NovaBox Reward Pool Drained of 56.73 ETH on June 9, Affecting 130+ Users

According to Bits.media, NovaBox's reward pool on Ethereum was drained of approximately 56.73 ETH on June 9 due to a flaw in the reward distribution mechanism, impacting over 130 depositors. A single transaction reduced the pool from 65.11 ETH to 0.09 ETH, representing a 99.86% loss. Security firm F12 confirmed the attack exploited a design flaw rather than a smart contract vulnerability.

The attacker borrowed 427.5 WETH via Aave V3 flash loan and exploited a timing gap in NovaBox's system: by depositing small amounts of NOVA tokens initially, then adding large amounts of ETH, the protocol calculated dividends based on an outdated balance while issuing payouts at the inflated share size, generating approximately 145.82 ETH in phantom dividends that depleted the reward pool.