🚨 On September 4, 2026, the well-known decentralized lending protocol @NotionalFinance was attacked, resulting in a loss of approximately $1.73 million. The SlowMist Security Team has fully analyzed the incident. 🧩 Attack flow: 1️⃣ In a preceding transaction, the attacker deployed auxiliary contracts and called setApprovalForAll on ERC1155Trade to authorize them, after querying two CashMarket maturities and the required AssetIds. 2️⃣ First safeTransferFrom: minted an fCash pair with amount 1 (maturity Sep 4, 2026). The position was too small and rounded to 0 in ETH terms, so the free-collateral check passed. 3️⃣ Second safeTransferFrom: minted an fCash pair with amount uint128.max at a different maturity (Dec 3, 2026), so the two liabilities would not be added in the same bucket and revert under SafeMath. 4️⃣ mintfCashPair then checked free collateral. The two liabilities summed to -2^128, overflowed to 0 when converted to ETH, and the protocol treated the account as healthy. 5️⃣ Receiving contract 2 split the large claim to two auxiliary contracts. The payer was now contract 2, which already held a positive claim, so the check passed and the two contracts received receiver fCash. 6️⃣ In a second transaction, the attacker settled those two positions, increasing the cash balances in Escrow, then called withdraw to realize the profit. ⚙️ Root Cause: ExchangeRate._convertToETH does uint128(balance.abs()) on Solidity 0.6.x with no range check. When the liability is -2^128, 2^128 truncates to 0, so mintfCashPair only sees free collateral ≥ 0 and allows an unbacked position. 🔒 SlowMist Insight: A successful cast is not a successful valuation. Reject any abs() result above type(uint128).max, use SafeCast, and test extremes such as uint128.max and -2^128. Collateral ≥ 0 is not the same as collateral that is real. Full analysis👇 https://slowmist.medium.com/the-vanishing-debt-an-analysis-of-the-notional-finance-hack-a79b00fa2e47(SlowMist)