What happened
On June 9, 2026, NovaBox's Ethereum reward pool lost approximately 56.73 ETH (about $107,000), affecting 133 depositors and reducing the pool from 65.11 ETH to 0.09 ETH.
Technical root cause
NovaBox distributed dividends before fully updating the depositor's stake balance. The attacker could therefore make the reward calculation use a stale small position while payout accounting used the newly inflated position, creating a phantom dividend. A constructor-based execution path also bypassed checks intended to reject contract callers.
How it happened
- The attacker used a 427.5 WETH Aave V3 flash loan, made a small NOVA deposit and then a much larger ETH deposit, and exploited the reward flow's timing.
- A phantom dividend of about 145.82 ETH was calculated against the reward pool; approximately 56.73 ETH was realized and extracted in one transaction.
Protocol details
Classification
Protocol Logic
Protocol Type
Chain
Implementation language
Solidity
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
