NEM Token Contract Exploit Causes About $821,920 in Losses

An exploit of NEM’s NemTokenV2 contract caused an estimated $821,920 loss after an attacker manipulated the NEM balance in a USDT trading pool and sold tokens into the distorted market. A transfer-handling flaw in NemTokenV2 let the attacker exploit incomplete swap settlement checks. The attacker ran transfer, skim and flush operations in a loop, repeating the sequence 42 times. Those actions sharply lowered NEM reserves in the PancakePair USDT/NEM pool and updated the pool’s recorded reserve figures. With the pool reserves reduced and its accounting changed, the attacker sold the remaining NEM at a manipulated higher price and received USDT.

Source: TokenPost