NovaBox exploit analysis
NovaBox's constructor dividend checkpoint was readable from storage without a corresponding mint constraint, so the attacker reset the checkpoint at a manipulated rate and redeemed dividends against it. DeFiHackLabs reconstructs about 56.73 ETH drained on Ethereum.
- Reported loss
- 56.73 ETH, per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-06-09: Constructor Dividend Checkpoint Bypass on NovaBox”.
Analysis1 min read
NovaBox's constructor set an initial dividend checkpoint that was bypassable because the dividend accounting read it from storage without requiring that storage to have been minted into. The attacker deployed a fresh NovaBox, called a public function that incremented the dividend checkpoint at a manipulated rate, and redeemed dividends against the inflated checkpoint.
DeFiHackLabs reconstructs the sequence against the live Ethereum state; the drain is in 0x0cfa357e9e4db1540246f17cb6bfa0634ff8727d7cf241b63fb22605021c8844 on Etherscan for a total loss of about 56.73 ETH. Defimon Alerts reported the incident.
What would have prevented it: a constructor that requires the dividend checkpoint to equal a value derived from the constructor's own supply minting, so the checkpoint cannot be reset by any later call.
Sources read (3)
Other exploits
- Raydium exploit analysis $1.3M
- Secret bridge exploit analysis $4.7M
- Humanity Protocol exploit analysis $36M
- TOPBPool exploit analysis 9 Jun 2026
- AmbientCrocSwapDex exploit analysis 7 Jun 2026
- BOSS exploit analysis 6 Jun 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
