# ApeCoin airdrop: flash-loan BAYC to claim APE

Attacker flash-loaned BAYC tokens from NFTX vault, redeemed them for real BAYC NFTs, and claimed ~60,564 APE from the airdrop.

- Payout: Real-world hack
- Severity: high
- Program: ApeCoin (APE)
- Analysis by: DeFiHackLabs
- Disclosed: 2022-05-17
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-05/Bayc_apecoin_exp.sol
- Library page: http://bugbountylibrary.com/r/dhl%3A20220517-bayc-apecoin
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:business-logic vuln:flash-loan

**Target:** ApeCoin airdrop claim contract + NFTX BAYC vault
**Root cause:** Airdrop eligibility was based on current BAYC ownership at claim time, so borrowed/redeemed NFTs could be used to claim APE without holding them long-term.
**Steps:**
1. Flash loan 5.2 BAYC from NFTX vault via `NFTXVault.flashLoan(address(this), address(NFTXVault), 5_200_000_000_000_000_000, "")`.
2. In callback, call `NFTXVault.redeem(5, blank)` to redeem 5 BAYC NFTs.
3. Call `AirdropGrapesToken.claimTokens()` to claim APE for the held BAYC NFTs.
4. Re-mint the BAYC NFTs back into the vault via `NFTXVault.mint(nfts, blank)` to repay the flash loan.
**Exploitation:** Flash-borrowed BAYC from NFTX, redeemed to hold NFTs at claim time, claimed ~60,564 APE, then re-minted NFTs to repay the loan.
**Insight:** Airdrop snapshots based on live ownership at claim time are flash-loanable; check whether eligibility uses a historical snapshot or requires time-weighted holding.