NEM token contract attacked, SlowMist says hackers profited about $820,000

BlockBeats news, October 22 - SlowMist issued a security alert stating that the NEM token-related contract has been attacked, resulting in losses of approximately $821,900. The root cause lies in a logic flaw in the NemTokenV2 contract: the contract directly counts tokens transferred into the liquidity pool as sell volume, but fails to verify whether the swap was actually settled.

The attacker exploited this vulnerability by repeatedly executing token transfers, calling skim() to remove excess tokens, and triggering flushLpSellRecycle(), among other operations, for a total of 42 repetitions, continuously draining the original NEM reserves in the liquidity pool while simultaneously reducing the reserve records, then selling the remaining NEM at inflated prices to extract USDT.

The affected trading pair disclosed by SlowMist is the USDT/NEM trading pair on PancakeSwap. Currently, the attacker's address is 0xfd929b0f270dfea6c4827262b4e2bf6ea50fe9b6, and the attack contract is 0x5e6d1f40be466dd2facc94a26818948ecd3b1ca2.