# Notional V1: fCash mint overflow drains escrow

Notional V1 minted unbacked ERC-1155 fCash pairs on transfer from empty accounts; a ~2^128 short overflowed the uint128 cash ladder, settling into real DAI/USDC claims that drained ~$1.73M from escrow.

- Payout: Real-world hack
- Severity: critical
- Program: NotionalFinance
- Disclosed: 2026-09-03
- Write-up quality: 8/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-09/NotionalFinance_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260903-notionalfinance
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:precision-loss

**Target:** Notional V1 ERC-1155 fCash / Portfolios / Escrow contracts on Ethereum mainnet
**Root cause:** ERC1155Trade.safeTransferFrom books a transfer as a minted CASH_PAYER/CASH_RECEIVER pair even when the sender holds no such token, and the escrow nets each account's fCash in uint128 cash ladders; minting a short near 2^128 overflows that ladder, leaving an unbacked long that settles as a real cash claim with no offsetting debt.
**Steps:**
1. Deploy orchestrator + four helper contracts (A1 seed, B_HUB mule, C_DAI, D_USDC) and set ERC-1155 approvals so B_HUB can mint to C/D.
2. Read escrow's live DAI/USDC balances to size the drain.
3. Encode fCash ids via `encodeAssetId(2,0,maturityNear,0xA8)` (CASH_PAYER) and `encodeAssetId(3,0,maturityNear,0xA8)` (CASH_RECEIVER).
4. Seed a 1-unit pair: `safeTransferFrom(this, A1, idPayerNear, 1, "")`.
5. Seed ~2^128 pair on far market: `safeTransferFrom(this, B_HUB, idPayerFar, type(uint128).max, "")` — the uint128 netting wraps.
6. Push overflowed shorts from B_HUB to C_DAI and D_USDC so each ends holding an unbacked CASH_RECEIVER long sized to escrow balance.
7. After maturity (~73s later), call `Portfolios.settleMaturedAssets(helper)` then `Escrow.withdraw(token, amount)` and transfer DAI/USDC to attacker EOA.
**How found:** Not stated in text; PoC reconstructs the on-chain attack from the two incident transactions, implying the attacker spotted that ERC-1155 fCash transfers mint pairs regardless of sender balance and that the uint128 cash ladder could be wrapped.
**Exploitation:** Two permissionless txs from attacker EOA 0xDaCC235a...: TX1 (block 25900220) deploys helpers and mints the overflowed fCash pairs (no ERC-20 moves); TX2 (block 25900234) after maturity settles the unbacked longs into cash and withdraws 69,257.37 DAI + 1,658,524.86 USDC (~$1.73M) from the Notional escrow to the attacker. No privileged path used.
**Escalation:** Sized the fake claim to the escrow's entire live token balance per currency, draining both DAI and USDC markets in one incident.
**Insight:** When a protocol represents debt/claims as transferable ERC-1155 tokens, check whether transferFrom mints the offsetting pair without verifying the sender actually holds the token — then look for fixed-width (uint128/int128) netting ladders where a near-max short can wrap and leave an unbacked long that settles to real cash.