ChainCatcher 消息，据 Bits.media 报道，NovaBox 平台的奖励池于 6 月 9 日在以太坊上遭到黑客攻击，损失约 56.73 枚 ETH，超过 130 名存款用户受影响。攻击者仅通过一笔交易就将池中资金从 65.11 ETH 耗尽至 0.09 ETH，占比约 99.86%。
安全公司 F12 表示，此次事件并非源于智能合约漏洞，而是奖励分配机制中的缺陷。攻击者通过 Aave V3 闪电贷借入 427.5 WETH，利用 NovaBox 在用户存取款时先发放股息后更新余额的机制漏洞。黑客先存入少量 NOVA 代币触发股息计算，再存入大量 ETH 使实际份额大幅增加，但由于系统未及时更新余额，仍按之前的小额份额计算股息，却按新的大额份额进行支付，产生了约 145.82 ETH 的“幻影股息”，从而耗尽奖励池。
Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.