Daily Brief

Web3 Daily Exploits — 05 Sep 2026: Notional $1.7M Overflow + Dream Health $72k Logic Drain

Notional Finance lost ~$1.73M on Ethereum via an unsafe uint128 downcast in free-collateral checks. A separate ~$72k logic flaw drained Dream Health Chain awards on BSC.

Jacobo Avariento

Jacobo Avariento

— 3 min read
Web3 Daily Exploits — 05 Sep 2026: Notional $1.7M Overflow + Dream Health $72k Logic Drain

Notional Finance lost ~$1.73M on Ethereum via an unsafe uint128 downcast in free-collateral checks. A separate ~$72k logic flaw drained Dream Health Chain awards on BSC.

Two confirmed incidents were reported or materially updated in the last 24 hours. The larger loss hit a legacy Notional V1 escrow on Ethereum; the smaller struck a BNB Chain project’s award state machine. Funds from the primary exploit moved rapidly into Tornado Cash. No major bridge or oracle failures were newly confirmed in the window.

Notional Finance — ~$1.73M (Ethereum) — Confirmed

What happened: An attacker drained the legacy V1 escrow contract of Notional Finance by exploiting an integer truncation in free-collateral valuation.

Protocol / chain / asset: Notional Finance (legacy V1 escrow) on Ethereum. Assets: DAI and USDC.

Loss: Approximately $1.73 million (69,257 DAI + ~1.658M USDC). Funds were swapped for ~689.2 ETH and deposited into Tornado Cash. No recovery or rollback reported.

Attack type: Arithmetic error / unsafe type cast in free-collateral accounting.

Technical details: The attacker used two mintfCashPair() calls to create a −2^128 liability. An unsafe uint128() downcast in the free-collateral valuation path truncated the absolute value to zero, allowing the account to appear solvent. The attacker then settled matured assets and withdrew the real stablecoin balances from the escrow. Key transactions: setup at block ~25,900,220 and drain shortly after.

Explorer links:

Status: Confirmed by multiple firms. Funds mixed. No official project statement observed in the window.

Sources: https://x.com/CertiKAlert/status/2095797115788443893, https://x.com/PeckShieldAlert/status/2095678080241303915, https://x.com/GoPlusSecurity/status/2095805157732675843

Dream Health Chain — ~$71.8k (BNB Chain) — Confirmed

What happened: An attacker repeatedly claimed the same fixed reward from a business-award contract by resetting claim status.

Protocol / chain / asset: Dream Health Chain (award / farm contracts) on BNB Chain. Loss denominated in USDT equivalent (~71,851 USDT after conversion from DHC tokens).

Loss: ~$71.8k. Funds remained in the attacker wallet at time of reporting; no mixer or CEX exit observed in initial alerts.

Attack type: Business-logic / state-machine flaw (repeatable claim via status reset).

Technical details: createAward() recorded a fixed reward without locking collateral or a per-award reserve. participateAward() did not require the award to be unclaimed, allowing a claimed award (status=2) to be reset to status=1. claimAward() then paid the fixed amount again from the shared proxy balance. Reset cost was as low as 0–1 wei. Single-block execution observed.

Addresses (BSC):

Status: Confirmed by SlowMist. Funds still held by attacker at alert time.

Sources: https://x.com/SlowMist_Team/status/2096152539767120259

Also noted

  • DarkSword / iOS Safari wallet-targeting campaign (UPDATE): SlowMist reported continued n-day reuse of the DarkSword six-CVE chain against iOS 18.4–18.6.2 Safari users via a decoy “free VPS” page. Post-exploitation plugins target Keychain and keyboard input from wallets such as imToken, TokenPocket, and TronLink. Not a new on-chain protocol exploit; operational phishing / malware risk. Source: https://x.com/SlowMist_Team/status/2095829317544824953
  • Older Term Labs and Tectonic-related fund movements into Tornado Cash were observed but are not new primary incidents within the 24-hour window.

Sources & references

Editor’s note: Quiet relative to prior weeks. Both incidents were pure logic / arithmetic failures rather than key compromise or bridge verification failures. Legacy code surfaces continue to present residual risk even after protocol upgrades or rebrands. No how-to material is included.

Read more