Apecoin holders are losing their staked tokens when paired Bored Apes get sold

Holders of Bored Apes and Mutant Apes are losing their staked apecoin because they failed to delist their paired NFTs before staking their tokens.

Apecoin staking went live on Dec. 5 and already some Bored Apes and Mutant Apes holders have fallen victim to the issue, related to how the staking feature works, according to security firm PeckShield. Two traders have already earned between $8,000 and $10,000 in profits from targeting Bored Ape holders. In both cases, the victims lost their staked apecoin after selling their NFTs.

These incidents are possible because of the way apecoin staking works. Users can stake their tokens directly or pair them with their Bored Ape or Mutant Ape NFTs. When they pair them, only the tokens are locked in the smart contract. The NFTs can still be sold on OpenSea or any other marketplace. However, when this happens, the holder loses the staked apecoin to the NFT’s buyer because the paired NFT acts as the access key.

Smart-contract savvy arbitrageurs have targeted this apecoin staking feature. The process involves buying a Bored Ape or Mutant Ape whose owner has staked apecoins. These traders usually take a flash loan to obtain the capital needed to purchase the NFT. Once the NFT is sold, the new buyer receives the staked tokens. The next step involves selling the NFT and apecoin for ether. The funds realized from these sales are enough for the trader to repay the loan and still have some profit left over.

$26,000 lost

In one incident reported by PeckShield, the victim lost 6,400 APE ($26,240) to the trader when the paired NFT was sold. The trader used an 82 ETH ($103,000) flash loan from Dydx to buy the NFT and claim the staked tokens. The trader then sold both the NFT and the apecoin for 88 ETH in total. This gave the trader enough funds to cover the loan and still have 6 ETH left over as profit. These transactions happened in one single block — since that is how flash loans work — and cost only $14 in fees.

In another incident shared by PeckShield, a trader scooped almost 8 ETH in a transaction costing $17.

While Bored Ape developer Yuga Labs has faced criticism over these losses, warnings over apecoin staking have been part of the discussions in the ApeDAO community governance forum for months. Web3 wallets like MetaMask also display a warning when connecting to the apecoin staking website.

© 2022 The Block Crypto, Inc. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.