Worked example · 2023-03

ParaSpace whitehat rescue by BlockSec — an attacker inflates cAPE collateral value via a rebasingIndex manipulation, fails on gas, and BlockSec redeploys the attack to rescue the funds first — Ethereum — 2023-03-17

Loss: zero net loss. Approximately $5M (2,906 ETH) of ParaSpace funds were at imminent risk on 2023-03-17. An attacker attempted to drain the protocol by inflating the value of cAPE collateral, but their exploit transactions failed repeatedly on insufficient gas. BlockSec, whose monitoring caught the active attack, reverse-engineered it, redeployed a working version of the attacker's own exploit contract, extracted the at-risk funds to a BlockSec-controlled address ahead of the attacker landing a successful attempt, and returned them to a ParaSpace multisig.
Recovery: near-total (~100%). ParaSpace subsequently time-locked large withdrawals. The attacker later messaged BlockSec asking for ~0.7 ETH of gas fees back, saying "I lost a lot of money trying to make it work."
OAK Techniques observed: OAK-T9.001 (Oracle Price Manipulation — primary, confirmed mechanism, in its book-value / yield-bearing-token sub-shape. ParaSpace valued cAPE collateral through a rebasing index derived from the pooled-APE balance. By calling ApeCoinStaking.depositApeCoin() with the protocol's own proxy cAPE position as the _recipient, the attacker inflated the pool's stakedAmount (~851,662 → ~3,183,876 APE, roughly +373%), which inflated the rebasingIndex and therefore the reported value of pcAPE collateral, letting borrow() extend loans far beyond the collateral's true worth. This is the same book-value inflation family as Cream (2021) and Summer.fi (2026) — a donation-style deposit lifts a share/rebasing valuation with no real backing. See techniques/T9.001-oracle-price-manipulation.md). OAK-T9.002 (Flash-Loan-Enabled Exploit — the working capital that made the inflation profitable in a single transaction). OAK-T5.004 (Sandwich / MEV Extraction — in the defensive sense: BlockSec used MEV-style transaction-ordering and a redeployed copy of the attacker's exploit contract to land the rescue before the attacker could land a successful drain). The rescue is a whitehat-coordination case (mitigations/OAK-M35-whitehat-rescue-coordination.md).
Attribution: unattributed on the attacker side (pseudonymous address only; the attacker self-identified indirectly by messaging BlockSec for gas reimbursement, but no named individual or group). Confirmed on the defender side — this is one of the few OAK cases with direct, confirmed defender attribution: BlockSec publicly attributed the rescue to itself through its blog, X/Twitter, and engagement with industry coverage, and ParaSpace confirmed the rescue and the return-to-multisig. The rescue-transaction trace (a redeployed exploit contract extracting to a BlockSec address, then returning to a ParaSpace multisig) is reproducible on-chain.
Key teaching point: This was an active-adversary rescue in which the attacker was present and failing, not a pre-exploit discovery with no adversary — and the mechanism was collateral-value inflation, not reentrancy. Both facts were previously misrecorded and matter for what the case teaches. First, the vulnerability was a book-value oracle problem: the protocol trusted a rebasing collateral valuation that a self-directed depositApeCoin could inflate ~373% with no real backing, so borrow() paid out against phantom collateral. The load-bearing control is a manipulation-resistant collateral valuation — a rebasing/share index that cannot be moved by an attacker-controlled deposit into the protocol's own position, plus flash-loan-resistant borrow accounting (M09). Second, the rescue succeeded only because the attacker's own attempts kept reverting on gas, buying BlockSec the window to reverse-engineer, redeploy the exploit, and land it first. That is a different and more fragile primitive than a clean pre-exploit interception: it depends on the adversary failing. It is distinct from the Ronin 2024 in-mempool rescue (front-running a working exploit transaction already in the mempool) and from the Euler 2023 post-exploit recovery negotiation. OAK does not have a clean "pre-exploit, no adversary present" worked example; ParaSpace is not one, and should not be cited as one.

