# New BAKC Owner Can Steal ApeCoin

Selling a BAKC lets the new owner close the paired staking position, sending unstaked APE to ParaSpace's NTokenBAYC pool where any staker can sweep it.

- Payout: Contest reward
- Severity: medium
- Program: ParaSpace
- Credited: xiaoming90
- Disclosed: 2023-04-27
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-11-paraspace-findings/issues/284
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-paraspace%3AM-06
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:accounting-error vuln:business-logic

**Target:** ApeCoin staking integration (PoolApeStaking / ApeStakingLogic.withdrawBAKC)
**Root cause:** ApeCoinStaking._withdrawPairNft sends unstaked APE to the BAYC owner (ParaSpace's NTokenBAYC pool) when a BAKC owner closes a split pair; ApeStakingLogic.withdrawBAKC then sweeps the entire APE balance of that pool to an arbitrary recipient.
**Steps:**
1. Victim stakes BAYC #8888 + BAKC #9999 in Paired Pool via ParaSpace, accruing 100 APE; BAKC is not locked by ParaSpace.
2. Victim sells BAKC #9999 to attacker (OpenSea or private sale).
3. Attacker calls ApeCoinStaking.withdrawBAKC on the official contract for pair (BAYC #8888, BAKC #9999); 98 APE unstaked principal is transferred to NTokenBAYC pool (BAYC owner), 2 APE rewards to attacker.
4. Attacker calls PoolApeStaking.withdrawBAKC against their own BAYC #0002/BAKC #0002 pair.
5. ApeStakingLogic.withdrawBAKC reads `apeCoin.balanceOf(address(this))` and `safeTransfer(_apeRecipient, balance)`, sweeping the victim's 98 APE to attacker.
**How found:** Reading the official ApeCoinStaking._withdrawPairNft revealed the split-pair edge case where either BAYC or BAKC owner can close the position and unstaked APE goes to the BAYC owner; combined with ParaSpace holding BAYC in NTokenBAYC and ApeStakingLogic.withdrawBAKC sweeping the pool's entire balance, the theft path became apparent.
**Exploitation:** Attacker acquires the victim's BAKC (which ParaSpace does not lock), closes the split pair to force the victim's unstaked APE into the NTokenBAYC reserve pool, then triggers withdrawBAKC on their own pair to sweep the pool's full APE balance to themselves.
**Insight:** When integrating external staking contracts, check who receives unstaked principal on edge-case close paths (split pairs) and whether your wrapper sweeps `balanceOf(this)` rather than the exact amount withdrawn — any residual funds in the pool become claimable by any user.