#NemoProtocol

🚨 Nemo Protocol Exploited for $2.6M Due to Unaudited Code 🚨

Sui-based DeFi platform Nemo Protocol revealed a $2.6M exploit on Sept. 7, caused by two vulnerabilities in unaudited code deployed by a developer. 😱

🔍 Post-mortem report highlights:

1️⃣ Exposed internal flash loan function

2️⃣ Flawed query function allowing unauthorized state changes

The issues, introduced in January, went unnoticed despite prior audits. A single-signature address for upgrades enabled the deployment without proper scrutiny. 😞

💸 The attacker manipulated the contract’s state, draining assets from the SY/PT liquidity pool and moving funds to Ethereum via Wormhole CCTP.

🛠️ Nemo has paused core functions, patched vulnerabilities, and is undergoing an emergency audit. The team is tracing funds and working on a compensation plan.

🔐 Lesson learned: Uncompromising scrutiny is crucial at every step, despite past assurances.