NEX token on BNB Chain exploited via double-spend logic error in _transfer function, draining ~$59.6K from the NEX/AIC liquidity pair.
Security & Exploits ·
The NEX token on BNB Chain was exploited through a logic error in its _transfer function, resulting in the loss of approximately $59.6K from the NEX/AIC liquidity pair. The vulnerability allowed tokens to be transferred twice when routed through PancakeSwap: the function executed a transfer to the router and then continued execution to perform an unconditional second transfer of the same amount, bypassing the intended single-transfer logic.
The attacker leveraged this double-spend flaw by flash-borrowing AIC, purchasing NEX, and donating NEX into the pool before calling pair.skim(router). Since skim directs output to the router address, the second unintended transfer executed, draining the pair's entire NEX reserve to a balance of 1 token while the AIC reserve remained at approximately 83 million. This extreme imbalance allowed the attacker to purchase the entire remaining AIC reserve using only a small amount of NEX.
The attacker subsequently exchanged the acquired AIC for approximately 32.36 WBNB. The exploit's success depended entirely on the control-flow flaw in the token's transfer mechanism; without the accidental double-execution, the pool's reserves would have remained balanced and the attack would not have been possible. The incident highlights how subtle implementation errors in token contracts can create critical vulnerabilities in liquidity pools.