NovaBox ($NOVA) — Flash Loan Dividend Exploit

Timeline: On June 9, 2026 at 18:48:59 UTC (Block 25281768), an attacker exploited a dividend distribution order flaw in the NovaBox ($NOVA) reward pool on Ethereum. The exploit ran entirely inside a constructor (method 0x60806040), bypassing NovaBox's anti-contract guard (require(extcodesize==0)) since code size is zero mid-deployment. The attacker flash-loaned 427.5 WETH from Aave V3, then exploited a critical ordering bug: on ETH deposit, NovaBox first snapshots the dividend baseline (while stake is still 0), distributes the 4% fee over the old _totalWei (excluding the new deposit), and only then credits the stake. This created a phantom dividend amplified ~8.53x by the ratio between the new stake and the old total. The attacker withdrew the inflated dividend, draining 65.11 ETH to 0.09 ETH (99.86% of the pool). 133 depositors were wiped. Net attacker gain: ~56.73 ETH ($93,600 at $1,647.87/ETH). Funds were withdrawn in three batches to intermediary addresses between June 10–12.