NotionalFinance exploit analysis

Notional V1's escrow books an ERC-1155 fCash transfer as a minted pair: a CASH_PAYER (debt, assetType 2) leg on the sender and a CASH_RECEIVER (claim, assetType 1) leg on the recipient, even if the sender never actually held the token. Each account's fCash position is netted in uint128 cash ladders inside the escrow. Minting a short of value around 2^128 overflows that ladder, so the unbacked long on the counterparty settles at maturity as a real, withdrawable cash claim sized to the escrow's live holdings, with no offsetting debt left behind.

The attacker (EOA 0xDaCC235a494750193695A111D715c2ca12b5Ce38, funded via helpers 0x8aaf01B6F9AcC973274B8718BE4D1C1be10E3be6 and 0xC95496c917A41a394EfdAC3e0882F5903D24De69) ran the drain in two transactions on Ethereum mainnet, both fully permissionless. The first transaction (0xe1589a19fe742f0d553889214abade69551fe944acffac014c28cc07b325d60a on block 25900220) deployed the exploit contract and four helper accounts, then used IERC1155Trade.encodeAssetId and safeTransferFrom to mint the overflowed fCash pair. No ERC-20 left the protocol in this transaction; only the fCash positions were created. The fCash on the near market matured at timestamp 1788480000, ~73 seconds after the block.

The second transaction (0xc3f3e318f7ab2d0daaba59e6ec901d25d1fe8a89aafe2b2b62e3b9aee1a24efa on block 25900234) settled the unbacked long into cash via Portfolios.settleMaturedAssets for the four helpers, then withdrew the resulting DAI and USDC balances from the Notional escrow via Escrow.withdraw, forwarding ~69,257.37 DAI and ~1,658,524.86 USDC to the attacker EOA.

The arithmetic that overflows lives in Notional's own on-chain contracts. The PoC reconstructs both transactions as ordinary Solidity calling Notional's real functions directly: ERC1155Trade.encodeAssetId, safeTransferFrom, setApprovalForAll, Portfolios.settleMaturedAssets, Escrow.withdraw. The huge fCash sizes are read live from the escrow's own token balances, exactly as the attacker sized them.

The README totals the incident at ~$1.727M. Reported by Specter and PeckShield. The protocol bug is in the uint128 netting of fCash legs across accounts; the fix is to widen the netting type to a value that cannot be overflowed by a single minted position, or to enforce that a fCash transfer's payer actually holds the position being spent.