Digital Asset
Intelligence
Security Incident · ETH Ecosystem

Nowswap K value verification vulnerability: $1.00M Reported Loss

·Historical incident record

Incident Overview

Nowswap, a decentralized exchange on Ethereum, was attacked by a flash loan. The attacker emptied Nowswap’s liquidity pool. The liquidity pool was reduced from US$1,069,197 to US$24.15. The attacker made a profit of 536,000 USDT and 158 WETH. A total of more than 1 million US dollars. The attacker used the K value verification vulnerability in the Nowswap USDT/WETH transaction pair contract to perform multiple exchanges, and each exchange obtained multiple times the normal due assets, until the assets in the trading pair pool were exhausted.

Sources & References

Original incident referencehttps://twitter.com/PuPuThrashing/status/1438058002817323009 (opens in a new tab)

This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.

More Security Incidents

View All →
  1. Incident date
    Attack methodSecurity Vulnerability
    Reported lossNot disclosed
  2. Incident date
    Target

    MISO

    Attack methodMalicious Code Injection Attack
    Reported lossNot disclosed
  3. Incident date
    Target

    pNetwork

    Attack methodContract Vulnerability
    Reported loss277 BTC
  4. Incident date
    Attack methodContract Vulnerability
    Reported loss$ 35,000,000
  5. Incident date
    Attack methodContract Vulnerability
    Reported lossNot disclosed