2026-09-03 · record inc_0004 · updated 2026-10-19

Notional V1: integer overflow in a deprecated escrow contract

An attacker drained about 1.65 million USDC and 69,000 DAI from the escrow of the deprecated Notional V1.

Notional V1 EthereumComponent: Legacy escrow contract, fCash accounting

Event: Official statement
Root cause: Official statement
Loss: Official statement

Current status

Paused; recovery efforts ongoing.

Timeline

2026-09-03Drain; contract paused soon after.
2026-09-08Post-mortem published.

Root cause

Per Notional's post-mortem, a value that overflowed the type used in the escrow's accounting created an unbacked claim that settled as a real withdrawal.

Basis: official post-mortem · verified by us against that source

Classes: Arithmetic, overflow and rounding

Impact: loss and recovery

Funds left in the V1 escrow by users who had not withdrawn. Notional says no other product is at risk.

Reported loss

$1.73M

USD basis: Notional post-mortem, USDC and DAI.

Recovered or returned

None reported

Notional says nothing has been recovered.

Loss and recovery are separate figures. They are never netted, and amounts in different currencies are never added together.

Addresses and transactions

No addresses or transaction hashes have been verified for this record. We do not publish unverified hashes.

Associated code

src/test/2026-09/NotionalFinance_exp.solPublic reproduction file — open in the code reader

Public reproduction file

From the public reference dataset

File: NotionalFinance_exp.sol
Path: src/test/2026-09/NotionalFinance_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Status: Test or reproduction identified
Date: 2026-09-03
Licence: file UNLICENSED; repository Apache-2.0
Framework: Foundry
What it is: A public Foundry test that reproduces this incident against archived chain state. ThreatWire has not executed it. Use only for defensive research after your own review.
Dataset loss text: ~69,257.37 DAI + ~1,658,524.86 USDC (~$1.73M)

ThreatWire has not executed this file. Retrieved 2026-10-19 · blob 4b5b4335f55bafed937ff39888f620a0156fc93e.

Open in the code reader →

Remediation and defensive indicators

Contract paused. (reported)

Defensive lessons from the class

Use checked arithmetic and reject values that do not fit.
Check both sides of a trade.

Sources

Official post-mortem
Notional: Notional V1 exploit post-mortem
Published 2026-09-08 · retrieved 2026-10-19
Independent analysis
Quill Audits: Notional Finance integer overflow exploit
retrieved 2026-10-19
Independent analysis
BlockSec: Weekly exploit summary
retrieved 2026-10-19
Independent analysis
Foothold: Notional V1 integer truncation
retrieved 2026-10-19
Media report
BeInCrypto: Notional Finance exploit integer overflow
retrieved 2026-10-19
Media report
Olympix: Notional loss analysis
retrieved 2026-10-19

Similar incidents

Hemi Genesis Drop: reentrancy in the MerkleBox claim contractLinked by our editors

Read the full written analysis

Method, uncertainty and corrections

Still unknown

Whether funds can be recovered

Written by ThreatWire editorial. Facts attributed to the sources listed; figures are estimates and not independently verified unless marked on-chain. Published 2026-10-19, last updated 2026-10-19. Figures are estimates from public post-mortems and named analysts; not independently verified unless marked as confirmed on-chain.

No corrections recorded since publication.