Nemo $2.4M hack exposes gaps in smart contract auditing

The crypto community is buzzing about a painful incident: the Nemo platform suffered a major hack that led to serious consequences for project participants. This article provides up-to-date details, the causes, and the Nemo team's response to the crisis.

As we reported a few days ago, the decentralized Nemo protocol was forced to suspend its contracts after attackers drained approximately $2.59 million in USDC stablecoins from its pools.

The Nemo team has now published a detailed report on the causes and progression of the incident. It states that the main issue was a vulnerability in the unaudited code of one of the protocol's smart contracts responsible for token valuation inside one of the protocol’s pools.

The contract lacked proper validation checks for price data. This allowed the attackers to use specially created contracts to change the internal market parameters, enabling them to withdraw a large sum of funds. A critical factor was that this section of the code had not undergone an independent audit and was not discovered by the developers in time.

According to the official report, the attackers exploited a bug in the fairPrice function, which is responsible for token pricing. As a result, they were able to distort the calculations and perform a series of transactions in which funds were moved from the platform to external addresses. According to Nemo representatives, this vulnerability was absent from the protocol's main logic, so only one of the additional modules, which the developers did not pay much attention to, was affected.

After the hack, the Nemo team promptly suspended all contracts and engaged external experts to investigate and analyze the incident. Some of the stolen funds have been traced, though a significant portion remains under the attackers’ control.

Currently, the team is conducting a full audit of all protocol modules, implementing new security checks, and collaborating with crypto exchanges to prevent stolen funds from being laundered. Nemo has also contacted law enforcement and is working toward recovering user assets.

The project emphasizes that they are open to an honest dialogue with the community and are counting on cooperation with other market participants to minimize losses and prevent similar incidents in the future.