SlowMist said an attack on a NEM token contract caused losses of about $821,900, BlockBeats reported on Oct. 22.
Accounting flaw exposed in NEM contract
The report said the NemTokenV2 contract counted tokens sent into a liquidity pool as sold without checking whether the swap had settled. The attacker repeated token transfers, skim() calls and flushLpSellRecycle() operations 42 times, according to SlowMist.
The attacker then sold remaining NEM at an inflated price for USDT. SlowMist identified the affected market as the PancakeSwap USDT/NEM pair. BlockBeats attributed the loss estimate and exploit description to SlowMist; the flash did not independently verify the incident.