# Truebit: integer overflow in getPurchasePrice mints free TRU

Integer overflow in Truebit's getPurchasePrice (Solidity <0.8) returned zero price, letting attacker mint 240M TRU free and drain 8,535 ETH.

- Payout: Real-world hack
- Severity: critical
- Program: Truebit
- Credited: DeFiHackLabs
- Disclosed: 2026-01-09
- Write-up quality: 8/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-01/Truebit_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260109-truebit
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:reverse-engineering technique:source-review vuln:accounting-error vuln:business-logic vuln:precision-loss

**Target:** Truebit bonding-curve token sale contract (AdminUpgradeabilityProxy)
**Root cause:** getPurchasePrice computes numerator 200*T*A*R + 100*A*A*R in Solidity <0.8 without overflow checks; for large A the sum exceeds 2^256 and wraps, so price divides down to 0.
**Steps:**
1. Read decompiled 0x1446: price = (100*A*A*R + 200*T*A*R) / (25*T*T) with unchecked uint256 math.
2. Query THETA(), reserve() R, and TRU.totalSupply() T at fork block 24191018.
3. Solve for A such that numerator overflows: A ≈ sqrt(2^256/(100*R)) - T.
4. Call `getPurchasePrice(A)` — returns 0 wei.
5. Call `buyTRU{value:0}(A)` to mint A TRU for free.
6. Approve pool and call `sellTRU(A)` to receive ETH from reserve.
7. Loop while pool balance >= 0.1 ETH, recomputing A each iteration as reserve grows.
**How found:** Researcher inspected decompiled getPurchasePrice, noticed unchecked multiplication of amount, reserve and totalSupply in pre-0.8 Solidity, and derived the amount that pushes the numerator past 2^256 to force price to zero.
**Exploitation:** Attacker called getPurchasePrice with amount 240,442,509,453,545,333,947,284,131 which overflowed the numerator to yield price 0, minted 240M TRU for 0 ETH via buyTRU, then sold via sellTRU for 8.33 ETH; repeated with growing amounts draining 8,535 ETH total in one tx.
**Escalation:** Iterative loop recomputing overflow-triggering amount each round as reserve increased, scaling from 8.33 ETH to 8,535 ETH; a second attacker extracted a further 224k.
**Insight:** On pre-0.8 Solidity bonding-curve contracts, solve for input size where numerator terms (A^2*R, T*A*R) exceed 2^256 so price rounds to zero; loop with increasing amounts to drain reserve.