SlowMist issued a security alert saying NEM was exploited, with losses estimated at about $821,920. According to the alert, the root cause was a flaw in NemTokenV2: tokens transferred into the liquidity pool were counted as sell volume, but swap settlement was not verified. SlowMist said the attacker abused that gap by repeatedly carrying out a sequence of transfers, calling skim() to remove transferred tokens, and invoking flushLpSellRecycle(). The sequence was executed 42 times. The alert said those actions wiped out the liquidity pool’s original reserves and pushed down NEM reserve balances. After that, the attacker sold the remaining NEM at an inflated price and withdrew USDT. The disclosure was cited by ChainCatcher in a market analysis newsflash.
SlowMist issued a security alert saying NEM suffered an exploit, with losses of about $821,920.
Flaw tied to LP sell-volume accounting
According to the alert, the root cause was that NemTokenV2 counted tokens sent into the liquidity pool, or LP, as sell volume, but did not verify swap settlement.
Attack sequence was repeated 42 times
SlowMist said the attacker used the flaw to repeat a sequence 42 times: making transfers, calling skim() to clear the transferred tokens, and calling flushLpSellRecycle().
The alert said those actions destroyed the liquidity pool’s original reserves and pushed down NEM reserve balances. The attacker then sold the remaining NEM at an inflated price and extracted USDT.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