Summary

ParaSpace (later Parallel Finance) was an NFT / hybrid lending protocol on Ethereum, allowing borrowing against NFT and ERC-20 collateral, including cAPE — a wrapper over staked ApeCoin. ParaSpace valued cAPE collateral through a rebasing index computed from the pool's total pooled-APE balance divided by total shares (getPooledApeByShares).

The flaw was that this pooled-APE balance could be inflated by anyone. On 2023-03-17, an attacker called ApeCoinStaking.depositApeCoin() specifying the protocol's own proxy cAPE position as the _recipient, which increased the pool's stakedAmount from roughly 851,662 to 3,183,876 APE (~+373%). Because the rebasing index read that inflated stakedAmount, the reported value of pcAPE collateral rose far above its true worth, and ParaSpace's borrow() would extend loans against the phantom collateral. The position was sized with flash-loaned capital so the whole sequence resolved in one transaction.

The attacker's exploit transactions failed repeatedly on insufficient gas — the attack was computationally heavy, and across successive attempts the attacker raised the gas limit (reportedly ~6.7M → 9M → 13M) but kept reverting, coming close by the final try. BlockSec's on-chain monitoring caught the active attack. Rather than rely on the attacker continuing to fail, BlockSec reverse-engineered the exploit, redeployed a working version of the attacker's own attack contract, executed it to extract the **2,906 ETH ($5M)** at risk to a BlockSec-controlled address, and returned the funds to a ParaSpace multisig. BlockSec first reported the event around 06:50 UTC. ParaSpace acknowledged the rescue, confirmed the return, and time-locked large withdrawals as a follow-up control. The attacker subsequently sent BlockSec an on-chain message requesting ~0.7 ETH of gas fees back.

Timeline (UTC)

When	Event	OAK ref
(standing)	ParaSpace values cAPE collateral via a rebasing index read from the pool's `stakedAmount`, which a self-directed `depositApeCoin(_recipient = proxy position)` can inflate	(standing T9.001 surface)
2023-03-17 ~03:51–04:36	Attacker makes multiple exploit attempts, inflating `stakedAmount` ~851,662 → ~~3,183,876 APE (~~+373%) to borrow against inflated cAPE collateral; transactions revert on insufficient gas (limit raised ~6.7M → 9M → 13M across attempts)	T9.001 + T9.002 (attempted)
2023-03-17 ~06:50	BlockSec's monitoring detects the active attack; BlockSec publicly reports it	(defender detection)
2023-03-17 (rescue window)	BlockSec reverse-engineers and redeploys the attacker's exploit contract, extracts ~~2,906 ETH (~~$5M) to a BlockSec-controlled address before the attacker lands a successful drain	T5.004 defensive-MEV rescue
2023-03-17 (within hours)	Rescued funds returned to a ParaSpace multisig; ParaSpace acknowledges the rescue	near-total recovery (~100%)
2023-03-17 onward	ParaSpace time-locks large withdrawals; deploys fix to the collateral-valuation surface	(operator response)
post-event	Attacker messages BlockSec requesting ~0.7 ETH of gas fees back ("I lost a lot of money trying to make it work")	(attacker self-identification, indirect)

What defenders observed

Pre-event (a collateral valuation an attacker could inflate). The root cause is a book-value oracle problem, not reentrancy: the rebasing index that valued cAPE collateral read a pooled-APE balance that any caller could raise by depositing into the protocol's own position. The control is a manipulation-resistant valuation — the collateral's reported value must not move in response to an attacker-controlled deposit — combined with flash-loan-resistant borrow accounting so a single-transaction inflation cannot be borrowed against (M09).
At-event (the drain was gas-heavy and kept failing). The attacker's attempts reverted on gas across escalating limits. That failure is the only reason a rescue window existed at all. Defenders should not generalise from this to "rescue is reliably possible" — the window was a gift from the adversary's own execution failure, not something the defender manufactured.
At-event (active monitoring, not code review, was the trigger). BlockSec's detection came from on-chain/mempool monitoring of an in-progress attack, not from a scheduled audit. The detection surface is runtime anomaly monitoring — a borrow against a collateral position whose value jumped implausibly in the same transaction it was funded is the diagnostic signal, and it is the same signal that would flag any book-value inflation.
Response (redeploying the adversary's exploit is a real but fragile rescue primitive). BlockSec rescued by copying and landing the attacker's own exploit first. This works only when the defender can reverse-engineer the attack faster than the adversary can fix it, and when the adversary is not already succeeding. It is distinct from front-running a working exploit already in the mempool (Ronin 2024) and from negotiating a return after extraction (Euler 2023). Its prerequisites are stricter and adversary-dependent.
Response (operator preparation bounded the outcome). ParaSpace was positioned to receive rescued funds at a multisig, acknowledge publicly, and follow up with a withdrawal time-lock. Operator-side preparation — designated multisig, pre-drafted disclosure, whitehat-protection posture — is what turns a successful rescue into a cleanly closed incident (M35).

