NemTokenV2 Exploit Drains About $820,000 From PancakeSwap Pool

An exploit drained about $820,000 from PancakeSwap’s USDT/NEM pool on BNB Chain as repeated calls to NemTokenV2 functions manipulated the pool’s reserves.

Loss estimates ranged from about $820,000 to $821,920. The attacker repeated the sequence for 42 cycles, then sold the remaining NEM for USDT.

The flaw counted tokens sent into the pool as sell volume even when no swap had settled. The pending balance remained after extra NEM was removed with the skim() function, allowing the attacker to manipulate the pair’s reserves.

The attacker repeated transfers, skim() calls and flushLpSellRecycle() calls 42 times, progressively reducing the pool’s NEM reserves. The resulting imbalance pushed the token’s price higher before the remaining NEM was sold for USDT.

PancakeSwap V2 pairs track stored reserves for both assets. The skim() function transfers token balances above those reserves, and its interaction with NemTokenV2’s accounting enabled the reserve manipulation.