What happened
On May 29, 2022, an attacker exploited Novo DeFi's NOVO token on BNB Smart Chain using flash-loaned WBNB. A missing allowance check in transferFrom let the attacker disrupt the NOVO supply in the PancakeSwap pair, then sell NOVO at the distorted pool price. CertiK calculated the loss at about 278 BNB, or roughly $83,000 at the time.
How it happened
- The attacker flash-borrowed 17.2 WBNB and swapped it for NOVO.
- A vulnerable transferFrom path let the attacker pull about 113.95 million NOVO from the PancakeSwap pair without the intended allowance restriction.
- The reduced NOVO supply changed the pool economics, allowing the attacker to sell NOVO for 265 WBNB.
- After repaying the flash loan, the first run produced about 248 WBNB; a second run added about 30 BNB.
- The analysis traces the resulting 278 BNB to another EOA and then to Tornado Cash.
Protocol details
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