Public references

[blocksecparaspace2023] — BlockSec, "Blocked ParaSpace Attack: the industry's most important block that rescued $5,000,000" / "A Race Against Time" (primary defender write-up: rebasingIndex manipulation, depositApeCoin _recipient inflation of stakedAmount ~851,662 → ~3,183,876, the failed gas attempts, redeploy-the-exploit rescue, 2,906 ETH): https://blocksec.com/blog/blocked-paraspace-attack-industry-s-most-important-block-that-rescued-5-000-000
[certikparaspace2023] — CertiK, "Aping Peril: The Price Manipulation Exploit with ParaSpace" (independent mechanism analysis confirming collateral-value/price manipulation, not reentrancy): https://www.certik.com/blog/aping-peril-the-price-manipulation-exploit-with-paraspace
[cryptoslateparaspace2023] — CryptoSlate, "ParaSpace hack in retrospect: $5M rescued, large withdrawals time-locked, hacker wants fees back" (active attacker, BlockSec interception and forced recovery via redeployed attack contract, withdrawal time-lock, hacker's 0.7 ETH gas-fee request): https://cryptoslate.com/paraspace-hack-in-retrospect-5m-rescued-large-withdrawals-time-locked-hacker-wants-fees-back/
[theblockparaspace2023] — The Block, "BlockSec prevents $5 million from being stolen on ParaSpace" (mainstream corroboration of loss-at-risk, rescue, and return): https://www.theblock.co/post/220761/blocksec-prevents-5-million-from-being-stolen-on-paraspace

Discussion

ParaSpace is corrected here on two points that the earlier record got wrong, and both change what the case teaches. The mechanism was book-value oracle manipulation (T9.001), not reentrancy: a rebasing collateral index that an attacker could inflate ~373% by depositing into the protocol's own cAPE position, then borrow against. That places ParaSpace squarely in the T9.001 book-value family with Cream (2021) and Summer.fi (2026) — the recurring shape where a share or rebasing valuation is lifted by a donation-style flow with no real backing, and a lending market pays out against the phantom value. The defensive lesson is the same across that family: value collateral by something an attacker-controlled deposit cannot move.

The second correction is the rescue framing. ParaSpace was previously filed as the canonical pre-exploit rescue — a whitehat discovering a bug via code review before any adversary existed. That is not what happened. There was an active attacker, mid-exploit, whose transactions were reverting on gas; BlockSec's monitoring caught the live attack, and BlockSec rescued by reverse-engineering and redeploying the attacker's own exploit contract to land the drain first. The attacker's own follow-up message asking for gas reimbursement is direct evidence of an active, failing adversary. So the honest classification is an active-adversary interception where the rescue depended on the adversary failing — a more fragile primitive than either the Ronin 2024 in-mempool front-run of a working exploit transaction or the Euler 2023 post-exploit negotiation. The corollary is that OAK's cross-window recovery taxonomy no longer has ParaSpace as its "pre-exploit, no adversary" anchor, because no such incident is what ParaSpace was; that slot is currently without a clean worked example, and contributors should not backfill it with this case.

What remains genuinely valuable and unchanged is the confirmed defender attribution (BlockSec, at operational-decision granularity) and the near-total recovery of ~$5M. The case is still one of OAK's best-documented whitehat rescues; it is simply a rescue of a price-manipulation drain by an active, failing attacker, not a reentrancy bug caught before anyone tried it.