SlowMist: NEM suffered a loss of approximately $822,000 due to an attack, with the attacker profiting by manipulating the liquidity pool reserves

SlowMist released a security alert stating that NEM suffered an attack, resulting in a loss of approximately $821,920. The root cause lies in NemTokenV2 recording the tokens transferred to the liquidity pool (LP) as sell volume without verifying the exchange settlement.

The attacker exploited this vulnerability, executing the transfer, calling skim() to clear the incoming tokens, and calling flushLpSellRecycle() a total of 42 times, destroying the original reserves of the liquidity pool and lowering the NEM reserve balance, and then selling the remaining NEM at an inflated price to withdraw USDT.