Briefing
A recent security incident has impacted the Nemo Protocol, a yield trading platform on the Sui blockchain, resulting in a loss of approximately $2.59 million in USDC. The exploit leveraged a critical vulnerability within unaudited code deployed under single-signature control, allowing an attacker to manipulate the protocol’s state. This incident necessitated the immediate suspension of all smart contract activity to prevent further financial damage and has prompted the team to develop a patch and design a compensation plan for affected users.
Context
Prior to this incident, the prevailing risk factors in the DeFi ecosystem included the deployment of unaudited smart contracts and the use of centralized administrative controls, such as single-signature deployment processes. The Nemo Protocol itself had a known vulnerability, identified in a preliminary report by auditor Asymptotic, which was not adequately addressed by the development team. This oversight created a significant attack surface, enabling the exploit to proceed unchecked.
Analysis
The incident’s technical mechanics involved the compromise of Nemo Protocol’s market pool on the Sui blockchain. An unaudited function, specifically get_sy_amount_in_for_exact_py_out , was deployed without proper multisignature controls, requiring only a single developer’s signature. This flaw allowed the attacker to invoke arbitrary calls, manipulate the protocol’s state, and execute suspicious withdrawals, likely through price manipulation on its lending protocol. The attacker successfully drained approximately $2.59 million in USDC, subsequently bridging these funds from Arbitrum to Ethereum and converting them into DAI and ETH to complicate tracing and asset freezing efforts.
Parameters
- Protocol Targeted → Nemo Protocol
- Attack Vector → Unaudited Code, Single-Signature Deployment, State Manipulation
- Financial Impact → $2.59 Million
- Affected Blockchain → Sui
- Asset Drained → USDC
- Date of Exploit → September 7, 2025
Outlook
Immediate mitigation for users involves refraining from interacting with the Nemo Protocol until full functionality and security are confirmed through official channels. This incident underscores the critical necessity for rigorous, independent smart contract audits and the implementation of robust multi-signature governance for all sensitive protocol actions, particularly code deployments. Moving forward, the industry must establish higher standards for code review and deployment procedures to prevent similar vulnerabilities from being introduced, thereby enhancing the overall security posture of DeFi protocols and mitigating contagion risk across interconnected ecosystems.
