NovaBox reward pool was hacked and lost 56.73 ETH

On June 9th, the NovaBox reward pool was hacked on Ethereum, resulting in a loss of approximately 56.73 ETH and affecting over 130 deposit users. The attacker depleted the funds in the pool from 65.11 ETH to 0.09 ETH through a single transaction, accounting for approximately 99.86%. Security company F12 stated that the incident was caused by a defect in the reward distribution mechanism. The attacker borrowed 427.5 WETH through Aave V3 Lightning Loan and exploited a loophole in NovaBox's mechanism of distributing dividends before updating the balance when users deposit or withdraw funds.