SlowMist: NEM loses approximately $822,000 in attack as attacker profits from manipulating liquidity pool reserves

SlowMist released a security alert warning that the NEM token contract suffered an attack, causing losses of approximately $821,920. The root cause stems from NemTokenV2 recording tokens transferred into the liquidity pool (LP) in the sell volume without verifying swap settlement. Exploiting this vulnerability, the attacker repeatedly executed transfers, called skim() to clear the incoming tokens, and called flushLpSellRecycle() a total of 42 times, depleting the pool's original reserves and suppressing the NEM reserve balance. The attacker then sold the remaining NEM at the inflated price to extract USDT.