Nemo on Sui was drained of ~$2.59M when unaudited code left an internal flash-loan function publicly callable and a query function able to mutate state, enabling the attacker to drain the Market pool and bridge to Ethereum.