,"archive_timestamp":"2026-08-30T20:35:25+00:00"},{"url":"https://watchpug.medium.com/aperocket-finance-performance-fee-minting-incident-root-cause-analysis-b959c1e963ba","name":"watchpug.medium.com","type":"other","archive_url":"http://web.archive.org/web/20251116101558/https://watchpug.medium.com/aperocket-finance-performance-fee-minting-incident-root-cause-analysis-b959c1e963ba","credibility":3,"archive_timestamp":"2025-11-16T10:15:58+00:00"},{"url":"https://watchpug.medium.com/aperocket-polygon-performance-fee-minting-incident-root-cause-analysis-ed216f422f56","name":"watchpug.medium.com","type":"other","archive_url":"http://web.archive.org/web/20251116100301/https://watchpug.medium.com/aperocket-polygon-performance-fee-minting-incident-root-cause-analysis-ed216f422f56","credibility":3,"archive_timestamp":"2025-11-16T10:03:01+00:00"},{"url":"https://www.nasdaq.com/articles/defi-yield-farming-aggregator-aperocket-suffers-$1.26m-flash-loan-attack-2021-07-15","name":"nasdaq.com","type":"other","archive_url":"https://web.archive.org/web/20260829203131/https://www.nasdaq.com/articles/defi-yield-farming-aggregator-aperocket-suffers-$1.26m-flash-loan-attack-2021-07-15","credibility":3,"archive_timestamp":"2026-08-29T20:31:31+00:00"},{"url":"https://www.quadrigainitiative.com/casestudy/aperocketfinancerewardbug.php","name":"quadrigainitiative.com","type":"other","archive_url":"http://web.archive.org/web/20260511083213/https://quadrigainitiative.com/casestudy/aperocketfinancerewardbug.php","credibility":3,"archive_timestamp":"2026-05-11T08:32:13+00:00"},{"url":"https://github.com/peckshield/publications/blob/master/audit_reports/PeckShield-Audit-Report-ApeRocket-v1.0.pdf","name":"github.com","type":"other","archive_url":"http://web.archive.org/web/20260528020650/https://github.com/peckshield/publications/blob/master/audit_reports/PeckShield-Audit-Report-ApeRocket-v1.0.pdf","credibility":3,"archive_timestamp":"2026-05-28T02:06:50+00:00"},{"url":"https://aperocket.gitbook.io/ape-rocket/security/audits","name":"aperocket.gitbook.io","type":"other","archive_url":"http://web.archive.org/web/20260209135750/https://aperocket.gitbook.io/ape-rocket/security/audits","credibility":3,"archive_timestamp":"2026-02-09T13:57:50+00:00"},{"url":"https://coinmarketcap.com/currencies/aperocket/","name":"coinmarketcap.com","type":"other","archive_url":"https://web.archive.org/web/20260901072112/https://coinmarketcap.com/currencies/aperocket/","credibility":3,"archive_timestamp":"2026-09-01T07:21:12+00:00"},{"url":"https://yieldrocket.medium.com/aperocket-v2-imminent-launch-7d7f685a4d36","name":"yieldrocket.medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cryptorank.io/price/aperocket","name":"cryptorank.io","type":"other","archive_url":"https://web.archive.org/web/20260829192220/https://cryptorank.io/price/aperocket","credibility":3,"archive_timestamp":"2026-08-29T19:22:20+00:00"},{"url":"https://bscscan.com/token/0x01a0cbec1e6b69c1a21d036d8ea4d43bb1fd41cb","name":"bscscan.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://en.wikipedia.org/wiki/ZachXBT","name":"en.wikipedia.org","type":"other","archive_url":"http://web.archive.org/web/20260711020137/https://en.wikipedia.org/wiki/ZachXBT","credibility":3,"archive_timestamp":"2026-07-11T02:01:37+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:55.876314+00:00","updated_at":"2026-09-01T07:26:08.722455+00:00"}}