Novo Defi Incident Analysis

On 29 May 2022 Novo Defi's NOVO token was drained in a flash-loan exploit that leveraged a commented-out allowance check in transferFrom(), allowing the attacker to manipulate the PancakeSwap pair and extract ~278 BNB (~$83K). After a relaunch, an untested reward-update function deployed on 11 October 2022 created a 500x token accounting change that opened a mempool-detected arbitrage opportunity, enabling a bot to capture ~61 WBNB (~$16K). The report details transaction flows, smart-contract weaknesses, and tracing of stolen funds to an EOA and Tornado Cash, and concludes with recommendations for audits and rigorous testing.