Notional Finance Hit by $1.7 Million Exploit From Integer Overflow Bug
An attacker drained roughly $1.73 million from Notional Finance’s legacy escrow contract early Friday, exploiting a coding flaw that made an infinite fabricated debt register as zero.
The stolen DAI and USDC turned about 689 ether (ETH). The funds then went via Tornado Cash, a service that breaks the path between wallets. Notional has stated nothing publicly.
How the Notional Finance Exploit Worked
Notional Finance is a fixed-rate lending protocol on Ethereum. Its first model recorded future money obligations as tokens referred to as fCash. The system screened debtors for collateral earlier than letting them add debt.
That screening transformed debt into ether phrases via a uncooked uint128 conversion. Two mints summed to precisely two raised to the facility of 128. That is the only worth the conversion flattens to zero, QuillAudits discovered.
A checked conversion would have rejected the determine as a substitute of quietly dropping its digits. Notional used the safer methodology elsewhere in the identical file, in accordance with the write-up.
The account then learn as debt free. Etherscan information present the setup landed at 11:58 p.m. UTC Thursday and the withdrawal three minutes later.
That second transaction moved 69,257 DAI and 1,658,524 USDC out of the escrow. The attacker additionally tipped block builder Titan 0.07 ETH to route the commerce privately.
Security agency PeckShield relayed a warning from on-chain monitor Specter. The escrow now holds about $60,600 in leftover tokens.
Dormant V1 Contracts Still Held Real Money
Notional wound down its third model after the November 2025 Balancer exploit cascaded into its vaults. The V1 contracts stayed reside and funded, and no one swept them.
Independently audited protocols nonetheless account for most crypto hack losses, so an previous evaluation provided no cowl right here. June introduced an in depth parallel, when an attacker drained legacy Solana pools at Raydium.
Notional’s NOTE token trades close to $0.0065, up 3.5% over 24 hours, on a market worth near $400,700.
Notional had issued no assertion, loss determine, or autopsy at publication. Whether the drained money belonged to customers, the treasury, or a 3rd social gathering stays unconfirmed.
The submit Notional Finance Hit by $1.7 Million Exploit From Integer Overflow Bug appeared first on BeInCrypto.
