NEX token exploited for ~$19K via double-spend logic error in _transfer function; attacker flash-borrowed AIC, manipulated NEX/AIC pair via router exploit, and extracted AIC reserve.
Security & Exploits ·
A logic error in the NEX token's _transfer function enabled an attacker to extract approximately $19,000 from a liquidity pool on BNB Chain. The vulnerability stemmed from a fall-through bug where the function executed two consecutive token transfers for any interaction with the PancakeSwap router, effectively doubling token movement in a single transaction.
The attacker exploited this by flash-borrowing AIC tokens, purchasing NEX, and depositing NEX into the NEX/AIC pair before calling pair.skim(), which directed tokens to the router and triggered the double-spend. This maneuver drained the pair's entire NEX reserve to near-zero while the AIC balance remained at approximately 83 million, creating an extreme price imbalance. The distorted pool allowed the attacker to purchase the full AIC reserve with minimal NEX and subsequently convert the AIC to approximately 32.36 WBNB.
The incident highlights how control flow errors in token contracts can be weaponized through liquidity manipulation. The exact conditions that enabled the skim function to trigger the double-spend, and whether NEX's developers were aware of the code path, remain unclear.