APE Token Staking in NFT Pools Puts Investors at Risk, Says PeckShield

PeckShield, a blockchain security company, has issued a warning to users staking APE tokens in NFT pools after an exploiter bought a Bored Ape Yacht Club (BAYC) NFT and received staked APE associated with the sold NFT.

Staking is a popular way for users to earn rewards by locking up their crypto assets in smart contracts. However, in the case of staking APE in NFT pools, there is a risk that the staked tokens can be lost if the associated NFT is sold, according to the security warning.

#PeckShieldAlert If you stake $APE in the NFT pools & sell your #NFT you will lose the staked $APE!

Exploiter/Arbitrageur 0x06800a just bought following #BoredApeYachtClub #7810 and got the staked 14.3k $APE (~$60K) https://t.co/8K1fVMlWQp pic.twitter.com/nA9tMDEi1A

— PeckShieldAlert (@PeckShieldAlert) April 9, 2023

Notably, the exploiter with a wallet address initials “0x06800a” received 14.3k APE tokens of approximately $60k after buying BAYC 7810. The warning from PeckShield reminds users to be cautious when investing their crypto assets in NFT pools and to thoroughly research the mechanisms behind these investments.

On the other hand, users of the SushiSwap protocol have been advised to reverse approvals or move their funds to a new wallet following a bug in the SushiSwap’s RouterProcessor2 contract. PeckShield captured the incident earlier today, stating that over 1,800 Ethereum tokens worth over $3.3 million have been lost.

It seems the @SushiSwap RouterProcessor2 contact has an approve-related bug, which leads to the loss of >$3.3M loss (about 1800 eth) from @0xSifu.

If you have approved https://t.co/E1YvC6VZsP, please *REVOKE* ASAP!

One example hack tx: https://t.co/ldg0ww3hAN pic.twitter.com/OauLbIgE0Q

— PeckShield Inc. (@peckshield) April 9, 2023

Jared Grey, the head chef at Sushi Swap, acknowledged the issue and said the protocol collaborated with security specialists to minimize the intrusion. A smart contract audit company stated that it had stopped an assault transaction, saving 100 ETH, equivalent to over $180,000, and urged the impacted SushiSwap contract to seek compensation.

Source