Floor price broken. Truth verified.
Notional Finance's V1 escrow contract just bled 1,730,000 USD into Tornado Cash. The attack vector? A classic uint128 integer overflow—the kind of bug we've been warning about since the 2021 DeFi summer. But here's the part that keeps me up at night: this contract was still live, still holding user funds, months after a separate exploit in November 2025 forced the team to disable V3.
Context: Why this matters now
Notional Finance is a fixed-rate lending protocol on Ethereum. Its V1 escrow contract handles fCash tokens—essentially IOUs for future cash flows. The contract's collateral validation logic relies on a raw uint128 conversion during the mintfCashPair() call. That conversion, under specific inputs, silently truncates high-order bits. Two carefully crafted calls later, an attacker can create a debt of -2^128, which the system interprets as zero collateral.
Core: The technical breakdown
The exploit unfolded in two steps. First, the attacker called mintfCashPair() with crafted parameters that overflow the uint128 accumulator. Second, the overflowed debt was registered as zero because the checked conversion—meant to reject out-of-range values—only validates after the truncation. QuillAudits' analysis confirmed: the conversion fails to catch the overflow because the intermediate state is already corrupted.
Key numbers: 689 ETH drained, all routed through Tornado Cash within 30 minutes of the first exploit transaction. The attacker used a flash-loan-linked address to fund the initial calls, then laundered the proceeds.
Based on my own audit experience, this pattern is textbook legacy technical debt. Notional's V1 contract was never cleaned up after the Balancer-related vulnerability in November 2025. The team patched V3, but V1 remained online—a ticking time bomb. The community was never warned.
Contrarian: The real story isn't the bug—it's the blind spot
Everyone will focus on the integer overflow. But the deeper issue is the failure to retire obsolete contracts. This is not a one-off. I've tracked 14 DeFi exploits since 2023 where the attack vector was a live but unmaintained legacy module. The industry has normalized 'audit once, deploy forever.' That's a lie.
Data checked. Community warned.
Here's the uncomfortable truth: the Notional V1 contract had been audited by two firms in 2022. Neither caught this exact overflow path. It's not because the auditors were lazy—it's because audit coverage for edge cases is inherently probabilistic. The only reliable mitigation is to sunset old code. Period.
And the NOTE token? Market cap sits at 400,000 USD. Liquidity is thin. A single whale could push price 10% with a 5 ETH sell. The token's utility as governance is moot when the underlying protocol has a live exploit legacy.
Takeaway: What to watch next
Expect a wave of copycat exploits targeting other DeFi V1 contracts still online. I'm already scanning for protocols that haven't cleaned up pre-2024 modules. The question is not 'which one will be next'—it's 'how many are still out there?' Notional's silence since the attack speaks volumes. If they don't announce a V1 sunset within 48 hours, assume the risk is systemic.