$820K Drained: How a Logic Flaw Led to NEM Exploit

On October 22nd, blockchain security firm SlowMist issued a critical alert detailing an exploit against the NEM project, resulting in an estimated loss of $821,920. The incident stemmed not from an external breach but from a fundamental flaw within the project's own smart contract logic.

The Root Cause: Faulty Token Accounting

SlowMist's analysis pinpointed the issue to the sell-volume calculation in the NemTokenV2 contract. A critical design flaw was identified: when users deposited tokens into the liquidity pool (LP), these transfers were incorrectly registered by the system as "sell" transactions. However, the contract failed to validate the corresponding "swap settlement" that should follow.

In essence, the system mistakenly treated liquidity-providing actions as market sells, without the necessary subsequent checks. This discrepancy created the exploitable vulnerability.

The Attacker's Step-by-Step Playbook

The exploiter meticulously leveraged this logic gap through a series of orchestrated steps:

  • Step 1: Deposit and Purge Cycle: The attacker repeatedly executed transfers to deposit tokens into the liquidity pool.
  • Step 2: Critical Function Calls: They then immediately called the skim() function to remove the just-deposited tokens, followed by the flushLpSellRecycle() function to process the erroneous "sell recycle."
  • Step 3: Draining the Reserves: This cycle was repeated 42 times. This process gradually burned through the pool's existing token reserves while artificially suppressing the NEM balance within the pool.

Once the liquidity pool was depleted and the NEM reserve balance was driven to a critically low level, the price of the token in the pool became severely distorted and inflated. The attacker then sold their remaining NEM tokens at this artificially elevated price, ultimately extracting the equivalent value in USDT from the pool to complete the arbitrage.

Security Takeaway: The Imperative of Logic Validation

This incident underscores a persistent critical lesson in DeFi security: the most devastating vulnerabilities often lie not in breaking cryptographic algorithms but in missing validations for core business logic. For projects, beyond standard code audits, multi-dimensional stress testing that mirrors real-world financial interactions is crucial before deployment. For users, understanding the core mechanics and potential risks of any protocol remains the first and most vital line of defense for asset security.