---
id: 5303
title: "Pandora NFT: BugFix Review"
source_domain: hackenproof.com
source_url: "https://hackenproof.com/blog/pandora-nft-bugfix-review"
published_at: "2026-06-11 10:26"
tags: ["web3", "vulnerability-research", "defi", "smart-contract", "vulnerability-disclosure", "bugfix", "bsc", "defi-security", "nft"]
phying_url: "https://phying.com/item/5303"
lang: en
---

# Pandora NFT: BugFix Review

## Summary

A bugfix review of Pandora NFT's BondRouter: duplicate NFT Security IDs passed to harvest let an attacker reuse one bond to inflate interest payouts; lastHarvest is now updated per loop iteration.

## Intelligence Metadata

- **Sources:** hackenproof.com
- **Published:** 2026-06-11 10:26
- **Original:** https://hackenproof.com/blog/pandora-nft-bugfix-review
- **Phying News:** https://phying.com/item/5303