Scallop Confirms Security Incident on Nemo Protocol's sCoin Pool

The Nemo protocol’s post-mortem clarifies a developer’s unaudited code caused the exploit, which led to a $2.59 million loss and triggered urgent security measures and compensation plans.

ETH
W

Summary

Nemo Protocol’s post-mortem reveals that a rogue developer’s unaudited code led to the September 7 exploit, resulting in a $2.59 million loss. Key vulnerabilities included a public flash loan function and a faulty pricing mechanism, allowing attackers to steal funds. The protocol has removed the flaws, initiated emergency audits, and promised compensation for affected users. Security practices will be strengthened going forward.

Terms & Concepts
  • Flash loan: A type of uncollateralized loan in decentralized finance (DeFi) that is borrowed and repaid within a single blockchain transaction.
  • MoveBit: A security audit firm responsible for reviewing code and identifying vulnerabilities in the Nemo Protocol before the exploit.
  • Wormhole CCTP: A cross-chain token bridge enabling the transfer of assets between different blockchains, in this case, used to move stolen funds to Ethereum.