Briefing
The Nemo Protocol, a DeFi yield platform, experienced a significant security incident resulting in a $2.59 million loss. A rogue developer deployed unaudited code containing critical vulnerabilities, bypassing established internal review processes. This unauthorized deployment introduced a publicly exposed flash loan function and a query function capable of modifying contract state, which attackers subsequently leveraged. The incident highlights severe internal control failures and the profound impact of compromised development integrity on protocol security.
Context
Prior to this exploit, the protocol’s security posture was undermined by a lack of rigorous code review and deployment controls. A single-signature deployment address facilitated the activation of an unauthorized contract version, sidestepping multi-signature safeguards. This created a substantial attack surface, as a critical vulnerability (C-2) affecting core financial calculations remained unaddressed despite earlier identification by security researchers.
Analysis
The incident originated from a developer’s unauthorized deployment of unaudited code to the Sui blockchain. This code exposed a flash loan function as public, intended for internal use, and included a query function ( get_sy_amount_in_for_exact_py_out ) with unintended write capabilities. Attackers initiated a flash loan, then manipulated the protocol’s state via the vulnerable query function, specifically exploiting the py_index_stored variable. This chain of events allowed for the siphoning of $2.59 million in assets, which were subsequently bridged to Ethereum.
Parameters
- Affected Protocol ∞ Nemo Protocol
- Attack Vector ∞ Unaudited Code Deployment, Flash Loan Exploitation, State Manipulation via Query Function
- Financial Impact ∞ $2.59 Million
- Blockchain(s) Affected ∞ Sui (exploit origin), Ethereum (fund destination)
- Root Cause ∞ Rogue Developer, Internal Control Bypass
- Vulnerability Identified ∞ Public Flash Loan Function, State-Modifying Query Function (C-2 vulnerability)
- Funds Destination ∞ Hacker’s Ethereum address via Wormhole CCTP
Outlook
Immediate mitigation requires comprehensive re-audits of all deployed contracts and the implementation of stringent multi-signature controls for all future code deployments. Protocols must enforce strict separation of duties within development teams and conduct continuous monitoring for unauthorized code changes. This incident underscores the critical need for robust internal security frameworks, emphasizing that even formally audited code can be compromised by a failure in deployment integrity, leading to significant contagion risk across similar yield-generating DeFi platforms.
Signal Acquired from ∞ cryptonews.com
