NemTokenV2 liquidity accounting lets an attacker drain reserves

What happened

SlowMist estimates about $821,920 taken from NemTokenV2 on BSC. The contract treated tokens sent into its liquidity pool as completed sales without verifying that a swap had settled.

The researcher describes repeated transfers, pool withdrawals and reserve recycling that reduced the pool’s backing before the attacker sold the remaining tokens. This entry concerns the BSC contract called NemTokenV2. Its amount is an estimate, and its date follows the 22 October public alert.